Skip to content

Commit 0235ed7

Browse files
ThomasMichael1811k9ne257Thomas Michael
authored
Create cert-manager (#238)
* Cert-Manager created Co-authored-by: Aaron Frey <aaron.frey@cloudogu.com> --------- Co-authored-by: Aaron Frey <aaron.frey@cloudogu.com> Co-authored-by: Thomas Michael <thomas.michael@cloudogu.com>
1 parent 18c1759 commit 0235ed7

17 files changed

+617
-19
lines changed

‎README.md

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Creates a complete GitOps-based operational stack on your Kubernetes clusters:
88
* Notifications/Alerts: Grafana and ArgoCD can be predefined with either an external mailserver or [MailHog](https://github.com/mailhog/MailHog) for demo purposes.
99
* Pipelines: Example applications using [Jenkins](#jenkins) with the [gitops-build-lib](https://github.com/cloudogu/gitops-build-lib) and [SCM-Manager](#scm-manager)
1010
* Ingress Controller: [ingress-nginx](https://github.com/kubernetes/ingress-nginx/)
11-
* Certificate Management: (planned)
11+
* Certificate Management: [cert-manager](#certificate-management)
1212
* Runs on:
1313
* local cluster (try it [with only one command](#tldr)),
1414
* in the public cloud,
@@ -551,6 +551,20 @@ Set the parameter `--vault=[dev|prod]` to enable deployment of secret management
551551
secrets operator.
552552
See [Secrets management tools](#secrets-managment-tools) for details.
553553

554+
##### Certificate Management
555+
Is implemented by cert-manager.
556+
Set the parameter `--cert-manager` to enable cert-manager.
557+
For custom images use this parameters to override defaults:
558+
- --cert-manager-image
559+
- --cert-manager-webhook-image
560+
- --cert-manager-cainjector-image
561+
- --cert-manager-acme-solver-image
562+
- --cert-manager-startup-api-check-image
563+
564+
i.e.
565+
```
566+
--cert-manager-image someRegistry/cert-manager-controller:latest
567+
```
554568
### Remove playground
555569

