Add cert-manager resources for Istio CA and TLS certificates

regional/README.md

@@ -30,10 +30,14 @@ No modules.
 | [helm_release.istiod](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [kubernetes_ingress_v1.istio_gateway](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress_v1) | resource |
 | [kubernetes_manifest.istio_gateway_backendconfig](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
+| [kubernetes_manifest.istio_gateway_ca_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
+| [kubernetes_manifest.istio_gateway_ca_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 | [kubernetes_manifest.istio_gateway_frontendconfig](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 | [kubernetes_manifest.istio_gateway_managed_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 | [kubernetes_manifest.istio_gateway_mci](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 | [kubernetes_manifest.istio_gateway_mcs](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
+| [kubernetes_manifest.istio_gateway_selfsigned_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
+| [kubernetes_manifest.istio_gateway_tls](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
 
 ## Inputs
 
@@ -67,6 +71,7 @@ No modules.
 | <a name="input_proxy_memory_limits"></a> [proxy\_memory\_limits](#input\_proxy\_memory\_limits) | The memory limit for the Istio proxy | `string` | `"64Mi"` | no |
 | <a name="input_proxy_memory_requests"></a> [proxy\_memory\_requests](#input\_proxy\_memory\_requests) | The memory request for the Istio proxy | `string` | `"32Mi"` | no |
 | <a name="input_region"></a> [region](#input\_region) | The region in which the resource belongs | `string` | n/a | yes |
+| <a name="input_zone"></a> [zone](#input\_zone) | The zone to deploy the resources to | `string` | n/a | yes |
 
 ## Outputs
 

regional/locals.tf

@@ -24,5 +24,5 @@ locals {
   EOF
 
   gateway_domains    = keys(var.gateway_dns)
-  multi_cluster_name = "${var.cluster_prefix}-${var.region}-${local.env}"
+  multi_cluster_name = "${var.cluster_prefix}-${var.region}-${var.zone}-${local.env}"
 }

regional/main.tf

@@ -401,3 +401,106 @@ resource "kubernetes_manifest" "istio_gateway_mci" {
     }
   }
 }
+
+resource "kubernetes_manifest" "istio_gateway_ca_certificate" {
+  count = var.enable_istio_gateway ? 1 : 0
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+
+    metadata = {
+      name      = "istio-gateway-ca"
+      namespace = "istio-ingress"
+    }
+
+    spec = {
+      commonName = "istio-gateway-ca"
+      duration   = "2160h"
+      isCA       = true
+
+      issuerRef = {
+        name  = "selfsigned"
+        kind  = "Issuer"
+        group = "cert-manager.io"
+      }
+
+      secretName = "istio-gateway-ca"
+
+      subject = {
+        organizations = ["istio.osinfra.io"]
+      }
+    }
+  }
+}
+
+resource "kubernetes_manifest" "istio_gateway_ca_issuer" {
+  count = var.enable_istio_gateway ? 1 : 0
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Issuer"
+
+    metadata = {
+      name      = "istio-gateway-ca"
+      namespace = "istio-ingress"
+    }
+
+    spec = {
+      ca = {
+        secretName = "istio-gateway-ca"
+      }
+    }
+  }
+}
+
+resource "kubernetes_manifest" "istio_gateway_tls" {
+  count = var.enable_istio_gateway ? 1 : 0
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+
+    metadata = {
+      name      = "istio-gateway-tls"
+      namespace = "istio-ingress"
+    }
+
+    spec = {
+      commonName = "istio-gateway.osinfra.io"
+      dnsNames   = ["*"]
+      duration   = "2160h"
+      isCA       = false
+
+      issuerRef = {
+        name  = "istio-gateway-ca"
+        kind  = "Issuer"
+        group = "cert-manager.io"
+      }
+
+      renewBefore = "360h"
+      secretName  = "istio-gateway-tls"
+
+      usages = [
+        "client auth",
+        "server auth"
+      ]
+    }
+  }
+}
+
+resource "kubernetes_manifest" "istio_gateway_selfsigned_issuer" {
+  count = var.enable_istio_gateway ? 1 : 0
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Issuer"
+
+    metadata = {
+      name      = "selfsigned"
+      namespace = "istio-ingress"
+    }
+
+    spec = {
+      selfSigned = {}
+    }
+  }
+}

regional/variables.tf

@@ -175,3 +175,8 @@ variable "region" {
   description = "The region in which the resource belongs"
   type        = string
 }
+
+variable "zone" {
+  description = "The zone to deploy the resources to"
+  type        = string
+}

tests/default.tftest.hcl

@@ -51,7 +51,8 @@ run "default_regional" {
       }
     }
 
-    region                      = "mock-region-a"
+    region                      = "mock-region"
+    zone                        = "mock-zone"
   }
 }
 

tests/fixtures/default/regional/main.tf

@@ -78,4 +78,5 @@ module "test" {
 
   project = var.project
   region  = var.region
+  zone    = var.zone
 }

tests/fixtures/default/regional/variables.tf

@@ -19,3 +19,7 @@ variable "project" {
 variable "region" {
   type = string
 }
+
+variable "zone" {
+  type = string
+}