Add buuypass & zerossl providers

tasks/main.yml

@@ -1,5 +1,14 @@
 - name: Cert Manager setup
   block:
+    - name: Deploy Cert-Manager CRD
+      kubernetes.core.k8s:
+        state: "present"
+        context: "{{ my_context }}"
+        namespace: "{{ cert_manager_namespace }}"
+        apply: yes
+        definition:
+          "{{ lookup('url', 'https://github.com/cert-manager/cert-manager/releases/download/v' + certmanager_version + '/cert-manager.crds.yaml', split_lines=False) | from_yaml_all }}"
+
     - name: Defined jetstack repository
       kubernetes.core.helm_repository:
         name: jetstack
@@ -14,7 +23,7 @@
         create_namespace: true
         release_namespace: "{{ cert_manager_namespace }}"
         values:
-          installCRDs: true
+          installCRDs: false
 #          global:
 #            podSecurityPolicy:
 #              enabled: true
@@ -23,6 +32,7 @@
             - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
 
 # https://github.com/baarde/cert-manager-webhook-ovh/tree/master/deploy/cert-manager-webhook-ovh
+# https://github.com/aureq/cert-manager-webhook-ovh ?
     - name: Install OVH webhook
       block:
         - name: Git clone stable repo on HEAD
@@ -30,6 +40,7 @@
             repo: "https://github.com/baarde/cert-manager-webhook-ovh.git"
             dest: tmp/cert-manager-webhook-ovh
 
+        # groupname devrait avoir une valeur type {{ item.solvers.consumerKey }}
         - name: Deploy OVH webhook chart from local path
           run_once: true
           kubernetes.core.helm:
@@ -39,28 +50,25 @@
             chart_ref: tmp/cert-manager-webhook-ovh/deploy/cert-manager-webhook-ovh
             release_namespace: "{{ cert_manager_namespace }}"
             values:
-#              groupName: '{{ cert_manager_issuer | selectattr("provider", "match", "ovh") | first }}'
-              groupName: '{{ cert_manager_issuer | json_query(\"[?provider=="ovh"]\") | first }}'
+#              groupName: '{{ cert_manager_issuer | selectattr("dns_provider", "match", "ovh") | first }}'
+              groupName: '{{ cert_manager_issuer | json_query(\"[?dns_provider=="ovh"]\") | first }}'
 #          with_items:
-#            - "{{ cert_manager_issuer | selectattr('ovh', 'in', provider) }}"
+#            - "{{ cert_manager_issuer | selectattr('ovh', 'in', dns_provider) }}"
 #          when:
 #            - item.provider == "ovh"
 
-        - name: OVH WebHook dependency
+        - name: OVH WebHook RBAC
           kubernetes.core.k8s:
             state: present
             context: "{{ my_context }}"
             apply: true
             namespace: "{{ cert_manager_namespace }}"
-            resource_definition: "{{ lookup('template', item) | from_yaml }}"
-          with_items:
-            - cert-manager-webhook-ovh-Role.yml.j2
-            - cert-manager-webhook-ovh-RoleBinding.yml.j2
+            resource_definition: "{{ lookup('template', 'cert-manager-webhook-ovh-rbac.yml.j2') | from_yaml_all }}"
 
       when:
         - false
         - cert_manager_issuer is defined
-        - cert_manager_issuer.[].provider == "ovh"
+        - cert_manager_issuer.[].dns_provider == "ovh"
 
 # https://smallstep.com/
 # https://github.com/smallstep/step-issuer
@@ -105,6 +113,26 @@
 
     - name: Add ClusterIssuers
       block:
+        - name: Create Secret object for ZeroSSL API Key authentification
+          kubernetes.core.k8s:
+            state: present
+            context: "{{ my_context }}"
+            apply: true
+            namespace: "{{ cert_manager_namespace }}"
+            definition:
+              apiVersion: v1
+              kind: Secret
+              metadata:
+                name: zero-ssl-eabsecret
+              data:
+                secret: "{{ item.zerossl_eab_hmac_key | b64encode }}"
+          with_items:
+            - "{{ cert_manager_issuer }}"
+            # - "{{ cert_manager_issuer | json_query(\"solvers.[?solver=="dns01"]\") }}"
+          when:
+            - item.acme_provider is defined
+            - item.acme_provider == "zerossl"
+
         - name: Create Secret object for API Key authentification
           kubernetes.core.k8s:
             state: present