DNS Providers + TLS Certificates

[dotxlem]

This PR adds support for DNS Providers, beginning with Amazon Route53. Having a hosted zone available for your domain, AssemblyLift will generate DNS records for your services. Additionally TLS certificates will be provisioned for each service; on AWS Lambda these are ACM certificates, and on K8S cert-manager is installed and certificates are obtained from Let's Encrypt.

DNS Providers are declared in the domains array in assemblylift.toml:

[[domains]]
dns_name = "akkoro.io"
[domains.provider]
name = "route53"
[domains.provider.options]
aws_region = "us-east-1"
cert_manager_aws_credentials_secret_name = "iam-cert-manager-r53"

To use a domain with a service, declare it in the api table in the service.toml:

[api]
domain_name = "akkoro.io" # matches dns_name in assemblylift.toml

DNS entries are created for each service which declares a domain name. Entries are A Records named <service-name>.<project-name> which point to the service. For Lambda-based services, these are aliases to an API Gateway endpoint.

For example a project named petshop and a service named pos you might invoke a function mounted at /checkout with:
curl https://pos.petshop.mydomain.com/checkout

Route53

The Route53 (R53) provider requires that the Hosted Zone for the domain name already exists in the region specified in provider.options.

When using R53 with the Kubernetes provider, cert-manager is deployed to provision TLS certificates from Let's Encrypt and keep them up-to-date. This requires cert-manager to have access to your R53 Hosted Zone in order to create the verification DNS entries. These credentials are expected to be in a generic Kubernetes secret named iam-cert-manager-r53 in the cert-manager namespace.

kubectl create secret generic iam-cert-manager-r53 -n cert-manager --from-literal=aws_region=<region> --from-literal=aws_access_key_id=<id> --from-literal=aws_secret_access_key=<key>

Let's Encrypt

This build will only provision a self-signed cert from the staging API and is not suitable for production. Toggling a production cert will come in another release :)