deploy.yml

apiVersion: v1
kind: Namespace
metadata:
  name: kcert
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kcert
  namespace: kcert
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kcert
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "update", "patch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kcert
subjects:
- kind: ServiceAccount
  name: kcert
  namespace: kcert
roleRef:
  kind: ClusterRole
  name: kcert
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kcert
  namespace: kcert
rules:
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "create", "delete", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kcert
  namespace: kcert
subjects:
- kind: ServiceAccount
  name: kcert
  namespace: kcert
roleRef:
  kind: Role
  name: kcert
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kcert
  namespace: kcert
  labels:
    app: kcert
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kcert
  template:
    metadata:
      labels:
        app: kcert
    spec:
      serviceAccountName: kcert
      containers:
      - name: kcert
        image: nabsul/kcert:v1.0.1
        ports:
        - containerPort: 80
          name: http
        - containerPort: 8080
          name: http-admin
        env:
        - name: ACME__DIRURL
          value: # https://acme-staging-v02.api.letsencrypt.org/directory or https://acme-v02.api.letsencrypt.org/directory
        - name: ACME__TERMSACCEPTED
          value: # You must set this to "true" to indicate your acceptance of Let's Encrypt's terms of service (https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf)
        - name: ACME__EMAIL
          value: # Your email address for Let's Encrypt and email notifications
---
apiVersion: v1
kind: Service
metadata:
  name: kcert
  namespace: kcert
  labels:
    app: kcert
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
    - name: http-admin
      protocol: TCP
      port: 8080
      targetPort: 8080
  selector:
    app: kcert