redhat-cop · pittar · Aug 22, 2024 · Aug 20, 2024 · Aug 20, 2024
@@ -17,6 +17,7 @@ CICD
 CRD
 CRDs
 CheCluster
+ClusterIssuer
 ClusterPolicy
 ClusterRoleBindings
 ClusterTask
@@ -203,6 +204,7 @@ machineset
 microservices
 mig
 namespace
+namespaced
 namespaces
 newman
 nfd

@@ -9,6 +9,9 @@ The current *overlays* available are for the following channels:
 * [stable-v1](operator/overlays/stable-v1)
 * [stable-v1.10](operator/overlays/stable-v1.10)
 * [stable-v1.11](operator/overlays/stable-v1.11)
+* [stable-v1.12](operator/overlays/stable-v1.12)
+* [stable-v1.13](operator/overlays/stable-v1.13)
+* [stable-v1.14](operator/overlays/stable-v1.14)
 * [tech-preview](operator/overlays/tech-preview)
 
 ## Usage

@@ -0,0 +1,3 @@
+This is an example of ClusterIssuer resources for letsencrypt to use HTTP01 solver. Use of these prod and staging
+cluster issuers requires valid DNS that will point letsencrypt servers to an ingress with which cert-manager can respond
+from within OpenShift.
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - letsencrypt-prod-cluster-issuer.yaml
+  - letsencrypt-staging-cluster-issuer.yaml
@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # This key doesn't exist, cert-manager creates it
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    server: 'https://acme-v02.api.letsencrypt.org/directory'
+    preferredChain: ''
+    solvers:
+      - http01:
+          ingress:
+            class: openshift-default
@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    # This key doesn't exist, cert-manager creates it
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    server: 'https://acme-staging-v02.api.letsencrypt.org/directory'
+    preferredChain: ''
+    solvers:
+      - http01:
+          ingress:
+            class: openshift-default
@@ -0,0 +1,4 @@
+This is an example of using cert-manager to generate a root CA for signing certificates.
+
+It works by creating a namespaced issuer (not ClusterIssuer) to generate the root certificate in the cert-manager
+namespace. It then references the root certificate with a ClusterIssuer set to be a CA.
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - self-signed-root-issuer.yaml
+  - self-signed-ca-root.yaml
+  - self-signed-ca-cluster-issuer.yaml
@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-ca
+spec:
+  ca:
+    secretName: self-signed-ca-root
@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: self-signed-ca-root
+  namespace: cert-manager
+spec:
+  issuerRef:
+    group: cert-manager.io
+    kind: Issuer
+    name: self-signed-root
+  isCA: true
+  commonName: self-signed-ca-root
+  secretName: self-signed-ca-root
+  privateKey:
+    algorithm: ECDSA
+    size: 256
@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: self-signed-root
+  namespace: cert-manager
+spec:
+  selfSigned: {}
@@ -0,0 +1 @@
+This is an example of a cert-manager namespaced issuer (not ClusterIssuer) for generating self-signed certificates.
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - self-signed-issuer.yaml
@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - target:
+      kind: Subscription
+      name: openshift-cert-manager-operator
+    path: patch-channel.yaml
@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/channel
+  value: stable-v1.12
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - target:
+      kind: Subscription
+      name: openshift-cert-manager-operator
+    path: patch-channel.yaml
@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/channel
+  value: stable-v1.13
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - target:
+      kind: Subscription
+      name: openshift-cert-manager-operator
+    path: patch-channel.yaml
@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/channel
+  value: stable-v1.14
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		This is an example of a cert-manager namespaced issuer (not ClusterIssuer) for generating self-signed certificates.