-
Notifications
You must be signed in to change notification settings - Fork 270
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cert Management: Adding OCP v4 templates for use with OpenShift Appli…
…er (#403) * Adding OCP v4 templates for use with OpenShift Applier * Fixing Typo * Updated filestructure * Updated filestructure * Updated filestructure * Updated namespaces * Fixing namespace template processing * Updating README with references to the new OpenShift template based approach * Updating README with references to the new OpenShift template based approach * Updating README with references to the new OpenShift template based approach
- Loading branch information
Showing
7 changed files
with
317 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| --- | ||
|
|
||
| openshift_templates_url: "https://raw.githubusercontent.com/redhat-cop/openshift-templates" | ||
| openshift_templates_version: "master" | ||
|
|
||
| openshift_domain: "my.cluster.example.com" | ||
| cert_mgmt_namespace: "cert-mgmt" | ||
|
|
||
| cert_mgmt_namespace_params: | ||
| NAMESPACE: "{{ cert_mgmt_namespace }}" | ||
| NAMESPACE_DISPLAY_NAME: "Certificate Management Namespace" | ||
| NAMESPACE_DESCRIPTION: "Where a cluster certificate management is hosted" | ||
|
|
||
| cert_manager_params: | ||
| NAMESPACE: "{{ cert_mgmt_namespace }}" | ||
| DNS_DOMAIN: "{{ openshift_domain }}" | ||
| AWS_ACCESS_KEY_ID: "ASDF321ADF63" | ||
| AWS_SECRET_ACCESS_KEY: "$#%DASFSDF#24SRT@#$DFFSVSDFG@#$@#$==" | ||
| ACME_EMAIL: "[email protected]" | ||
|
|
||
| cert_utils_operator_params: | ||
| NAMESPACE: "{{ cert_mgmt_namespace }}" | ||
|
|
||
| openshift_cert_params: | ||
| DNS_DOMAIN: "{{ openshift_domain }}" | ||
|
|
||
| openshift_cluster_content: | ||
| - object: namespace | ||
| content: | ||
| - name: CertMgmtNamespace | ||
| template: "{{ openshift_templates_url }}/{{ openshift_templates_version }}/project-requests/create-project.yml" | ||
| params_from_vars: "{{ cert_mgmt_namespace_params }}" | ||
| action: create | ||
| - object: CertificateManagement | ||
| content: | ||
| - name: CertManager | ||
| template: "{{ inventory_dir }}/../.openshift/cert-manager.yml" | ||
| params_from_vars: "{{ cert_manager_params }}" | ||
| namespace: "{{ cert_mgmt_namespace }}" | ||
| tags: | ||
| - cert-manager | ||
| - name: CertUtilsOperator | ||
| template: "{{ inventory_dir }}/../.openshift/cert-utils-operator.yml" | ||
| params_from_vars: "{{ cert_utils_operator_params }}" | ||
| namespace: "{{ cert_mgmt_namespace }}" | ||
| tags: | ||
| - cert-utils-operator | ||
| - name: OCPv4-Certs | ||
| template: "{{ inventory_dir }}/../.openshift/ocpv4-certs.yml" | ||
| params_from_vars: "{{ openshift_cert_params }}" | ||
| # namespace: ... No namespace here - it will break the implementation | ||
| tags: | ||
| - ocpv4-certs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| --- | ||
|
|
||
| ansible_connection: local |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
|
|
||
| [seed-hosts] | ||
| localhost |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| --- | ||
| kind: Template | ||
| apiVersion: v1 | ||
| metadata: | ||
| annotations: | ||
| description: Cert Manager Deployment to support Acme Certificates | ||
| name: cert-manager-template | ||
| labels: | ||
| template: cert-manager-template | ||
| objects: | ||
| - kind: Secret | ||
| apiVersion: v1 | ||
| data: | ||
| aws-secret-access-key: ${AWS_SECRET_ACCESS_KEY} | ||
| metadata: | ||
| name: aws-secret-access-key-secret | ||
| type: Opaque | ||
| - kind: ClusterIssuer | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| metadata: | ||
| name: "${NAME}-production" | ||
| spec: | ||
| acme: | ||
| email: "${ACME_EMAIL}" | ||
| server: https://acme-v02.api.letsencrypt.org/directory | ||
| privateKeySecretRef: | ||
| name: letsencrypt-account-private-key | ||
| solvers: | ||
| - selector: | ||
| dnsZones: | ||
| - "${DNS_DOMAIN}" | ||
| dns01: | ||
| route53: | ||
| region: ${AWS_REGION} | ||
| accessKeyID: ${AWS_ACCESS_KEY_ID} | ||
| secretAccessKeySecretRef: | ||
| name: "aws-secret-access-key-secret" | ||
| key: "aws-secret-access-key" | ||
| parameters: | ||
| - name: NAME | ||
| description: Name of the Deployment | ||
| value: letsencrypt | ||
| - name: NAMESPACE | ||
| value: cert-mgmt | ||
| - name: DNS_DOMAIN | ||
| description: The DNS domain whereas the certificates are to be created | ||
| required: true | ||
| - name: AWS_REGION | ||
| value: us-east-1 | ||
| required: true | ||
| - name: AWS_ACCESS_KEY_ID | ||
| required: true | ||
| - name: AWS_SECRET_ACCESS_KEY | ||
| required: true | ||
| - name: ACME_EMAIL | ||
| required: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| --- | ||
| kind: Template | ||
| apiVersion: v1 | ||
| metadata: | ||
| annotations: | ||
| description: Cert Manager Deployment to support Acme Certificates | ||
| name: cert-utils-operator-template | ||
| labels: | ||
