Add imagePullSecrets to Let's Encrypt ClusterIssuer for DockerHub authentication

clusters/yc-ecp/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - ./helm-repositories.yaml
 
 # infrastructure
+  - ../../infrastructure/cert-manager/yc-ecp
   - ../../infrastructure/istio-config/yc-ecp
   - ../../infrastructure/vault/yc-ecp

infrastructure/cert-manager/yc-ecp/cert-manager.yaml

@@ -0,0 +1,12 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - dockerhub

infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml

@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer
+$patch: delete

infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml

@@ -0,0 +1,5 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer-istio
+$patch: delete

infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: "sarex@sarex.io"
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: "https://acme-v02.api.letsencrypt.org/directory"
+    solvers:
+      - http01:
+          ingress:
+            class: istio
+            podTemplate:
+              spec:
+                imagePullSecrets:
+                  - name: dockerhub

infrastructure/cert-manager/yc-ecp/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - clusterissuer-letsencrypt-prod.yaml
+patches:
+  - path: cert-manager.yaml
+  # yc-ecp выпускает сертификаты только через letsencrypt-prod
+  - path: clusterissuer-letsencrypt-delete.yaml
+  - path: clusterissuer-letsencrypt-istio-delete.yaml