diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index bc2313ae..57daf2d0 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,7 +1,7 @@ fail_fast: false repos: - repo: https://github.com/adrienverge/yamllint.git - rev: v1.25.0 + rev: v1.26.1 hooks: - args: - -c @@ -23,6 +23,6 @@ repos: hooks: - id: fix-smartquotes - repo: https://github.com/k8s-at-home/sops-pre-commit - rev: v1.1.0 + rev: v2.0.1 hooks: - - id: sops-encrypted-check + - id: forbid-secrets diff --git a/README.md b/README.md index c142f4ab..6f86904b 100644 --- a/README.md +++ b/README.md @@ -23,29 +23,39 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS ### :wrench:  Tools -| Tool | Purpose | Minimum version | Required | -|--------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|:---------------:|:--------:| -| [k3sup](https://github.com/alexellis/k3sup) | Tool to install k3s on your nodes | `0.10.2` | ✅ | -| [kubectl](https://kubernetes.io/docs/tasks/tools/) | Allows you to run commands against Kubernetes clusters | `1.21.0` | ✅ | -| [flux](https://toolkit.fluxcd.io/) | Operator that manages your k8s cluster based on your Git repository | `0.12.3` | ✅ | -| [SOPS](https://github.com/mozilla/sops) | Encrypts k8s secrets with GnuPG | `3.7.1` | ✅ | -| [GnuPG](https://gnupg.org/) | Encrypts and signs your data | `2.2.27` | ✅ | -| [pinentry](https://gnupg.org/related_software/pinentry/index.html) | Allows GnuPG to read passphrases and PIN numbers | `1.1.1` | ✅ | -| [direnv](https://github.com/direnv/direnv) | Exports env vars based on present working directory | `2.28.0` | ❌ | -| [pre-commit](https://github.com/pre-commit/pre-commit) | Keeps formatting consistency across your files and ensures you **do not commit un-encrypted secrets** to your repository | `2.12.0` | ❌ | -| [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | +| Tool | Purpose | Minimum version | Required | +|--------------------------------------------------------------------|---------------------------------------------------------------------|:---------------:|:--------:| +| [k3sup](https://github.com/alexellis/k3sup) | Tool to install k3s on your nodes | `0.10.2` | ✅ | +| [kubectl](https://kubernetes.io/docs/tasks/tools/) | Allows you to run commands against Kubernetes clusters | `1.21.0` | ✅ | +| [flux](https://toolkit.fluxcd.io/) | Operator that manages your k8s cluster based on your Git repository | `0.12.3` | ✅ | +| [SOPS](https://github.com/mozilla/sops) | Encrypts k8s secrets with GnuPG | `3.7.1` | ✅ | +| [GnuPG](https://gnupg.org/) | Encrypts and signs your data | `2.2.27` | ✅ | +| [pinentry](https://gnupg.org/related_software/pinentry/index.html) | Allows GnuPG to read passphrases and PIN numbers | `1.1.1` | ✅ | +| [direnv](https://github.com/direnv/direnv) | Exports env vars based on present working directory | `2.28.0` | ❌ | +| [pre-commit](https://github.com/pre-commit/pre-commit) | Runs checks during `git commit` | `2.12.0` | ❌ | +| [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | +| [helm](https://helm.sh/) | Manage Kubernetes applications | `3.5.4` | ❌ | -## :rocket:  Pre-installation +## :warning:  Pre-installation It's very important and I cannot stress enough, make sure you are not pushing your secrets un-encrypted to a public Git repo. -I would start off **by making your repository private** until you are certain there are no leaks before showing it off to the world. +### pre-commit + +It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-commit hooks that come with this repository. +[sops-pre-commit](https://github.com/k8s-at-home/sops-pre-commit) will check to make sure you are not by accident commiting your secrets un-encrypted. + +After pre-commit is installed on your machine run: + +```sh +pre-commit install-hooks +``` ## :rocket:  Lets go! Very first step will be to create a new repository by clicking the **Use this template** button on this page. -### :key:  Setting up GnuPG keys +### :closed_lock_with_key:  Setting up GnuPG keys Here we will create a personal and a Flux GPG key. Using SOPS with GnuPG allows us to encrypt and decrypt secrets. @@ -86,7 +96,7 @@ Key-Length: 4096 Subkey-Type: 1 Subkey-Length: 4096 Expire-Date: 0 -Name-Real: ${KEY_NAME} +Name-Real: ${FLUX_KEY_NAME} EOF gpg --list-secret-keys "${FLUX_KEY_NAME}" @@ -133,7 +143,7 @@ kubectl --kubeconfig=./kubeconfig get nodes # k8s-worker-a Ready worker 4d20h v1.20.5+k3s1 ``` -### GitOps with Flux +### :small_blue_diamond:  GitOps with Flux Here we will be installing [flux](https://toolkit.fluxcd.io/) after some quick bootstrap steps. @@ -176,7 +186,7 @@ envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/infrastructure/cert-manager/s ```sh export GPG_TTY=$(tty) sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml -sops --encrypt --in-place ./cluster/core/infrastructure/cert-manager/secret.enc.yaml +sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml ``` Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster` @@ -197,7 +207,7 @@ git push kubectl --kubeconfig=./kubeconfig --kustomize=./cluster/base/flux-system ``` -## Post installation +## :mega:  Post installation ### Verify ingress @@ -209,17 +219,6 @@ sudo echo "${BOOTSTRAP_INGRESS_NGINX_LB} ${BOOTSTRAP_DOMAIN} homer.${BOOTSTRAP_D Head over to your browser and you _should_ be able to access `https://homer.${BOOTSTRAP_DOMAIN}` -### pre-commit - -It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-commit hooks that come with this repository. -[sops-pre-commit](https://github.com/k8s-at-home/sops-pre-commit) will check to make sure you are not by accident commiting your SOPS secrets un-encrypted. - -After pre-commit is installed run: - -```sh -pre-commit install-hooks -``` - ### direnv This is a great tool to export environment variables depending on what your present working directory is, head over to their [installation guide](https://direnv.net/docs/installation.html) and don't forget to hook it into your shell! @@ -237,7 +236,7 @@ gpg --delete-secret-keys "${FLUX_KEY_FP}" [Here](https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops)'s a neat little plugin for those using VSCode. It will automatically decrypt you SOPS secrets when you click on the file in the editor and encrypt them when you save the file. -## Debugging +## :point_right:  Debugging Manually sync Flux with your Git repository @@ -264,8 +263,8 @@ Show the health of your main Flux `GitRepository` ```sh flux --kubeconfig=./kubeconfig get sources git -# NAME READY MESSAGE REVISION SUSPENDED -# flux-system True Fetched revision: main/943e4126e74b273ff603aedab89beb7e36be4998 main/943e4126e74b273ff603aedab89beb7e36be4998 False +# NAME READY MESSAGE REVISION SUSPENDED +# flux-system True Fetched revision: main/943e4126e74b273ff603aedab89beb7e36be4998 main/943e4126e74b273ff603aedab89beb7e36be4998 False ``` Show the health of your `HelmRelease`s @@ -291,9 +290,9 @@ flux --kubeconfig=./kubeconfig get sources helm -A Flux has a wide range of CLI options available be sure to run `flux --help` to view more! -## What's next? +## :grey_question:  What's next -The world is your cluster, try installing another application! +The world is your cluster, try installing another application or if you have a NAS and want storage back by that check out [democratic-csi](https://github.com/democratic-csi/democratic-csi), [csi-driver-nfs](https://github.com/kubernetes-csi/csi-driver-nfs) or [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner). ## :handshake:  Thanks diff --git a/cluster/apps/default/homer/helm-release.yaml b/cluster/apps/default/homer/helm-release.yaml index 62a527f4..e608a00f 100644 --- a/cluster/apps/default/homer/helm-release.yaml +++ b/cluster/apps/default/homer/helm-release.yaml @@ -15,7 +15,6 @@ spec: kind: HelmRepository name: k8s-at-home-charts namespace: flux-system - interval: 5m values: image: repository: b4bz/homer diff --git a/cluster/apps/networking/ingress-nginx/helm-release.yaml b/cluster/apps/networking/ingress-nginx/helm-release.yaml index 68f0642f..13740bdd 100644 --- a/cluster/apps/networking/ingress-nginx/helm-release.yaml +++ b/cluster/apps/networking/ingress-nginx/helm-release.yaml @@ -15,7 +15,6 @@ spec: kind: HelmRepository name: ingress-nginx-charts namespace: flux-system - interval: 5m values: controller: ingressClass: nginx diff --git a/cluster/base/flux-system/gotk-components.yaml b/cluster/base/flux-system/gotk-components.yaml index e0ab7b39..34b63911 100644 --- a/cluster/base/flux-system/gotk-components.yaml +++ b/cluster/base/flux-system/gotk-components.yaml @@ -1,5 +1,5 @@ --- -# Flux version: v0.12.1 +# Flux version: v0.12.3 # Components: source-controller,kustomize-controller,helm-controller,notification-controller apiVersion: v1 kind: Namespace @@ -7,7 +7,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: flux-system --- apiVersion: apiextensions.k8s.io/v1 @@ -19,7 +19,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: alerts.