556570
For k3d, you can just `k3d cluster delete gitops-playground`. This will delete the whole cluster.

‎applications/cluster-resources/certManager-helm-values.ftl.yaml

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
<#assign DockerImageParser=statics['com.cloudogu.gitops.utils.DockerImageParser']>
2+
<#if config.registry.createImagePullSecrets == true>
3+
global:
4+
imagePullSecrets:
5+
- name: proxy-registry
6+
</#if>
7+
8+
<#if config.application.podResources == true>
9+
resources:
10+
limits:
11+
cpu: '1'
12+
memory: 400Mi
13+
requests:
14+
cpu: 30m
15+
memory: 400Mi
16+
</#if>
17+
<#if config.application.skipCrds != true>
18+
crds:
19+
enabled: true
20+
</#if>
21+
22+
<#if config.features.certManager.helm.image?has_content>
23+
<#assign imageObject = DockerImageParser.parse(config.features.certManager.helm.image)>
24+
image:
25+
repository: ${imageObject.registryAndRepositoryAsString}
26+
tag: ${imageObject.tag}
27+
</#if>
28+
29+
<#--webhookImage-->
30+
<#if config.application.podResources == true || config.features.certManager.helm.webhookImage?has_content>
31+
webhook:
32+
<#if config.application.podResources == true>
33+
resources:
34+
limits:
35+
cpu: '1'
36+
memory: 30Mi
37+
requests:
38+
cpu: 20m
39+
memory: 30Mi
40+
</#if>
41+
<#if config.features.certManager.helm.webhookImage?has_content>
42+
<#assign imageObject = DockerImageParser.parse(config.features.certManager.helm.webhookImage)>
43+
image:
44+
repository: ${imageObject.registryAndRepositoryAsString}
45+
tag: ${imageObject.tag}
46+
</#if>
47+
</#if>
48+
<#--cainjectorImage-->
49+
<#if config.application.podResources == true || config.features.certManager.helm.cainjectorImage?has_content>
50+
cainjector:
51+
<#if config.application.podResources >
52+
resources:
53+
limits:
54+
cpu: '1'
55+
memory: 400Mi
56+
requests:
57+
cpu: 30m
58+
memory: 400Mi
59+
</#if>
60+
<#if config.features.certManager.helm.cainjectorImage?has_content>
61+
<#assign imageObject = DockerImageParser.parse(config.features.certManager.helm.cainjectorImage)>
62+
image:
63+
repository: ${imageObject.registryAndRepositoryAsString}
64+
tag: ${imageObject.tag}
65+
</#if>
66+
</#if>
67+
68+
<#--acmeSolverImage-->
69+
<#if config.application.podResources == true || config.features.certManager.helm.acmeSolverImage?has_content>
70+
acmesolver:
71+
<#if config.application.podResources >
72+
resources:
73+
limits:
74+
cpu: '1'
75+
memory: 400Mi
76+
requests:
77+
cpu: 30m
78+
memory: 400Mi
79+
</#if>
80+
<#if config.features.certManager.helm.acmeSolverImage?has_content>
81+
<#assign imageObject = DockerImageParser.parse(config.features.certManager.helm.acmeSolverImage)>
82+
image:
83+
repository: ${imageObject.registryAndRepositoryAsString}
84+
tag: ${imageObject.tag}
85+
</#if>
86+
</#if>
87+
88+
<#--startupAPICheckImage-->
89+
<#if config.application.podResources == true || config.features.certManager.helm.startupAPICheckImage?has_content>
90+
startupapicheck:
91+
<#if config.application.podResources >
92+
resources:
93+
limits:
94+
cpu: '1'
95+
memory: 400Mi
96+
requests:
97+
cpu: 30m
98+
memory: 400Mi
99+
</#if>
100+
<#if config.features.certManager.helm.startupAPICheckImage?has_content>
101+
<#assign imageObject = DockerImageParser.parse(config.features.certManager.helm.startupAPICheckImage)>
102+
image:
103+
repository: ${imageObject.registryAndRepositoryAsString}
104+
tag: ${imageObject.tag}
105+
</#if>
106+
</#if>

‎argocd/argocd/argocd/values.ftl.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,10 @@ argo-cd:
105105
name: codecentric
106106
type: helm
107107
url: https://codecentric.github.io/helm-charts
108+
cert-manager:
109+
name: cert-manager
110+
type: helm
111+
url: https://charts.jetstack.io
108112
argo-helm-repo:
109113
type: helm
110114
url: https://argoproj.github.io/argo-helm

‎argocd/argocd/projects/cluster-resources.ftl.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,14 @@ spec:
2222
- ${scmm.baseUrl}/repo/3rd-party-dependencies/ingress-nginx
2323
- ${scmm.baseUrl}/repo/3rd-party-dependencies/external-secrets
2424
- ${scmm.baseUrl}/repo/3rd-party-dependencies/vault
25+
- ${scmm.baseUrl}/repo/3rd-party-dependencies/cert-manager
2526
<#else>
2627
- https://prometheus-community.github.io/helm-charts
2728
- https://codecentric.github.io/helm-charts
2829
- https://kubernetes.github.io/ingress-nginx
2930
- https://helm.releases.hashicorp.com
3031
- https://charts.external-secrets.io
32+
- https://charts.jetstack.io
3133
</#if>
3234