| template: cert-utils-operator-template | ||
| objects: | ||
| - kind: OperatorGroup | ||
| apiVersion: operators.coreos.com/v1 | ||
| metadata: | ||
| name: cert-utils | ||
| spec: | ||
| targetNamespaces: | ||
| - ${NAMESPACE} | ||
| - kind: Subscription | ||
| apiVersion: operators.coreos.com/v1alpha1 | ||
| metadata: | ||
| name: cert-utils-operator | ||
| spec: | ||
| channel: alpha | ||
| installPlanApproval: Automatic | ||
| name: cert-utils-operator | ||
| source: community-operators | ||
| sourceNamespace: openshift-marketplace | ||
| parameters: | ||
| - name: NAMESPACE | ||
| value: cert-mgmt |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| --- | ||
| kind: Template | ||
| apiVersion: v1 | ||
| metadata: | ||
| annotations: | ||
| description: OCP v4 Certificate and Configuration to load the certs | ||
| name: "${NAME}-certs" | ||
| labels: | ||
| template: "${NAME}-certs" | ||
| objects: | ||
| - kind: ConfigMap | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: letsencrypt-ca | ||
| namespace: ${LE_CA_NAMESPACE} | ||
| data: | ||
| ca-bundle.crt: | | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ | ||
| MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT | ||
| DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow | ||
| SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT | ||
| GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC | ||
| AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF | ||
| q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 | ||
| SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 | ||
| Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA | ||
| a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj | ||
| /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T | ||
| AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG | ||
| CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv | ||
| bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k | ||
| c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw | ||
| VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC | ||
| ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz | ||
| MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu | ||
| Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF | ||
| AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo | ||
| uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ | ||
| wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu | ||
| X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG | ||
| PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 | ||
| KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== | ||
| -----END CERTIFICATE----- | ||
| - kind: Certificate | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| metadata: | ||
| name: "api-${NAME}-cert" | ||
| namespace: ${API_CERT_NAMESPACE} | ||
| spec: | ||
| secretName: "api-${NAME}-cert" | ||
| issuerRef: | ||
| name: letsencrypt-production | ||
| kind: ClusterIssuer | ||
| dnsNames: | ||
| - "api.${DNS_DOMAIN}" | ||
| - kind: Certificate | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| metadata: | ||
| name: ingress-${NAME}-cert | ||
| namespace: ${INGRESS_CERT_NAMESPACE} | ||
| spec: | ||
| secretName: "ingress-${NAME}-cert" | ||
| issuerRef: | ||
| name: letsencrypt-production | ||
| kind: ClusterIssuer | ||
| dnsNames: | ||
| - "*.apps.${DNS_DOMAIN}" | ||
| - kind: APIServer | ||
| apiVersion: config.openshift.io/v1 | ||
| metadata: | ||
| name: cluster | ||
| spec: | ||
| servingCerts: | ||
| namedCertificates: | ||
| - names: | ||
| - "api.${DNS_DOMAIN}" | ||
| servingCertificate: | ||
| name: "api-${NAME}-cert" | ||
| - kind: IngressController | ||
| apiVersion: operator.openshift.io/v1 | ||
| metadata: | ||
| name: default | ||
| namespace: ${INGRESS_OPERATOR_NAMESPACE} | ||
| spec: | ||
| defaultCertificate: | ||
| name: "ingress-${NAME}-cert" | ||
| - kind: Proxy | ||
| apiVersion: config.openshift.io/v1 | ||
| metadata: | ||
| name: cluster | ||
| spec: | ||
| trustedCA: | ||
| name: letsencrypt-ca | ||
| parameters: | ||
| - name: NAME | ||
| description: Name of the Deployment | ||
| value: letsencrypt | ||
| - name: DNS_DOMAIN | ||
| description: The DNS domain to use for the certificate | ||
| required: true | ||
| - name: LE_CA_NAMESPACE | ||
| description: The namespace used for LE CA | ||
| value: openshift-config | ||
| - name: LE_CA_NAMESPACE | ||
| description: The namespace used for LE CA | ||
| value: openshift-config | ||
| - name: API_CERT_NAMESPACE | ||
| description: The namespace used for the API Cert | ||
| value: openshift-config | ||
| - name: INGRESS_CERT_NAMESPACE | ||
| description: The namespace used for the Ingress Cert | ||
| value: openshift-ingress | ||
| - name: INGRESS_OPERATOR_NAMESPACE | ||
| description: The namespace used for the Ingress Operator | ||
| value: openshift-ingress-operator |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters