added cert-manager release modules #2137

samidbb · 2025-12-12T08:05:05Z

Describe your changes

This pull request introduces a new Terraform module for managing FluxCD manifests for cert-manager, integrating it into the Kubernetes services deployment workflow. The changes add module configuration, resource definitions, templated manifest files, and necessary variables to support automated deployment and management of cert-manager via GitOps.

Key changes:

Cert-Manager FluxCD Module Introduction

Added a new Terraform module (_sub/security/cert-manager) that generates and manages FluxCD manifests for cert-manager, including CRD and Helm release resources, and integrates with GitHub repositories for GitOps workflows. [1] [2] [3] [4] [5] [6] [7]

Module Integration and Configuration

Integrated the new cert_manager_flux_manifests module into the main Kubernetes services Terraform configuration (compute/k8s-services/main.tf), with parameters for cluster, repository, and deployment settings.
Added a new variable cert_manager_is_debug_mode to control debug logging for cert-manager deployments.

Issue ticket number and link

Checklist before requesting a review

I have tested changes in my sandbox
I have added the needed changes in the test/integration folder to apply my changes in QA. Read the guide on adding environment variables in QA
I have rebased the code to master (or merged in the latest from master)

Is it a new release?

Apply a release tag release:(major|minor|patch), following semantic versioning in this guide or norelease if there is no changes to the Terraform code

wcarlsen · 2025-12-12T09:00:47Z

_sub/security/cert-manager/vars.tf

+  default     = "external-dns"
+}
+
+variable "namespace" {


Again this wont work and you cannot test that you can actually change this.

wcarlsen · 2025-12-12T09:01:01Z

_sub/security/cert-manager/vars.tf

+  type = string
+}
+
+variable "deploy_name" {


Please hardcode this one too.

wcarlsen · 2025-12-12T09:01:51Z

_sub/security/cert-manager/vars.tf

+  description = "The AWS region the EKS cluster is deployed in"
+}
+
+variable "is_debug_mode" {


Wouldn't it be much faster and simpler to just change this value in platform-apps if you need changes. I would remove this one.

wcarlsen · 2025-12-12T09:03:42Z

_sub/security/cert-manager/outputs.tf

@@ -0,0 +1,3 @@
+output "namespace_name" {


Why do you need this output? Is it used anywhere?

wcarlsen · 2025-12-12T09:04:21Z

_sub/security/cert-manager/values/helm-patch.yaml

+spec:
+  serviceAccountName: helm-controller
+  values:
+%{ if is_debug_mode ~}


If loglevel isn't a variable no patching is needed

it is a variable!

wcarlsen · 2025-12-12T09:05:25Z

_sub/security/cert-manager/versions.tf

+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {


Many of the providers are not even in use, why are they here? You only use the Github one.

wcarlsen · 2025-12-12T09:05:48Z

compute/k8s-services/vars.tf

+# --------------------------------------------------
+# Cert-Manager
+# --------------------------------------------------
+variable "cert_manager_is_debug_mode" {


Remove this once removed from _sub module.

I need this

wcarlsen

Very good, but there are few things that needs adjustments.

Also I think cert-manager would need an AWS IAM role at some point and that is not present in the current setup. Consider adding one using this module https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/modules/iam-role-for-service-accounts

wcarlsen · 2025-12-12T09:19:16Z

Also I think cert-manager would need an AWS IAM role at some point and that is not present in the current setup. Consider adding one using this module https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/modules/iam-role-for-service-accounts

Really important for DNSChallenge

samidbb · 2025-12-12T09:46:59Z

Also I think cert-manager would need an AWS IAM role at some point and that is not present in the current setup. Consider adding one using this module https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/modules/iam-role-for-service-accounts

Really important for DNSChallenge

I think it will be relevant only when deploying (cluster)issuer(s). so not really needed for the deployment of the cert-manager itself

wcarlsen · 2025-12-12T09:54:57Z

Also I think cert-manager would need an AWS IAM role at some point and that is not present in the current setup. Consider adding one using this module https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/modules/iam-role-for-service-accounts

Really important for DNSChallenge

I think it will be relevant only when deploying (cluster)issuer(s). so not really needed for the deployment of the cert-manager itself

Of course with cert-manager you can do self signed certs, but the strength will come from giving it AWS access to Route53. I also think this is the main driver for putting it in, so it makes little sense that it is not there.

samidbb · 2025-12-12T10:17:10Z

cert-manager can run without issuer for now. I can ofcorse deploy the clusterissuer in namespace cert-manager if that what you are talking but I wanted to postpone it until I know how to handle certificate requests in namespaces/or on loadbalancer level

wcarlsen · 2025-12-12T10:44:53Z

cert-manager can run without issuer for now. I can ofcorse deploy the clusterissuer in namespace cert-manager if that what you are talking but I wanted to postpone it until I know how to handle certificate requests in namespaces/or on loadbalancer level

This is a decent argument. But I guess you could also just test this in your sandbox cluster now right.

added cert-manager release modules

9d59219

samidbb added the release:minor Triggers a minor release label Dec 12, 2025

wcarlsen reviewed Dec 12, 2025

View reviewed changes

_sub/security/cert-manager/vars.tf Outdated

type = string

}

variable "deploy_name" {

Copy link

Contributor

wcarlsen Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please hardcode this one too.

wcarlsen reviewed Dec 12, 2025

View reviewed changes

wcarlsen requested changes Dec 12, 2025

View reviewed changes

samidbb added 2 commits December 12, 2025 11:19

removed output

a47faae

fixes

5aac5e7

samidbb added 5 commits December 15, 2025 16:37

almost complete with cluster issuer

9ad994c

remove output

23841b7

nlb with aws lb controller working config

bfc2597

add svc phase changes

d206081

support adding hosts with aws lb controller

a1c0d42

added cert-manager release modules #2137

Are you sure you want to change the base?

added cert-manager release modules #2137

Uh oh!

Conversation

samidbb commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Describe your changes

Cert-Manager FluxCD Module Introduction

Module Integration and Configuration

Issue ticket number and link

Checklist before requesting a review

Is it a new release?

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wcarlsen left a comment

Choose a reason for hiding this comment

Uh oh!

wcarlsen commented Dec 12, 2025

Uh oh!

samidbb commented Dec 12, 2025

Uh oh!

wcarlsen commented Dec 12, 2025

Uh oh!

samidbb commented Dec 12, 2025

Uh oh!

wcarlsen commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

samidbb commented Dec 12, 2025 •

edited

Loading

wcarlsen commented Dec 12, 2025 •

edited

Loading