All products Terraform Kubernetes helm
tf-k8s-ingress-nginx

Module deploys Ingress Nginx and Cert Manager into a Kubernetes cluster via Helm. Creates Let's Encrypt ClusterIssuers for ACME servers:

  • staging - to test Let's Encrypt cert generation via Staging server of LE
  • production - uses production Let's Encrypt CA server (with limited rate of certificate generation requests)
  • selfsigned - optional deployment of selfsigned cluster issuer
Log in to Corewide IaC registry

Once you have a Corewide Solutions Portal account, this one-time action will use your browser session to retrieve credentials:

 shellterraform login solutions.corewide.com
Provision instructions

Initialize mandatory providers:

Copy and paste into your Terraform configuration and insert the variables:

 hclmodule "tf_k8s_ingress_nginx" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 4.0.0"

  # specify module inputs here or try one of the examples below
  ...
}

Initialize the setup:

 shellterraform init
Define update strategy

Corewide DevOps team strictly follows Semantic Versioning Specification to provide our clients with products that have predictable upgrades between versions. We recommend pinning patch versions of our modules using pessimistic constraint operator (~>) to prevent breaking changes during upgrades.

To get new features during the upgrades (without breaking compatibility), use ~> 4.0 and run terraform init -upgrade

For the safest setup, use strict pinning with version = "4.0.0"

v4.0.0 released 1 year, 6 months ago
New version approx. every 6 weeks
Upgrade Notes
Changelog

Deploy only Cert Manager (in case of another Ingress usage) and selfsigned cluster issuer:

 hclmodule "cert_manager" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 4.0"

  cert_manager = {
    acme_email      = "[email protected]"
    ingress_classes = ["contour"]
  }

  ingress_nginx = {
    enabled          = false
    create_namespace = false
  }
}

NOTE: Values of annotations and labels must always be passed as strings regardless of their actual type.

Deploy Ingress Nginx with Cert Manager:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 4.0"

  cert_manager = {
    acme_email = "[email protected]"
  }

  # Example of complex value name syntax. 
  ingress_nginx = {
    custom_values = [
      {
        name  = "controller.metrics.serviceMonitor.additionalLabels\\.app\\.kubernetes\\.io/name"
        value = "ingress"
      },
    ]
  }
}

Deploy Ingress Nginx and Cert Manager with letsencrypt and selfsigned cluster issuers for nginx and contour ingresses:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 4.0"

  cert_manager = {
    acme_email      = "[email protected]"
    ingress_classes = ["nginx", "contour"]
    issuer_names    = ["letsencrypt", "selfsigned"]
  }
}
Variable Description Type Default Required Sensitive
cert_manager Cert Manager parameters object yes no
k8s_flavor Name of managed Kubernetes to enable cloud-specific adjustments string yes no
cert_manager.acme_email E-mail that Let's Encrypt cluster issuer will use to request certificates string yes no
cert_manager.create_namespace Indicates creation of dedicated namespace for Cert Manager deployment bool true no no
cert_manager.custom_values A list of custom values for Cert Manager Helm Chart list(object) [] no no
cert_manager.custom_values[*].name Full name of the custom value to be set string yes no
cert_manager.custom_values[*].type Type of the value to be set (valid options are auto and string) string auto no no
cert_manager.custom_values[*].value Value of the custom value to be set any yes no
cert_manager.enable_metrics Enable Prometheus metrics of Cert Manager bool true no no
cert_manager.ingress_classes A list of Ingress Classes definition for Cert Manager deployment list(string) ['nginx'] no no
cert_manager.issuer_names A list of issuers to be created. The list of possible values are: letsencrypt, letsencrypt-staging, selfsigned list(string) ['letsencrypt', 'letsencrypt-staging'] no no
cert_manager.name Name to override Cert Manager release name string cert-manager no no
cert_manager.namespace Namespace to install Cert Manager into string cert-manager no no
cert_manager.version Version of Cert Manager Helm chart string 1.7.1 no no
ingress_nginx Ingress Nginx parameters object no no
ingress_nginx.create_namespace Indicates creation of dedicated namespace for Ingress Nginx deployment bool true no no
ingress_nginx.custom_values A list of custom values for Ingress Nginx Helm Chart list(object) no no
ingress_nginx.custom_values[*].name Full name of the custom value to be set string yes no
ingress_nginx.custom_values[*].type Type of the value to be set (valid options are auto and string) string auto no no
ingress_nginx.custom_values[*].value Value of the custom value to be set any yes no
ingress_nginx.enable_metrics Enable Prometheus metrics of Ingress Nginx bool true no no
ingress_nginx.enabled Enable/disable Ingress Nginx deployment bool true no no
ingress_nginx.name Name to override Ingress Nginx release name string ingress-nginx no no
ingress_nginx.namespace Namespace to install Ingress Nginx into string ingress-nginx no no
ingress_nginx.replicas Number of Ingress Nginx controller replicas number 2 no no
ingress_nginx.version Version of Ingress Nginx Helm chart string 4.0.18 no no
Output Description Type Sensitive
ingress_nginx_hostname Hostname of Ingress Nginx computed no
ingress_nginx_ip External IP of Ingress Nginx computed no
Dependency Version Kind
terraform >= 1.3 CLI
hashicorp/helm ~> 2.5 provider
hashicorp/kubernetes ~> 2.9 provider
tf-k8s-crd ~> 1.0 module

References

Not sure where to start?
Let's find your perfect match.