Add selfsigned certs, external-secrets

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -38,3 +38,25 @@ spec:
   wait: true
   interval: 30m
   timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app self-signed-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/cert-manager/cert-manager/selfsigned
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml

@@ -0,0 +1,39 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name home-selfsigned-ca
+spec:
+  isCA: true
+  commonName: *name
+  subject:
+    organizations:
+      - ${SECRET_DOMAIN}
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name strong-selfsigned-ca
+spec:
+  isCA: true
+  commonName: *name
+  subject:
+    organizations:
+      - ${SECRET_DOMAIN}
+  secretName: strong-root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml

@@ -0,0 +1,17 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: home-ca-issuer
+spec:
+  ca:
+    secretName: root-secret
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: strong-ca-issuer
+spec:
+  ca:
+    secretName: strong-root-secret

kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./certificate.yaml
+  - ./clusterissuer.yaml