Setup Ingress resource and cert-manager integration

cert-manager/cluster-issuer-selfsigned.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cluster-issuer-selfsigned
+spec:
+  selfSigned: {}

deploy/base/ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ingress
+spec:
+  ingressClassName: nginx
+  # NOTE: overlays depend on the order of rule entries.
+  rules:
+  - host: grafana
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: grafana
+            port:
+              name: service

deploy/base/kustomization.yaml

@@ -59,3 +59,5 @@ resources:
 - inflated/grafana/templates/podsecuritypolicy.yaml
 - inflated/grafana/templates/configmap.yaml
 - inflated/grafana/templates/clusterrolebinding.yaml
+
+- ingress.yaml

deploy/dev/deploy-ingress-nginx.yaml

@@ -5,3 +5,6 @@
 - op: replace
   path: /spec/template/spec/containers/0/args/5
   value: "--configmap=$(POD_NAMESPACE)/dev-ingress-nginx-controller"
+- op: replace
+  path: /spec/template/spec/volumes/0/secret/secretName
+  value: dev-ingress-nginx-admission

deploy/dev/ingress.yaml

@@ -0,0 +1,15 @@
+- op: replace
+  path: /spec/ingressClassName
+  value: dev-nginx
+- op: add
+  path: /metadata/annotations
+  value:
+    cert-manager.io/cluster-issuer: cluster-issuer-selfsigned
+- op: replace
+  path: /spec/tls
+  value:
+    - hosts:
+      - grafana.local
+- op: replace
+  path: /spec/rules/0/host
+  value: grafana.local

deploy/dev/job-ingress-nginx-admission-create.yaml

@@ -2,3 +2,6 @@
 - op: replace
   path: /spec/template/spec/containers/0/args/1
   value: "--host=dev-ingress-nginx-controller-admission,dev-ingress-nginx-controller-admission.$(POD_NAMESPACE).svc"
+- op: replace
+  path: /spec/template/spec/containers/0/args/3
+  value: "--secret-name=dev-ingress-nginx-admission"

deploy/dev/job-ingress-nginx-admission-patch.yaml

@@ -2,3 +2,6 @@
 - op: replace
   path: /spec/template/spec/containers/0/args/1
   value: "--webhook-name=dev-ingress-nginx-admission"
+- op: replace
+  path: /spec/template/spec/containers/0/args/4
+  value: "--secret-name=dev-ingress-nginx-admission"

deploy/dev/kustomization.yaml

@@ -55,6 +55,12 @@ patches:
     name: ingress-nginx-admission-patch
   path: job-ingress-nginx-admission-patch.yaml
 
+# Patch the ingress resource with stage-specific hostnames:
+- target:
+    kind: Ingress
+    name: ingress
+  path: ingress.yaml
+
 # Patch Grafana deployment to inject PostgreSQL credentials:
 - target:
     kind: Deployment

deploy/prod/deploy-ingress-nginx.yaml

@@ -5,3 +5,6 @@
 - op: replace
   path: /spec/template/spec/containers/0/args/5
   value: "--configmap=$(POD_NAMESPACE)/prod-ingress-nginx-controller"
+- op: replace
+  path: /spec/template/spec/volumes/0/secret/secretName
+  value: prod-ingress-nginx-admission

deploy/prod/ingress.yaml

@@ -0,0 +1,16 @@
+- op: replace
+  path: /spec/ingressClassName
+  value: prod-nginx
+- op: add
+  path: /metadata/annotations
+  value:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+- op: replace
+  path: /spec/tls
+  value:
+    - hosts:
+      - grafana.netflux.io
+      secretName: prod-ingress-tls
+- op: replace
+  path: /spec/rules/0/host
+  value: grafana.netflux.io

deploy/prod/job-ingress-nginx-admission-create.yaml

@@ -2,3 +2,6 @@
 - op: replace
   path: /spec/template/spec/containers/0/args/1
   value: "--host=prod-ingress-nginx-controller-admission,prod-ingress-nginx-controller-admission.$(POD_NAMESPACE).svc"
+- op: replace
+  path: /spec/template/spec/containers/0/args/3
+  value: "--secret-name=prod-ingress-nginx-admission"

deploy/prod/job-ingress-nginx-admission-patch.yaml

@@ -2,3 +2,6 @@
 - op: replace
   path: /spec/template/spec/containers/0/args/1
   value: "--webhook-name=prod-ingress-nginx-admission"
+- op: replace
+  path: /spec/template/spec/containers/0/args/4
+  value: "--secret-name=prod-ingress-nginx-admission"

deploy/prod/kustomization.yaml

@@ -46,6 +46,12 @@ patches:
     name: ingress-nginx-admission-patch
   path: job-ingress-nginx-admission-patch.yaml
 
+# Patch the ingress resource with stage-specific hostnames:
+- target:
+    kind: Ingress
+    name: ingress
+  path: ingress.yaml
+
 # Patch prometheus-server pod to mount the secrets volume.
 - target:
     kind: Deployment