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -194,7 +194,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: buckets.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -382,7 +382,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: gitrepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -601,7 +601,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helmcharts.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -793,7 +793,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helmreleases.helm.toolkit.fluxcd.io spec: group: helm.toolkit.fluxcd.io @@ -1309,7 +1309,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helmrepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -1477,7 +1477,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: kustomizations.kustomize.toolkit.fluxcd.io spec: group: kustomize.toolkit.fluxcd.io @@ -1874,7 +1874,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: providers.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -2021,7 +2021,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: receivers.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -2201,7 +2201,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helm-controller namespace: flux-system --- @@ -2211,7 +2211,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: kustomize-controller namespace: flux-system --- @@ -2221,7 +2221,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: notification-controller namespace: flux-system --- @@ -2231,7 +2231,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: source-controller namespace: flux-system --- @@ -2241,7 +2241,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: crd-controller-flux-system rules: - apiGroups: @@ -2321,7 +2321,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: cluster-reconciler-flux-system roleRef: apiGroup: rbac.authorization.k8s.io @@ -2341,7 +2341,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: crd-controller-flux-system roleRef: apiGroup: rbac.authorization.k8s.io @@ -2373,7 +2373,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: notification-controller namespace: flux-system @@ -2393,7 +2393,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: source-controller namespace: flux-system @@ -2413,7 +2413,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: webhook-receiver namespace: flux-system @@ -2433,7 +2433,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: helm-controller namespace: flux-system @@ -2506,7 +2506,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: kustomize-controller namespace: flux-system @@ -2581,7 +2581,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: notification-controller namespace: flux-system @@ -2657,7 +2657,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: source-controller namespace: flux-system diff --git a/cluster/core/crds/cert-manager/kustomization.yaml b/cluster/core/cert-manager/crd/kustomization.yaml similarity index 100% rename from cluster/core/crds/cert-manager/kustomization.yaml rename to cluster/core/cert-manager/crd/kustomization.yaml diff --git a/cluster/core/operators/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml similarity index 82% rename from cluster/core/operators/cert-manager/helm-release.yaml rename to cluster/core/cert-manager/helm-release.yaml index c4dd62d2..4c89afd4 100644 --- a/cluster/core/operators/cert-manager/helm-release.yaml +++ b/cluster/core/cert-manager/helm-release.yaml @@ -15,7 +15,6 @@ spec: kind: HelmRepository name: jetstack-charts namespace: flux-system - interval: 5m values: installCRDs: false webhook: @@ -30,8 +29,3 @@ spec: nameservers: - "1.1.1.1" - "8.8.8.8" - prometheus: - enabled: false - servicemonitor: - enabled: false - prometheusInstance: monitoring diff --git a/cluster/core/infrastructure/cert-manager/kustomization.yaml b/cluster/core/cert-manager/kustomization.yaml similarity index 85% rename from cluster/core/infrastructure/cert-manager/kustomization.yaml rename to cluster/core/cert-manager/kustomization.yaml index cf778581..f0c9364e 100644 --- a/cluster/core/infrastructure/cert-manager/kustomization.yaml +++ b/cluster/core/cert-manager/kustomization.yaml @@ -1,6 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: +- crd +- helm-release.yaml - letsencrypt-production.yaml - letsencrypt-staging.yaml - secret.enc.yaml diff --git a/cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml