Skip to content

Commit 44b11ec

Browse files
skopacz1skopacz1
authored
Merge pull request #77785 from michaelryanmcneill/OSDOCS-10979
[OSDOCS-10979] updating Dynamic Certificates tutorial to remove references to the CDO
2 parents 8fd0d43 + 1689802 commit 44b11ec

File tree

1 file changed

+61
-44
lines changed

1 file changed

+61
-44
lines changed

‎cloud_experts_tutorials/cloud-experts-dynamic-certificate-custom-domain.adoc

Lines changed: 61 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ Learn how to use the link:https://docs.openshift.com/container-platform/latest/s
2424
[id="cloud-experts-dynamic-certificate-custom-domain-prerequisites"]
2525
== Prerequisites
2626

27-
* A ROSA cluster
27+
* A ROSA cluster (HCP or Classic)
2828
* A user account with `cluster-admin` privileges
2929
* The OpenShift CLI (`oc`)
3030
* The Amazon Web Services (AWS) CLI (`aws`)
31-
* A unique domain, such as `*.apps.<company_name>.io`
31+
* A unique domain, such as `*.apps.example.com`
3232
* An Amazon Route 53 public hosted zone for the above domain
3333

3434
[id="cloud-experts-dynamic-certificate-custom-domain-environment-setup"]
@@ -38,24 +38,35 @@ Learn how to use the link:https://docs.openshift.com/container-platform/latest/s
3838
+
3939
[source,terminal]
4040
----
41-
$ export DOMAIN=apps.<company_name>.io <1>
42-
$ export EMAIL=<youremail@company_name.io> <2>
41+
$ export DOMAIN=apps.example.com <1>
42+
$ export EMAIL=email@example.com <2>
4343
$ export AWS_PAGER=""
44-
$ export CLUSTER_NAME=$(oc get infrastructure cluster -o=jsonpath="{.status.infrastructureName}" | sed 's/-[a-z0-9]\{5\}$//')
44+
$ export CLUSTER=$(oc get infrastructure cluster -o=jsonpath="{.status.infrastructureName}" | sed 's/-[a-z0-9]\{5\}$//')
4545
$ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed 's|^https://||')
4646
$ export REGION=$(oc get infrastructure cluster -o=jsonpath="{.status.platformStatus.aws.region}")
4747
$ export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
48-
$ export SCRATCH="/tmp/${CLUSTER_NAME}/dynamic-certs"
48+
$ export SCRATCH="/tmp/${CLUSTER}/dynamic-certs"
4949
$ mkdir -p ${SCRATCH}
5050
----
51-
<1> The custom domain.
52-
<2> The e-mail Let's Encrypt will use to send notifications about your certificates.
51+
<1> Replace with the custom domain you want to use for the `IngressController`.
52+
<2> Replace with the e-mail you want Let's Encrypt to use to send notifications about your certificates.
53+
+
5354
. Ensure all fields output correctly before moving to the next section:
5455
+
5556
[source,terminal]
5657
----
57-
$ echo "Cluster: ${CLUSTER_NAME}, Region: ${REGION}, OIDC Endpoint: ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
58+
$ echo "Cluster: ${CLUSTER}, Region: ${REGION}, OIDC Endpoint: ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
5859
----
60+
+
61+
[NOTE]
62+
====
63+
The "Cluster" output from the previous command may be the name of your cluster, the internal ID of your cluster, or the cluster's domain prefix. If you prefer to use another identifier, you can manually set this value by running the following command:
64+
65+
[source,terminal]
66+
----
67+
$ export CLUSTER=my-custom-value
68+
----
69+
====
5970

