enable ingress cert

2025-05-14 16:14:14 -05:00
parent d237978826
commit 0449e0030d
16 changed files with 61 additions and 4 deletions
--- a/cluster/cert-manager/base/cloudflare-secret-eso.yaml
+++ b/cluster/cert-manager/base/cloudflare-secret-eso.yaml
@@ -1,15 +0,0 @@
---
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: cloudflare-api-token # This is the secret name
-  namespace: cert-manager
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: doppler-cluster
-  refreshInterval: "1h"
-  data:
-    - secretKey: api-token
-      remoteRef:
-        key: CLOUDFLARE_TOKEN
--- a/cluster/cert-manager/base/clusterissuers.yaml
+++ b/cluster/cert-manager/base/clusterissuers.yaml
@@ -1,51 +0,0 @@
---
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-prod
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  acme:
-    email: ryan.blundon@protonmail.com
-    privateKeySecretRef:
-      name: letsencrypt-prod-issuer-account-key
-    server: https://acme-v02.api.letsencrypt.org/directory
-    solvers:
-    - dns01:
-        cloudflare:
-          apiTokenSecretRef:
-            name: cloudflare-api-token
-            key: api-token
-          email: ryan.blundon@protonmail.com
-        cnameStrategy: Follow
-      selector: 
-        dnsZones:
-          - 'mk-labs.cloud'
-          - 'monetnaildesign.com'
-
---
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  acme:
-    email: ryan.blundon@protonmail.com
-    privateKeySecretRef:
-      name: letsencrypt-staging-issuer-account-key
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    solvers:
-    - dns01:
-        cloudflare:
-          apiTokenSecretRef:
-            name: cloudflare-api-token
-            key: api-token
-          email: ryan.blundon@protonmail.com
-        cnameStrategy: Follow
-      selector: 
-        dnsZones:
-          - 'mk-labs.cloud'
-          - 'monetnaildesign.com'
--- a/cluster/cert-manager/base/kustomization.yaml
+++ b/cluster/cert-manager/base/kustomization.yaml
@@ -1,18 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-commonAnnotations:
-  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-
-resources:
-# Operator deployment
- namespace.yaml
- operatorgroup.yaml
- subscription.yaml
- monitoring.yaml
-# Deploy cluster resources
-# - cloudflare-secret-eso.yaml
-# - clusterissuers.yaml
-# - split-horizon-patch.yaml
-#- api-ingress.yaml
--- a/cluster/cert-manager/base/monitoring.yaml
+++ b/cluster/cert-manager/base/monitoring.yaml
@@ -1,52 +0,0 @@
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: prometheus-k8s
-  namespace: cert-manager
-rules:
- apiGroups:
-  - ""
-  resources:
-  - services
-  - endpoints
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: prometheus-k8s
-  namespace: cert-manager
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: prometheus-k8s
-subjects:
- kind: ServiceAccount
-  name: prometheus-k8s
-  namespace: openshift-monitoring
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  labels:
-    app: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/name: cert-manager
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  endpoints:
-  - interval: 30s
-    port: tcp-prometheus-servicemonitor
-    scheme: http
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/name: cert-manager
--- a/cluster/cert-manager/base/namespace.yaml
+++ b/cluster/cert-manager/base/namespace.yaml
@@ -1,9 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  annotations: {}
-#    openshift.io/display-name: "cert-manager Operator for Red Hat OpenShift"
-  labels:
-    openshift.io/cluster-monitoring: 'true'
-  name: cert-manager-operator
--- a/cluster/cert-manager/base/operatorgroup.yaml
+++ b/cluster/cert-manager/base/operatorgroup.yaml
@@ -1,9 +0,0 @@
---
-apiVersion: operators.coreos.com/v1
-kind: OperatorGroup
-metadata:
-  name: openshift-cert-manager-operator
-  namespace: cert-manager-operator
-spec:
-  targetNamespaces:
-    - cert-manager-operator
--- a/cluster/cert-manager/base/split-horizon-patch.yaml
+++ b/cluster/cert-manager/base/split-horizon-patch.yaml
@@ -1,11 +0,0 @@
-apiVersion: operator.openshift.io/v1alpha1
-kind: CertManager 
-metadata: 
-  name: cluster 
-spec: 
-  managementState: 'Managed'
-  unsupportedConfigOverrides: 
-    controller: 
-      args:
-        - "--dns01-recursive-nameservers=1.1.1.1:53" 
-        - "--dns01-recursive-nameservers-only"
--- a/cluster/cert-manager/base/subscription.yaml
+++ b/cluster/cert-manager/base/subscription.yaml
@@ -1,12 +0,0 @@
---
-apiVersion: operators.coreos.com/v1alpha1
