cert-manager/issuer-production.yml

@@ -1,5 +1,3 @@
-# Legacy issuer that is not managed by Kustomize.
-# For new certificates, prefer prod/clusterissuer.yaml.
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -11,6 +9,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-production
     solvers:
-    - http01:
+      - http01:
-        ingress:
+          ingress:
-          class: nginx
+            class: nginx

cert-manager/issuer-staging.yml

@@ -1,5 +1,3 @@
-# Legacy issuer that is not managed by Kustomize.
-# For new certificates, add staging/clusterissuer.yaml.
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:

deploy/prod/clusterissuer-staging.yaml

@@ -1,27 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    email: postmaster@netflux.io
-    privateKeySecretRef:
-      name: prod-letsencrypt-staging
-    solvers:
-    - http01:
-        ingress:
-          class: prod-nginx
-    - dns01:
-        route53:
-          region: eu-west-1
-          hostedZoneID: Z1OSEC2E6M9VER
-          accessKeyID: AKIARZPRT6YGHAENBEEX
-          secretAccessKeySecretRef:
-            # Using name reference transformers to manage this didn't work,
-            # probably because ClusterIssuer is a cluster-scoped resource.
-            #
-            # For now, this secret should be provisioned manually in the
-            # cert-manager namespace:
-            name: prod-aws-credentials
-            key: secret

deploy/prod/clusterissuer.yaml

@@ -1,27 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: postmaster@netflux.io
-    privateKeySecretRef:
-      name: prod-letsencrypt
-    solvers:
-    - http01:
-        ingress:
-          class: prod-nginx
-    - dns01:
-        route53:
-          region: eu-west-1
-          hostedZoneID: Z1OSEC2E6M9VER
-          accessKeyID: AKIARZPRT6YGHAENBEEX
-          secretAccessKeySecretRef:
-            # Using name reference transformers to manage this didn't work,
-            # possibly because ClusterIssuer is a cluster-scoped resource.
-            #
-            # For now, this secret should be provisioned manually in the
-            # cert-manager namespace:
-            name: prod-aws-credentials
-            key: secret

deploy/prod/kustomization.yaml

@@ -4,8 +4,7 @@ resources:
 - svc-db.yaml
 - svc-netflux.yaml
 - cm-ingress-nginx-tcp-services.yaml
-- clusterissuer.yaml
+
-- clusterissuer-staging.yaml
 configMapGenerator:
 - name: prometheus-server
   behavior: merge