From 81bf536ac384b3363f5078110be1aad1ad0d6c8b Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Sun, 5 Jul 2026 22:18:55 +0100
Subject: [PATCH] feat: add cert-manager role

---
 .../defaults/main.yaml                        |  6 ++++
 .../kubernetes_cert_manager/tasks/main.yaml   | 34 +++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 ansible/roles/kubernetes_cert_manager/defaults/main.yaml
 create mode 100644 ansible/roles/kubernetes_cert_manager/tasks/main.yaml

diff --git a/ansible/roles/kubernetes_cert_manager/defaults/main.yaml b/ansible/roles/kubernetes_cert_manager/defaults/main.yaml
new file mode 100644
index 0000000..3bc520d
--- /dev/null
+++ b/ansible/roles/kubernetes_cert_manager/defaults/main.yaml
@@ -0,0 +1,6 @@
+kubernetes_cert_manager_chart_version: "1.20.3"
+kubernetes_cert_manager_email: JamesAllenby@protonmail.com
+
+kubernetes_cert_manager_values:
+  crds:
+    enabled: true
diff --git a/ansible/roles/kubernetes_cert_manager/tasks/main.yaml b/ansible/roles/kubernetes_cert_manager/tasks/main.yaml
new file mode 100644
index 0000000..d1df2c6
--- /dev/null
+++ b/ansible/roles/kubernetes_cert_manager/tasks/main.yaml
@@ -0,0 +1,34 @@
+- name: Ensure cert-manager repository exists
+  kubernetes.core.helm_repository:
+    name: jetstack
+    url: https://charts.jetstack.io
+
+- name: Ensure cert-manager is installed
+  kubernetes.core.helm:
+    release_name: cert-manager
+    release_namespace: cert-manager
+    chart_ref: jetstack/cert-manager
+    chart_version: "{{ kubernetes_cert_manager_chart_version }}"
+    create_namespace: true
+    values: "{{ kubernetes_cert_manager_values }}"
+  run_once: true
+
+- name: Ensure ClusterIssuer exists
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt
+      spec:
+        acme:
+          server: https://acme-v02.api.letsencrypt.org/directory
+          email: "{{ kubernetes_cert_manager_email }}"
+          privateKeySecretRef:
+            name: letsencrypt-account-key
+          solvers:
+            - http01:
+                ingress:
+                  ingressClassName: traefik
+  run_once: true