Add cluster issuer, gateway, certificate, and httproute

iac/src/main/utils/k8s.cljs

@@ -2,17 +2,69 @@
 
 
 
+(defn cluster-issuer [{:keys [host is-prod?]}]
+  {:metadata {:name (if is-prod? "letsencrypt-prod" "letsencrypt-staging")}
+   :spec {:acme {:email "admin@example.com"
+                 :server (if is-prod? "https://acme-v02.api.letsencrypt.org/directory" "https://acme-staging-v02.api.letsencrypt.org/directory")
+                 :privateKeySecretRef {:name (if is-prod? "account-key-prod" "account-key-staging")}
+                 :solvers [{:dns01 {:cloudflare {:apiTokenSecretRef
+                                                 {:name "api-token-secret"
+                                                  :key "apiToken"}}}
+                            :selector {:dnsZones [(or host "example.com")]}}]}}})
+
+(defn certificate
+  [{:keys [app-name app-namespace host is-prod?]}]
+  (let [secret-name (str app-name "-cert")
+        domain (or host (str app-name ".example.com"))
+        issuer-name (if is-prod?
+                      "letsencrypt-prod"
+                      "letsencrypt-staging")]
+
+    {:apiVersion "cert-manager.io/v1"
+     :kind "Certificate"
+     :metadata {:name (str app-name "-cert")
+                :namespace app-namespace}
+     :spec {:secretName secret-name
+            :issuerRef {:name issuer-name
+                        :kind "ClusterIssuer"}
+            :dnsNames [domain]}}))
 
 
-(defn ingress [{:keys [app-name app-namespace host ingress-opts]}]
+(defn gateway
+  [{:keys [app-name]}]
+  {:apiVersion "gateway.networking.k8s.io/v1"
+   :kind "Gateway"
+   :metadata {:name "main-gateway"
+              :namespace "traefik"}
+   :spec {:gatewayClassName "traefik"
+          :listeners
+          [{:name "http"
+            :protocol "HTTP"
+            :port 80}
+           {:name "https"
+            :protocol "HTTPS"
+            :port 443
+            :tls {:certificateRefs
+                  [{:name (str app-name "-cert")
+                    :kind "Secret"}]}}]}})
+
+
+(defn httproute [{:keys [app-name app-namespace host]}]
+  {:apiVersion "gateway.networking.k8s.io/v1"
+   :kind "HTTPRoute"
+   :metadata {:name (str app-name "-route")
+              :namespace app-namespace}
+   :spec {:parentRefs [{:name "main-gateway"
+                        :namespace "traefik"}]
+          :hostnames [host]
+          :rules [{:matches [{:path {:type "PathPrefix"
+                                     :value "/"}}]
+                   :backendRefs [{:name app-name
+                                  :port 80}]}]}})
+
+(defn ingress [{:keys [app-name app-namespace host]}]
   {:metadata {:name app-name
-              :namespace app-namespace
+              :namespace app-namespace}
-              :annotations {"caddy.ingress.kubernetes.io/tls.issuer" "cloudflare"
-                            "caddy.ingress.kubernetes.io/tls.dns_provider" "cloudflare"
-                            "caddy.ingress.kubernetes.io/tls.dns_provider.credentials_secret" "caddy-ingress-controller-secrets"
-                            "caddy.ingress.kubernetes.io/tls.dns_provider.credentials_secret_namespace" "caddy-system"
-                            "caddy.ingress.kubernetes.io/tls.issuer.acme_ca" "https://acme-v02.api.letsencrypt.org/directory"
-                            "caddy.ingress.kubernetes.io/snippet" (:caddy-snippet ingress-opts)}}
    :spec {:ingressClassName "caddy"
           :rules [{:host host
                    :http {:paths [{:path "/"
@@ -60,6 +112,10 @@
 
 (def defaults
   {:ingress       ingress
+   :gateway      gateway
+   :httproute    httproute
+   :certificate certificate
+   :cluster-issuer cluster-issuer
    :chart         chart
    :config-map    config-map
    :service       service
@@ -125,8 +181,8 @@
   "k8s pre-deploy rule: scans the service registry and creates
    all unique namespaces. Returns a map of created namespaces
    keyed by their name."
-  [{:keys [service-registry provider]}]
+  [{:keys [resource-configs provider]}]
-  (let [namespaces (->> service-registry
+  (let [namespaces (->> resource-configs
                         (remove #(contains? % :no-namespace))
                         (map :app-namespace)
                         (remove nil?)