Add selfsigned certs, external-secrets

kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml

@@ -0,0 +1,39 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name home-selfsigned-ca
+spec:
+  isCA: true
+  commonName: *name
+  subject:
+    organizations:
+      - ${SECRET_DOMAIN}
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name strong-selfsigned-ca
+spec:
+  isCA: true
+  commonName: *name
+  subject:
+    organizations:
+      - ${SECRET_DOMAIN}
+  secretName: strong-root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml

@@ -0,0 +1,17 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: home-ca-issuer
+spec:
+  ca:
+    secretName: root-secret
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: strong-ca-issuer
+spec:
+  ca:
+    secretName: strong-root-secret

kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./certificate.yaml
+  - ./clusterissuer.yaml