chore: support external cert-manager (#1864)

Signed-off-by: odubajDT <ondrej.dubaj@dynatrace.com> Signed-off-by: odubajDT <93584209+odubajDT@users.noreply.github.com> Co-authored-by: Moritz Wiesinger <moritz.wiesinger@dynatrace.com> Co-authored-by: Giovanni Liva <giovanni.liva@dynatrace.com>
keptn · Aug 10, 2023 · 50dac48 · 50dac48
1 parent 05d2f51
commit 50dac48
Show file tree

Hide file tree

Showing 22 changed files with 51 additions and 64 deletions.
diff --git a/docs/content/en/docs/concepts/architecture/cert-manager.md b/docs/content/en/docs/concepts/architecture/cert-manager.md
@@ -39,7 +39,7 @@ It is included to simplify installation for new users
 and because it is much smaller than most standard certificate managers.
 However, KLT is compatible with most certificate managers
 and can be configured to use another certificate manager if you prefer.
-See [Use your own cert-manager](../../install/cert-manager.md)
+See [Use Keptn with cert-manager.io](../../install/cert-manager.md)
 for instructions.
 
 ## Invalid certificate errors

diff --git a/docs/content/en/docs/install/cert-manager.md b/docs/content/en/docs/install/cert-manager.md
@@ -1,5 +1,5 @@
 ---
-title: Use your own cert-manager (optional)
+title: Use Keptn with cert-manager.io (optional)
 description: Replace the default KLT cert-manager
 weight: 30
 hidechildren: false # this flag hides all sub-pages in the sidebar-multicard.html
@@ -14,86 +14,57 @@ without the overhead of other cert-managers.
 For a description of the architecture, see
 [Keptn Certificate Manager](../concepts/architecture/cert-manager.md).
 
-KLT, however, works well with standard cert-managers.
-The KLT cert-manager can also coexist with another cert-manager.
-If you are already using a different cert-manager,
-you can continue to use that cert-manager for other components
+KLT also works well with `cert-manager.io`.
+If you are already using `cert-manager.io`,
+you can continue to use it for other components
 and use the KLT cert-manager just for KLT activities
-or you can configure KLT to use that cert-manager.
+or you can disable the KLT cert-manager
+and configure KLT to use `cert-manager.io`.
 
-If you want KLT to use your cert-manager,
+If you want KLT to use `cert-manager.io`,
 you must configure it *before* you install KLT.
 The steps are:
 
-* Install the cert-manager of your choice
-  if it is not already installed.
-* Modify the `Deployment` manifest of each KLT operator component.
-* Add the `Certificate` CRD for the cert-manager you are using.
+* Install `cert-manager.io` if it is not already installed.
+* Add the `Certificate` and `Issuer` CRs for `cert-manager.io`.
+* (optional) Install Keptn without the built-in `klt-cert-manager` via Helm
 
-## Modify the KLT manifest
+## Add the CR(s) for cert-manager.io
 
-You must modify the KLT manifest for each KLT operator component
-to make it aware of the cert-manager you are using.
-These instructions implement
-[cert-manager.io](https://cert-manager.io/);
-the process is similar for other cert-managers.
-
-To configure KLT to use your cert-manager,
-change the `Deployment` manifest of each KLT operator component
-and **replace** the following `volumes` definition
-
-   ```yaml
-   - emptyDir: {}
-     name: certs-dir
-   ```
-
-   with
-
-   ```yaml
-   - name: cert
-     secret:
-       defaultMode: 420
-       secretName: webhook-server-cert
-   ```
-
-Each manifest must have the following special annotation:
-
-```yaml
-cert-manager.io/inject-ca-from=klt-serving-cert/keptn-lifecycle-toolkit-system
-```
-
-The value of the annotation must match the
-`name/namespace` of the cert-manager CRD discussed below.
-
-## Add the CRD for your cert-manager
-
-This is the CRD for `cert-manager.io`:
+These are the CRs for `cert-manager.io` to be applied to your cluster:
 
 ```yaml
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: klt-serving-cert 
-  namespace: keptn-lifecycle-toolkit-system
+  name: klt-certs
+  namespace: <your-namespace>
 spec:
   dnsNames:
-  - lifecycle-webhook-service.keptn-lifecycle-toolkit-system.svc
-  - lifecycle-webhook-service.keptn-lifecycle-toolkit-system.svc.cluster.local
+  - lifecycle-webhook-service.<your-namespace>.svc
+  - lifecycle-webhook-service.<your-namespace>.svc.cluster.local
+  - metrics-webhook-service.<your-namespace>.svc
+  - metrics-webhook-service.<your-namespace>.svc.cluster.local
   issuerRef:
     kind: Issuer
     name: klt-selfsigned-issuer
-  secretName webhook-server-cert
+  secretName: klt-certs
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: klt-selfsigned-issuer
+  namespace: <your-namespace>
+spec:
+  selfSigned: {}
 ```
 
 Note the following about these fields:
 
 * The `apiVersion` field refers to the API for the cert-manager.
-* The `metadata` section includes two fields.
-  The value of these fields must match the annotations
-  used in the KLT operator manifests.
-* The value of the `secretName` field
-  must match the value of the `secretName` field used
-  in the `volumes` definition section of the KLT operator manifests above.
+* The value of the `.spec.secretName` field as well as the `.metadata.name` of the `Certificate` CR
+  must be `klt-certs`.
+* Substitute the namespace placeholders with your namespace, where Keptn is installed.
 
