certbot-cronjob.yml

# You must create an API in kong pointing to this service and tied to /.well-known/acme-challenge
# it will always be inaccessible as certbot standalone is the http server, and only exists while
# it's trying to acquire certificates
apiVersion: v1
kind: Service
metadata:
  name: kong-certbot-agent
spec:
  type: ClusterIP
  ports:
  - name: certbot
    port: 80
    targetPort: 80
    protocol: TCP
  - name: certbot-ssl
    port: 443
    targetPort: 443
    protocol: TCP
  selector:
    app: kong-certbot

---

# Make sure you edit your config below at the environment vars
# Ensures certbot doesn't loop forever on fail to avoid exhausting your LE quotas in case of initial misconfiguration


apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: kong-certbot-agent
spec:
  # Run job at 01:07 every 60 days
  schedule: "7 1 */60 * * "
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      completions: 1
      backoffLimit: 0
      template:
        # Matches selector on service above
        metadata:
          labels:
            app: kong-certbot
        spec:
          restartPolicy: Never
          containers:
            - name: runtime
              image: phpdockerio/kong-certbot-agent:3 # This will bring in latest 3.x release - we do follow semver so should be safe
              imagePullPolicy: Always                 # Ensure you have this if you're not pinning to an exact major.minor.patch release
              ports:
                - name: web
                  containerPort: 80
                  protocol: TCP
              env:
                - name: TERM
                  value: linux
                - name: KONG_ENDPOINT
                  value: http://base.path.to.kong.admin:8001
                - name: EMAIL
                  value: letsencrypt@registration.email
                - name: DOMAINS
                  value: comma.separated,list.of,domains.and.subdomains