azure-aks-sandbox/cert_manager.tf at main · restatedev/azure-aks-sandbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
locals {
  cert_manager = {
    name      = "cert-manager"
    namespace = "cert-manager"
  }
}

resource "azurerm_user_assigned_identity" "cert_manager" {
  name                = "cert-manager"
  location            = var.location
  resource_group_name = var.resource_group_name
}

resource "azurerm_role_assignment" "cert_manager" {
  scope                = azurerm_dns_zone.public.id
  role_definition_name = "DNS Zone Contributor"
  principal_id         = azurerm_user_assigned_identity.cert_manager.principal_id
}

resource "azurerm_federated_identity_credential" "cert_manager" {
  name                = azurerm_user_assigned_identity.cert_manager.name
  resource_group_name = azurerm_user_assigned_identity.cert_manager.resource_group_name
  parent_id           = azurerm_user_assigned_identity.cert_manager.id
  audience            = ["api://AzureADTokenExchange"]
  issuer              = module.aks.oidc_issuer_url
  subject             = "system:serviceaccount:${local.cert_manager.namespace}:${local.cert_manager.name}"
}

resource "helm_release" "cert_manager" {
  provider = helm.main

  namespace        = local.cert_manager.namespace
  create_namespace = true

  name       = local.cert_manager.name
  repository = "https://charts.jetstack.io"
  chart      = "cert-manager"
  version    = "v1.11.0"

  set {
    name  = "installCRDs"
    value = "true"
  }

  values = [
    yamlencode({
      podLabels = {
        "azure.workload.identity/use" = "true"
      }

      serviceAccount = {
        labels = {
          "azure.workload.identity/use" = "true"
        }
      }

      resources = {
        requests = {
          cpu    = "10m",
          memory = "32Mi",
        }
      }
      tolerations = [
        {
          key    = "CriticalAddonsOnly"
          value  = "true"
          effect = "NoSchedule"
        },
      ]
      webhook = {
        resources = {
          requests = {
            cpu    = "10m",
            memory = "32Mi",
          }
        }
        tolerations = [
          {
            key    = "CriticalAddonsOnly"
            value  = "true"
            effect = "NoSchedule"
          }
        ]
      }
      cainjector = {
        resources = {
          requests = {
            cpu    = "10m",
            memory = "32Mi",
          }
        }
        tolerations = [
          {
            key    = "CriticalAddonsOnly"
            value  = "true"
            effect = "NoSchedule"
          },
        ]
      }
      startupapicheck = {
        resources = {
          requests = {
            cpu    = "10m",
            memory = "32Mi",
          }
        }
        tolerations = [
          {
            key    = "CriticalAddonsOnly"
            value  = "true"
            effect = "NoSchedule"
          },
        ]
      }
    }),
  ]

  depends_on = [
    module.aks,
    kubectl_manifest.karpenter_nodepool_default
  ]
}