 See the [CA Injector](https://cert-manager.io/docs/concepts/ca-injector/)
 documentation for more details.
diff --git a/docs/content/en/docs/install/k8s.md b/docs/content/en/docs/install/k8s.md
@@ -97,5 +97,5 @@ a light-weight cert-manager that, by default, is installed
 as part of the KLT software.
 If you are using another cert-manager in the cluster,
 you can configure KLT to instead use your cert-manager.
-See [Use your own cert-manager](cert-manager.md)
+See [Use Keptn with cert-manager.io](cert-manager.md)
 for detailed instructions.
diff --git a/helm/chart/templates/analysis-crd.yaml b/helm/chart/templates/analysis-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: analyses.metrics.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: metrics.keptn.sh

diff --git a/helm/chart/templates/analysisdefinition-crd.yaml b/helm/chart/templates/analysisdefinition-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: analysisdefinitions.metrics.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: metrics.keptn.sh

diff --git a/helm/chart/templates/analysisvaluetemplate-crd.yaml b/helm/chart/templates/analysisvaluetemplate-crd.yaml
@@ -5,6 +5,7 @@ metadata:
   name: analysisvaluetemplates.metrics.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: metrics.keptn.sh

diff --git a/helm/chart/templates/keptnapp-crd.yaml b/helm/chart/templates/keptnapp-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnapps.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnappcreationrequest-crd.yaml b/helm/chart/templates/keptnappcreationrequest-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnappcreationrequests.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnappversion-crd.yaml b/helm/chart/templates/keptnappversion-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnappversions.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnconfig-crd.yaml b/helm/chart/templates/keptnconfig-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnconfigs.options.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnevaluation-crd.yaml b/helm/chart/templates/keptnevaluation-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnevaluations.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnevaluationdefinition-crd.yaml b/helm/chart/templates/keptnevaluationdefinition-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnevaluationdefinitions.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnevaluationprovider-crd.yaml b/helm/chart/templates/keptnevaluationprovider-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnevaluationproviders.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnmetric-crd.yaml b/helm/chart/templates/keptnmetric-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnmetrics.metrics.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.0
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: metrics.keptn.sh

diff --git a/helm/chart/templates/keptnmetricsprovider-crd.yaml b/helm/chart/templates/keptnmetricsprovider-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnmetricsproviders.metrics.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.0
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: metrics.keptn.sh

diff --git a/helm/chart/templates/keptntask-crd.yaml b/helm/chart/templates/keptntask-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptntasks.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptntaskdefinition-crd.yaml b/helm/chart/templates/keptntaskdefinition-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptntaskdefinitions.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnworkload-crd.yaml b/helm/chart/templates/keptnworkload-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnworkloads.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/keptnworkloadinstance-crd.yaml b/helm/chart/templates/keptnworkloadinstance-crd.yaml
@@ -4,6 +4,7 @@ metadata:
   name: keptnworkloadinstances.lifecycle.keptn.sh
   annotations:
     controller-gen.kubebuilder.io/version: v0.12.1
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     app.kubernetes.io/part-of: keptn-lifecycle-toolkit
     crdGroup: lifecycle.keptn.sh

diff --git a/helm/chart/templates/lifecycle-mutating-webhook-configuration.yaml b/helm/chart/templates/lifecycle-mutating-webhook-configuration.yaml
@@ -3,7 +3,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: lifecycle-mutating-webhook-configuration
   annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     keptn.sh/inject-cert: "true"
     app.kubernetes.io/part-of: "keptn-lifecycle-toolkit"

diff --git a/helm/chart/templates/lifecycle-validating-webhook-configuration.yaml b/helm/chart/templates/lifecycle-validating-webhook-configuration.yaml
@@ -3,7 +3,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: lifecycle-validating-webhook-configuration
   annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     keptn.sh/inject-cert: "true"
   {{- include "chart.labels" . | nindent 4 }}

diff --git a/helm/chart/templates/metrics-validating-webhook-configuration.yaml b/helm/chart/templates/metrics-validating-webhook-configuration.yaml
@@ -3,7 +3,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: metrics-validating-webhook-configuration
   annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/
+    cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/klt-certs'
   labels:
     keptn.sh/inject-cert: "true"
   {{- include "chart.labels" . | nindent 4 }}