b/cluster/core/cert-manager/letsencrypt-production.yaml similarity index 100% rename from cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml rename to cluster/core/cert-manager/letsencrypt-production.yaml diff --git a/cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml b/cluster/core/cert-manager/letsencrypt-staging.yaml similarity index 100% rename from cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml rename to cluster/core/cert-manager/letsencrypt-staging.yaml diff --git a/cluster/core/cert-manager/secret.enc.yaml b/cluster/core/cert-manager/secret.enc.yaml new file mode 100644 index 00000000..6308663c --- /dev/null +++ b/cluster/core/cert-manager/secret.enc.yaml @@ -0,0 +1,8 @@ +# yamllint disable +apiVersion: v1 +kind: Secret +metadata: + name: cloudflare-token-secret + namespace: cert-manager +stringData: + cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN} diff --git a/cluster/core/crds/kustomization.yaml b/cluster/core/crds/kustomization.yaml deleted file mode 100644 index 75b65cfc..00000000 --- a/cluster/core/crds/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- cert-manager diff --git a/cluster/core/infrastructure/kustomization.yaml b/cluster/core/infrastructure/kustomization.yaml deleted file mode 100644 index 749e1da3..00000000 --- a/cluster/core/infrastructure/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- cert-manager -- metallb diff --git a/cluster/core/kustomization.yaml b/cluster/core/kustomization.yaml index 65d46e44..65cbeeb5 100644 --- a/cluster/core/kustomization.yaml +++ b/cluster/core/kustomization.yaml @@ -1,7 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- crds -- infrastructure - namespaces -- operators +- metallb-system +- cert-manager diff --git a/cluster/core/infrastructure/metallb/helm-release.yaml b/cluster/core/metallb-system/helm-release.yaml similarity index 79% rename from cluster/core/infrastructure/metallb/helm-release.yaml rename to cluster/core/metallb-system/helm-release.yaml index b9266346..0abe5bc1 100644 --- a/cluster/core/infrastructure/metallb/helm-release.yaml +++ b/cluster/core/metallb-system/helm-release.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: metallb - namespace: networking + namespace: metallb-system spec: interval: 5m chart: @@ -14,7 +14,6 @@ spec: kind: HelmRepository name: bitnami-charts namespace: flux-system - interval: 10m values: controller: image: @@ -24,11 +23,6 @@ spec: image: repository: metallb/speaker tag: v0.9.6 - prometheus: - serviceMonitor: - enabled: false - prometheusRule: - enabled: false configInline: address-pools: - name: default diff --git a/cluster/core/infrastructure/metallb/kustomization.yaml b/cluster/core/metallb-system/kustomization.yaml similarity index 100% rename from cluster/core/infrastructure/metallb/kustomization.yaml rename to cluster/core/metallb-system/kustomization.yaml diff --git a/cluster/core/namespaces/cert-manger.yaml b/cluster/core/namespaces/cert-manager.yaml similarity index 100% rename from cluster/core/namespaces/cert-manger.yaml rename to cluster/core/namespaces/cert-manager.yaml diff --git a/cluster/core/namespaces/kustomization.yaml b/cluster/core/namespaces/kustomization.yaml index 8b2d090b..f086345d 100644 --- a/cluster/core/namespaces/kustomization.yaml +++ b/cluster/core/namespaces/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cert-manager.yaml -- networking.yaml +- metallb-system.yaml diff --git a/cluster/core/namespaces/networking.yaml b/cluster/core/namespaces/metallb-system.yaml similarity index 66% rename from cluster/core/namespaces/networking.yaml rename to cluster/core/namespaces/metallb-system.yaml index fa9575ea..928cb910 100644 --- a/cluster/core/namespaces/networking.yaml +++ b/cluster/core/namespaces/metallb-system.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: Namespace metadata: - name: networking + name: metallb-system diff --git a/cluster/core/operators/cert-manager/kustomization.yaml b/cluster/core/operators/cert-manager/kustomization.yaml deleted file mode 100644 index 761d2252..00000000 --- a/cluster/core/operators/cert-manager/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- helm-release.yaml diff --git a/cluster/core/operators/kustomization.yaml b/cluster/core/operators/kustomization.yaml deleted file mode 100644 index 75b65cfc..00000000 --- a/cluster/core/operators/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- cert-manager