Cert-Manager Builders

Cert-Manager Builders - Certificate Resource Constructors

The certmanager package provides strongly-typed constructor functions for creating cert-manager Kubernetes resources. These are the low-level building blocks used by Kure’s higher-level stack and workflow packages.

Overview

Each config-struct builder takes a configuration struct and returns a populated cert-manager custom resource. The builders handle API version and kind metadata, letting you focus on the resource specification.

Constructors

Every kind this package registers has a generated Create<Kind> wrapper in zz_generated_create.go, produced from the scheme by pkg/kubernetes/internal/gen (make gen-builders, checked by make check-builders in CI). A wrapper delegates to kubernetes.Create[T] and emits TypeMeta and identity only: no default, no label, no spec value. Namespaced kinds take (name, namespace), cluster-scoped kinds take (name). The upstream struct is the construction API; set spec fields directly or through the admissible Set*/Add* sugar below.

obj := certmanager.CreateCertificate("my-cert", "default")
cl := certmanager.CreateClusterIssuer("letsencrypt-prod")

The config-struct builders (certmanager.Certificate(&certmanager.CertificateConfig{...})) are a separate, opinionated layer on top of the same upstream types; they are unchanged by the generated constructors. The hand-written Create* helpers for spec fragments that remain in this package are legacy and are removed by the prune work item of the builder-contract epic.

See the Kubernetes Builders page for the full builder contract: construction, sugar admission classes, purity and the release-1 migration ledger.

Supported Resources

Certificate

import "github.com/go-kure/kure/pkg/kubernetes/certmanager"

cert := certmanager.Certificate(&certmanager.CertificateConfig{
    Name:       "my-cert",
    Namespace:  "default",
    SecretName: "my-cert-tls",
    IssuerRef:  cmmeta.IssuerReference{Name: "letsencrypt", Kind: "ClusterIssuer"},
    DNSNames:   []string{"example.com", "www.example.com"},
})

Issuer

IssuerConfig.Variant is a sealed-interface sum type : exactly one of *ACMEConfig or *CAConfig is permitted, enforced at compile time.

issuer := certmanager.Issuer(&certmanager.IssuerConfig{
    Name:      "letsencrypt",
    Namespace: "default",
    Variant: &certmanager.ACMEConfig{
        Server: "https://acme-v02.api.letsencrypt.org/directory",
        Email:  "admin@example.com",
        Solvers: []certmanager.ACMESolverConfig{
            {Solver: &certmanager.HTTP01SolverConfig{IngressClass: "nginx"}},
        },
    },
})

ACMESolverConfig.Solver is also a sealed sum (*HTTP01SolverConfig or *DNS01SolverConfig). DNS-01 providers are likewise sealed:

issuer = certmanager.Issuer(&certmanager.IssuerConfig{
    Name:      "letsencrypt-dns",
    Namespace: "default",
    Variant: &certmanager.ACMEConfig{
        Server: "https://acme-v02.api.letsencrypt.org/directory",
        Email:  "admin@example.com",
        Solvers: []certmanager.ACMESolverConfig{{
            Solver: &certmanager.DNS01SolverConfig{
                Provider: &certmanager.CloudflareProviderConfig{
                    Email:    "admin@example.com",
                    APIToken: &cmmeta.SecretKeySelector{
                        LocalObjectReference: cmmeta.LocalObjectReference{Name: "cf-api-token"},
                        Key:                  "api-token",
                    },
                },
            },
        }},
    },
})

ClusterIssuer

clusterIssuer := certmanager.ClusterIssuer(&certmanager.ClusterIssuerConfig{
    Name:    "letsencrypt-prod",
    Variant: &certmanager.CAConfig{SecretName: "ca-key-pair"},
})

Modifier Functions

Update existing resources:

// Update Certificate spec
cert.Spec = newSpec

// Labels and annotations use the generic helpers, which work over any object
// with ObjectMeta -- this package carries no per-kind metadata helpers
kubernetes.AddLabel(cert, "app", "my-app")
kubernetes.AddAnnotation(issuer, "note", "production")

// Update issuer configuration
certmanager.SetIssuerACME(issuer, acmeConfig)
certmanager.SetIssuerCA(issuer, caConfig)
certmanager.SetClusterIssuerCA(clusterIssuer, caConfig)

stack - Domain model that produces Kubernetes resources