-kind: Subscription
-metadata:
-  name: openshift-cert-manager-operator
-  namespace: cert-manager-operator
-spec:
-  channel: stable-v1
-  installPlanApproval: Automatic
-  name: openshift-cert-manager-operator
-  source: redhat-operators
-  sourceNamespace: openshift-marketplace
--- a/cluster/cert-manager/cert-patches.yaml
+++ b/cluster/cert-manager/cert-patches.yaml
@@ -1 +0,0 @@
- 
--- a/cluster/cert-manager/overlays/hub/api-ingress.yaml
+++ b/cluster/cert-manager/overlays/hub/api-ingress.yaml
@@ -1,41 +0,0 @@
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  annotations:
-  generation: 1
-  name: letsencrypt
-  namespace: openshift-ingress
-spec:
-  commonName: '*.apps.hub.int.mk-labs.cloud'
-  dnsNames:
-  - '*.apps.hub.int.mk-labs.cloud'
-  duration: 2160h0m0s
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  renewBefore: 360h0m0s
-  secretName: letsencrypt
-  usages:
-  - server auth
-  - client auth
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  annotations:
-  name: letsencrypt
-  namespace: openshift-config
-spec:
-  commonName: 'api.hub.int.mk-labs.cloud'
-  dnsNames:
-  - api.hub.int.mk-labs.cloud
-  duration: 2160h0m0s
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  renewBefore: 360h0m0s
-  secretName: letsencrypt
-  usages:
-  - server auth
-  - client auth
--- a/cluster/cert-manager/overlays/hub/apiserver-cert-config.yaml
+++ b/cluster/cert-manager/overlays/hub/apiserver-cert-config.yaml
@@ -1,11 +0,0 @@
-apiVersion: config.openshift.io/v1
-kind: APIServer
-metadata:
-  name: cluster
-spec:
-  servingCerts:
-    namedCertificates:
-    - names:
-      - api.hub.int.mk-labs.cloud
-      servingCertificate:
-        name: letsencrypt
--- a/cluster/cert-manager/overlays/hub/ingress-controller-cert-config.yaml
+++ b/cluster/cert-manager/overlays/hub/ingress-controller-cert-config.yaml
@@ -1,8 +0,0 @@
-apiVersion: operator.openshift.io/v1
-kind: IngressController
-metadata:
-  name: default
-  namespace: openshift-ingress-operator
-spec:
-  defaultCertificate:
-    name: letsencrypt
--- a/cluster/cert-manager/overlays/hub/kustomization.yaml
+++ b/cluster/cert-manager/overlays/hub/kustomization.yaml
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-commonAnnotations:
-  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-
-resources:
- ../../base
-#- api-ingress.yaml
-#- apiserver-cert-config.yaml
-#- ingress-controller-cert-config.yaml
--- a/cluster/cert-manager/templates/certs/api-server.yaml
+++ b/cluster/cert-manager/templates/certs/api-server.yaml
@@ -0,0 +1,30 @@
+{{- if and .Values.le.prod.enabled .Values.le.apiCert.enabled -}}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: okd-api
+  namespace: openshift-config
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  dnsNames:
+  - api.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: le-prod
+  secretName: okd-api
+---
+apiVersion: config.openshift.io/v1
+kind: APIServer
+metadata:
+  name: cluster
+spec:
+  servingCerts:
+    namedCertificates:
+    - names:
+      - api.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+      servingCertificate:
+        name: okd-api
+{{- end }}
--- a/cluster/cert-manager/templates/certs/router.yaml
+++ b/cluster/cert-manager/templates/certs/router.yaml
@@ -0,0 +1,29 @@
+{{- if and .Values.le.prod.enabled .Values.le.routerCert.enabled -}}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: router-cert
+  namespace: openshift-ingress
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  commonName: apps.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+  dnsNames:
+  - apps.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+  - "*.apps.{{ .Values.cluster_name }}.{{ .Values.base_domain }}"
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: le-prod
+  secretName: router-cert
+---
+apiVersion: operator.openshift.io/v1
+kind: IngressController
+metadata:
+  name: default
+  namespace: openshift-ingress-operator
+spec:
+  defaultCertificate:
+    name: router-cert
+{{- end }}
--- a/cluster/cert-manager/values-hub.yaml
+++ b/cluster/cert-manager/values-hub.yaml
@@ -24,7 +24,6 @@ ca:
    <actual key>
    -----END PRIVATE KEY-----

-
 le:
  prod:
    enabled: true
@@ -35,7 +34,7 @@ le:
  apiCert:
    enabled: false
  routerCert:
-    enabled: false
+    enabled: true
  preferredChain: ""
  email: ryan.blundon@protonmail.com
  solvers:
@@ -56,4 +55,4 @@ le:
  #     secret-access-key: <actual secret access key>

 cluster_name: hub
-base_domain: mklabs.cloud
+base_domain: int.mk-labs.cloud