3335
# allow to only see application resources from the specified namespace

‎docs/configuration.schema.json

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,60 @@
169169
"additionalProperties" : false,
170170
"description" : "Configuration Parameter for the ArgoCD Operator"
171171
},
172+
"certManager" : {
173+
"type" : "object",
174+
"properties" : {
175+
"active" : {
176+
"type" : "boolean",
177+
"description" : "Sets and enables Cert Manager"
178+
},
179+
"helm" : {
180+
"type" : "object",
181+
"properties" : {
182+
"acmeSolverImage" : {
183+
"type" : "string",
184+
"description" : "Sets acmeSolver Image for Cert Manager"
185+
},
186+
"cainjectorImage" : {
187+
"type" : "string",
188+
"description" : "Sets cainjector Image for Cert Manager"
189+
},
190+
"chart" : {
191+
"type" : "string",
192+
"description" : "Name of the Helm chart"
193+
},
194+
"image" : {
195+
"type" : "string",
196+
"description" : "Sets image for Cert Manager"
197+
},
198+
"repoURL" : {
199+
"type" : "string",
200+
"description" : "Repository url from which the Helm chart should be obtained"
201+
},
202+
"startupAPICheckImage" : {
203+
"type" : "string",
204+
"description" : "Sets startupAPICheck Image for Cert Manager"
205+
},
206+
"values" : {
207+
"$ref" : "#/$defs/Map(String,Object)",
208+
"description" : "Helm values of the chart, allows overriding defaults and setting values that are not exposed as explicit configuration"
209+
},
210+
"version" : {
211+
"type" : "string",
212+
"description" : "The version of the Helm chart to be installed"
213+
},
214+
"webhookImage" : {
215+
"type" : "string",
216+
"description" : "Sets webhook Image for Cert Manager"
217+
}
218+
},
219+
"additionalProperties" : false,
220+
"description" : "Common Config parameters for the Helm package manager: Name of Chart (chart), URl of Helm-Repository (repoURL) and Chart Version (version). Note: These config is intended to obtain the chart from a different source (e.g. in air-gapped envs), not to use a different version of a helm chart. Using a different helm chart or version to the one used in the GOP version will likely cause errors."
221+
}
222+
},
223+
"additionalProperties" : false,
224+
"description" : "Config parameters for the Cert Manager"
225+
},
172226
"exampleApps" : {
173227
"type" : "object",
174228
"properties" : {

‎docs/developers.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,7 @@ notary:
391391

