Hetzner webhook

gitops-kaisers-info/templates/cert-manager.yaml

@@ -20,3 +20,25 @@ spec:
     targetRevision: 1.7.1
     helm:
       releaseName: cert-manager
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager-hetzner-webhook
+  namespace: {{ .Values.spec.namespace }}
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: {{ .Values.spec.namespace }}
+    name: {{ .Values.spec.destination.name }}
+  project: {{ .Values.spec.project }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  source:
+    chart: cert-manager-webhook-hetzner
+    repoURL: https://vadimkim.github.io/cert-manager-webhook-hetzner
+    helm:
+      releaseName: cert-manager-webhook-hetzner

gitops-kaisers-info/templates/hetzner-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hetzner-secret
+  namespace: cert-manager
+type: Opaque
+data:
+  api-key: M21TS3N1bzAzTVNld1JQeW12aVFpSU5TbFhPc0lBOFU=

gitops-kaisers-info/templates/letsencrypt.yaml

@@ -10,17 +10,15 @@ spec:
       name: "staging-issuer-account-key"
     server: "https://acme-staging-v02.api.letsencrypt.org/directory"
     solvers:
-      - http01:
-          ingress:
-            class: "traefik"
-            ingressTemplate:
-              metadata:
-                annotations:
-                  kubernetes.io/ingress.class: "traefik"
-                  traefik.ingress.kubernetes.io/router.tls: "true"
-                  traefik.ingress.kubernetes.io/frontend-entry-points: "https"
-                  traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
-                  #traefik.ingress.kubernetes.io/redirect-entry-point: "https"
+      - dns01:
+        webhook:
+          # This group needs to be configured when installing the helm package, otherwise the webhook won't have permission to create an ACME challenge for this API group.
+          groupName: acme.yourdomain.tld
+          solverName: hetzner
+          config:
+            secretName: hetzner-secret
+            zoneName: kaisers.info # (Optional): When not provided the Zone will searched in Hetzner API by recursion on full domain name
+            apiUrl: https://dns.hetzner.com/api/v1
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer