Google Cloud DNS RBAC for integration with Kubernetes Cert Manager

Module configures IAM permissions that allow Cert Manager to be integrated with the Google Cloud DNS service for DNS-01 ACME challenges.

Once you have a Corewide Solutions Portal account, this one-time action will use your browser session to retrieve credentials:

 shellterraform login solutions.corewide.com

Provision instructions

Initialize mandatory providers:

hashicorp/google

Copy and paste into your Terraform configuration and insert the variables:

 hclmodule "tf_k8s_cert_manager_dns_gcp" {
  source  = "solutions.corewide.com/google-cloud/tf-k8s-cert-manager-dns-gcp/google"
  version = "~> 2.0.0"

  # specify module inputs here or try one of the examples below
  ...
}

Initialize the setup:

 shellterraform init

Define update strategy

Corewide DevOps team strictly follows Semantic Versioning Specification to provide our clients with products that have predictable upgrades between versions. We recommend pinning patch versions of our modules using pessimistic constraint operator (~>) to prevent breaking changes during upgrades.

To get new features during the upgrades (without breaking compatibility), use ~> 2.0 and run terraform init -upgrade

For the safest setup, use strict pinning with version = "2.0.0"

Module 85% off	~~€280~~ €50
TOTAL	€50

BUY

304

Corewide Proprietary License

v2.0.0 released 9 months, 2 weeks ago

New version approx. every 18 weeks

Upgrade Notes

Changelog

Module configures IAM permissions that allow Cert Manager to be integrated with the Google Cloud DNS service for DNS-01 ACME challenges.

From `v1.x` to `v2.x`

Module from v2.0 has changed GCP provider version which isn't compatible with an old version. After the module version is upgraded, re-init module to upgrade GCP provider version.
Upgrade GCP provider version on project level to ~> 7.0:

 hclterraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.0"
    }
  }
}

Upgrade project dependencies:

 bashterraform init --upgrade

Minimal setup with default parameters and outputs passed to the tf-k8s-cert-manager module:

 hclmodule "gcp_cert_manager" {
  source  = "solutions.corewide.com/google-cloud/tf-k8s-cert-manager-dns-gcp/google"
  version = "~> 2.0"
}

module "cert_manager" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-cert-manager/helm"
  version = "~> 1.1"

  acme_email                  = "[email protected]"
  ingress_classes             = ["nginx"]
  dns_solver_config           = module.gcp_cert_manager.issuer_spec
  service_account_annotations = module.gcp_cert_manager.service_account_annotation
}

Setup with custom name prefix and outputs passed to the tf-k8s-cert-manager module:

 hclmodule "gcp_cert_manager" {
  source  = "solutions.corewide.com/google-cloud/tf-k8s-cert-manager-dns-gcp/google"
  version = "~> 2.0"

  name_prefix = "foo"
}

module "cert_manager" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-cert-manager/helm"
  version = "~> 1.1"

  acme_email                  = "[email protected]"
  ingress_classes             = ["nginx"]
  dns_solver_config           = module.gcp_cert_manager.issuer_spec
  service_account_annotations = module.gcp_cert_manager.service_account_annotation
}

Variable	Description	Type	Default	Required	Sensitive
`name_prefix`	Name prefix for created resources	`string`	`cert-manager`	no	no

Output	Description	Type	Sensitive
`issuer_spec`	Cert Manager parameters for Google Cloud DNS DNS-01 ACME challenge provider	`map`	no
`service_account_annotation`	Annotation to add to the Cert Manager controller's `ServiceAccount`	`map`	no