392392
Then install it like so:
393393
```bash
394+
helm repo add harbor https://helm.goharbor.io
394395
helm upgrade -i my-harbor harbor/harbor -f harbor-values.yaml --version 1.14.2 --namespace harbor --create-namespace
395396
```
396397
Once it's up and running either create your own private project or just set the existing `library` to private:
@@ -479,6 +480,11 @@ skopeo copy docker://quay.io/prometheus/prometheus:v2.51.2 --dest-creds Proxy:Pr
479480
skopeo copy docker://quay.io/prometheus-operator/prometheus-config-reloader:v0.73.2 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/prometheus-config-reloader
480481
skopeo copy docker://grafana/grafana:10.4.1 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/grafana
481482
skopeo copy docker://quay.io/kiwigrid/k8s-sidecar:1.27.4 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/k8s-sidecar
483+
# Cert Manager images
484+
skopeo copy docker://quay.io/jetstack/cert-manager-controller:v1.16.1 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/cert-manager-controller
485+
skopeo copy docker://quay.io/jetstack/cert-manager-cainjector:v1.16.1 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/cert-manager-cainjector
486+
skopeo copy docker://quay.io/jetstack/cert-manager-webhook:v1.16.1 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/cert-manager-webhook
487+
482488
```
483489
484490
* Deploy playground:

‎scripts/downloadHelmCharts.sh

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/usr/bin/env bash
22
set -o errexit -o nounset -o pipefail
33

4-
charts=( 'monitoring' 'externalSecrets' 'vault' 'mailhog' 'ingressNginx')
4+
charts=( 'monitoring' 'externalSecrets' 'vault' 'mailhog' 'ingressNginx' 'certManager')
55
APPLICATION_CONFIGURATOR_GROOVY="${1:-src/main/groovy/com/cloudogu/gitops/config/ApplicationConfigurator.groovy}"
66

77
tmpRepoFile="$(mktemp)"
@@ -10,12 +10,18 @@ mkdir -p charts
1010

1111
for chart in "${charts[@]}"; do
1212
chartDetails=$(grep -EA10 "${chart}.*:" "${APPLICATION_CONFIGURATOR_GROOVY}" \
13-
| grep -m1 -EA5 'helm.*:')
14-
13+
| grep -m1 -EA5 'helm.*:' || true)
14+
if [[ -z "$chartDetails" ]]; then
15+
echo "Did not find chart details for chart $chart in file ${APPLICATION_CONFIGURATOR_GROOVY} " >&2
16+
exit 1
17+
fi
1518
repo=$(echo "$chartDetails" | grep -oP "repoURL\s*:\s*'\K[^']+")
1619
chart=$(echo "$chartDetails" | grep -oP "chart\s*:\s*'\K[^']+")
1720
version=$(echo "$chartDetails" | grep -oP "version\s*:\s*'\K[^']+")
18-
21+
22+
# avoid Error: failed to untar: a file or directory with the name charts/$chart already exists
23+
rm -rf "./charts/$chart"
24+
1925
helm repo add "$chart" "$repo" --repository-config="${tmpRepoFile}"
2026
helm pull --untar --untardir ./charts "$chart/$chart" --version "$version" --repository-config="${tmpRepoFile}"
2127
# Note that keeping charts as tgx would need only 1/10 of storage

‎src/main/groovy/com/cloudogu/gitops/cli/GitopsPlaygroundCli.groovy

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ class GitopsPlaygroundCli implements Runnable {
5757
private String registryPasswordReadOnly
5858
@Option(names = ['--create-image-pull-secrets'], description = REGISTRY_CREATE_IMAGE_PULL_SECRETS_DESCRIPTION)
5959
private Boolean createImagePullSecrets
60-
60+
6161
// args group jenkins
6262
@Option(names = ['--jenkins-url'], description = JENKINS_URL_DESCRIPTION)
6363
private String jenkinsUrl
@@ -231,6 +231,28 @@ class GitopsPlaygroundCli implements Runnable {
231231
@Option(names = ['--ingress-nginx-image'], description = HELM_CONFIG_IMAGE_DESCRIPTION)
232232
private String ingressNginxImage
233233

234+
// args certManager
235+
@Option(names = ['--cert-manager'], description = CERTMANAGER_ENABLE_DESCRIPTION)
236+
private Boolean certManager
237+
238+
@Option(names = ['--cert-manager-image'], description = CERTMANAGER_IMAGE_DESCRIPTION)
239+
private String certManagerImage
240+
241+
@Option(names = ['--cert-manager-webhook-image'], description = CERTMANAGER_WEBHOOK_IMAGE_DESCRIPTION)
242+
private String webhookImage
243+
244+
@Option(names = ['--cert-manager-cainjector-image'], description = CERTMANAGER_CAINJECTOR_IMAGE_DESCRIPTION)
245+
private String cainjectorImage
246+
247+
@Option(names = ['--cert-manager-acme-solver-image'], description = CERTMANAGER_ACME_SOLVER_IMAGE_DESCRIPTION)
248+
private String acmeSolverImage
249+
250+
@Option(names = ['--cert-manager-startup-api-check-image'], description = CERTMANAGER_STARTUP_API_CHECK_IMAGE_DESCRIPTION)
251+
private String startupAPICheckImage
252+
253+
254+
255+
234256
@Override
235257
void run() {
236258
setLogging()
@@ -508,6 +530,16 @@ class GitopsPlaygroundCli implements Runnable {
508530
image: ingressNginxImage
509531
]
510532
],
533+
certManager: [
534+
active: certManager,
535+
helm: [
536+
image: certManagerImage,
537+
webhookImage: webhookImage,
538+
cainjectorImage: cainjectorImage,
539+
acmeSolverImage: acmeSolverImage,
540+
startupAPICheckImage: startupAPICheckImage
541+
]
542+
],
511543

512544
]
513545
]

‎src/main/groovy/com/cloudogu/gitops/cli/GitopsPlaygroundCliMainScripted.groovy

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ class GitopsPlaygroundCliMainScripted {
116116
new Content(config,k8sClient),
117117
new ArgoCD(config, k8sClient, helmClient, fileSystemUtils, scmmRepoProvider),
118118
new IngressNginx(config, fileSystemUtils, deployer, k8sClient, airGappedUtils),
119+
new CertManager(config,fileSystemUtils, deployer, k8sClient, airGappedUtils),
119120
new Mailhog(config, fileSystemUtils, deployer, k8sClient, airGappedUtils),
120121
new PrometheusStack(config, fileSystemUtils, deployer, k8sClient, airGappedUtils, scmmRepoProvider),
121122
new ExternalSecretsOperator(config, fileSystemUtils, deployer, k8sClient, airGappedUtils),

0 commit comments

Comments
 (0)