6071
[id="cloud-experts-dynamic-certificate-prep-aws"]
6172
== Preparing your AWS account
@@ -77,7 +88,7 @@ $ export ZONE_ID=$(aws route53 list-hosted-zones-by-name --output json \
7788
--dns-name "${DOMAIN}." --query 'HostedZones[0]'.Id --out text | sed 's/\/hostedzone\///')
7889
----
7990
+
80-
. Create an AWS IAM policy document for the `cert-manager` Operator that provides the ability to update _only_ the specified public hosted zone:
91+
. Create an AWS IAM policy document for the cert-manager Operator that provides the ability to update _only_ the specified public hosted zone:
8192
+
8293
[source,terminal]
8394
----
@@ -112,11 +123,11 @@ EOF
112123
+
113124
[source,terminal]
114125
----
115-
$ POLICY_ARN=$(aws iam create-policy --policy-name "${CLUSTER_NAME}-cert-manager-policy" \
126+
$ POLICY_ARN=$(aws iam create-policy --policy-name "${CLUSTER}-cert-manager-policy" \
116127
--policy-document file://${SCRATCH}/cert-manager-policy.json \
117128
--query 'Policy.Arn' --output text)
118129
----
119-
. Create an AWS IAM trust policy for the `cert-manager` Operator:
130+
. Create an AWS IAM trust policy for the cert-manager Operator:
120131
+
121132
[source,terminal]
122133
----
@@ -141,11 +152,11 @@ $ cat <<EOF > "${SCRATCH}/trust-policy.json"
141152
EOF
142153
----
143154
+
144-
. Create an IAM role for the `cert-manager` Operator using the trust policy you created in the previous step:
155+
. Create an IAM role for the cert-manager Operator using the trust policy you created in the previous step:
145156
+
146157
[source,terminal]
147158
----
148-
$ ROLE_ARN=$(aws iam create-role --role-name "${CLUSTER_NAME}-cert-manager-operator" \
159+
$ ROLE_ARN=$(aws iam create-role --role-name "${CLUSTER}-cert-manager-operator" \
149160
--assume-role-policy-document "file://${SCRATCH}/trust-policy.json" \
150161
--query Role.Arn --output text)
151162
----
@@ -154,14 +165,14 @@ $ ROLE_ARN=$(aws iam create-role --role-name "${CLUSTER_NAME}-cert-manager-opera
154165
+
155166
[source,terminal]
156167
----
157-
$ aws iam attach-role-policy --role-name "${CLUSTER_NAME}-cert-manager-operator" \
168+
$ aws iam attach-role-policy --role-name "${CLUSTER}-cert-manager-operator" \
158169
--policy-arn ${POLICY_ARN}
159170
----
160171

161172
[id="cloud-experts-dynamic-certificate-custom-domain-install-cert-man-op"]
162173
== Installing the cert-manager Operator
163174

164-
. Create a project to install the `cert-manager` Operator into:
175+
. Create a project to install the cert-manager Operator into:
165176
+
166177
[source,terminal]
167178
----
@@ -170,10 +181,10 @@ $ oc new-project cert-manager-operator
170181
+
171182
[IMPORTANT]
172183
====
173-
Do not attempt to use more than one `cert-manager` Operator in your cluster. If you have a community `cert-manager` Operator installed in your cluster, you must uninstall it before installing the `cert-manager` Operator for Red{nbsp}Hat OpenShift.
184+
Do not attempt to use more than one cert-manager Operator in your cluster. If you have a community cert-manager Operator installed in your cluster, you must uninstall it before installing the cert-manager Operator for Red{nbsp}Hat OpenShift.
174185
====
175186
+
176-
. Install the `cert-manager` Operator for Red{nbsp}Hat OpenShift:
187+
. Install the cert-manager Operator for Red Hat OpenShift:
177188
+
178189
[source,terminal]
179190
----
@@ -206,7 +217,7 @@ EOF
206217
It takes a few minutes for this Operator to install and complete its set up.
207218
====
208219
+
209-
. Verify that the `cert-manager` Operator is running:
220+
. Verify that the cert-manager Operator is running:
210221
+
211222
[source,terminal]
212223
----
@@ -220,14 +231,14 @@ NAME READY STATUS RE
220231
cert-manager-operator-controller-manager-84b8799db5-gv8mx 2/2 Running 0 12s
221232
----
222233
+
223-
. Annotate the service account used by the `cert-manager` pods with the AWS IAM role you created earlier:
234+
. Annotate the service account used by the cert-manager pods with the AWS IAM role you created earlier:
224235
+
225236
[source,terminal]
226237
----
227238
$ oc -n cert-manager annotate serviceaccount cert-manager eks.amazonaws.com/role-arn=${ROLE_ARN}
228239
----
229240
+
230-
. Restart the existing `cert-manager` controller pod by running the following command:
241+
. Restart the existing cert-manager controller pod by running the following command:
231242
+
232243
[source,terminal]
233244
----
@@ -286,13 +297,6 @@ letsencrypt-production True 47s
286297
[id="cloud-experts-dynamic-certificate-custom-domain-create-cd-ingress-con"]
287298
== Creating a custom domain Ingress Controller
288299

