feat: adding self-signed CA for certmanager for internal certificates

Author: InputObject2

kubernetes/umbrella-charts/certmanager/templates/clusterIssuers.yaml

@@ -16,4 +16,13 @@ spec:
           email: "{{ .Values.extra.cloudflare.email }}"
           apiTokenSecretRef:
             name: cloudflare-api-token
-            key: api-token
+            key: api-token
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+  namespace: kube-system
+spec:
+  ca:
+    secretName: certmanager-self-signed-ca

kubernetes/umbrella-charts/certmanager/templates/externalsecret.yaml

@@ -16,3 +16,29 @@ spec:
       remoteRef:
         key: apps/certmanager/cloudflare
         property: token
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: certmanager-self-signed-ca
+  namespace: kube-system
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: certmanager-self-signed-ca
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/tls
+  data:
+    - secretKey: tls.crt
+      remoteRef:
+        key: apps/certmanager/self-signed
+        property: certificate
+        decodingStrategy: Base64
+    - secretKey: tls.key
+      remoteRef:
+        key: apps/certmanager/self-signed
+        property: key
+        decodingStrategy: Base64