289-
. Create a new project:
290-
+
291-
[source,terminal]
292-
----
293-
$ oc new-project custom-domain-ingress
294-
----
295-
+
296300
. Create and configure a certificate resource to provision a certificate for the custom domain Ingress Controller:
297301
+
298302
[NOTE]
@@ -307,7 +311,7 @@ apiVersion: cert-manager.io/v1
307311
kind: Certificate
308312
metadata:
309313
name: custom-domain-ingress-cert
310-
namespace: custom-domain-ingress
314+
namespace: openshift-ingress
311315
spec:
312316
secretName: custom-domain-ingress-cert-tls
313317
issuerRef:
@@ -323,12 +327,12 @@ EOF
323327
+
324328
[NOTE]
325329
====
326-
It takes a few minutes for this certificate to be issued by Let's Encrypt. If it takes longer than 5 minutes, run `oc -n custom-domain-ingress describe certificate.cert-manager.io/custom-domain-ingress-cert` to see any issues reported by cert-manager.
330+
It takes a few minutes for this certificate to be issued by Let's Encrypt. If it takes longer than 5 minutes, run `oc -n openshift-ingress describe certificate.cert-manager.io/custom-domain-ingress-cert` to see any issues reported by cert-manager.
327331
====
328332
+
329333
[source,terminal]
330334
----
331-
$ oc -n custom-domain-ingress get certificate.cert-manager.io/custom-domain-ingress-cert
335+
$ oc -n openshift-ingress get certificate.cert-manager.io/custom-domain-ingress-cert
332336
----
333337
+
334338
.Example output
@@ -339,43 +343,56 @@ NAME READY SECRET AGE
339343
custom-domain-ingress-cert True custom-domain-ingress-cert-tls 9m53s
340344
----
341345
+
342-
. Create a new `CustomDomain` custom resource (CR):
346+
. Create a new `IngressController` resource:
343347
+
344348
[source,terminal]
345349
----
346350
$ cat << EOF | oc apply -f -
347-
apiVersion: managed.openshift.io/v1alpha1
348-
kind: CustomDomain
351+
apiVersion: operator.openshift.io/v1
352+
kind: IngressController
349353
metadata:
350354
name: custom-domain-ingress
355+
namespace: openshift-ingress-operator
351356
spec:
352357
domain: ${DOMAIN}
353-
scope: External
354-
loadBalancerType: NLB
355-
certificate:
358+
defaultCertificate:
356359
name: custom-domain-ingress-cert-tls
357-
namespace: custom-domain-ingress
360+
endpointPublishingStrategy:
361+
loadBalancer:
362+
dnsManagementPolicy: Unmanaged
363+
providerParameters:
364+
aws:
365+
type: NLB
366+
type: AWS
367+
scope: External
368+
type: LoadBalancerService
358369
EOF
359370
----
360-
. Verify that your custom domain Ingress Controller has been deployed and has a `Ready` status:
371+
+
372+
[WARNING]
373+
====
374+
This `IngressController` example will create an internet accessible Network Load Balancer (NLB) in your AWS account. To provision an internal NLB instead, set the `.spec.endpointPublishingStrategy.loadBalancer.scope` parameter to `Internal` before creating the `IngressController` resource.
375+
====
376+
+
377+
. Verify that your custom domain IngressController has successfully created an external load balancer:
361378
+
362379
[source,terminal]
363380
----
364-
$ oc get customdomains
381+
$ oc -n openshift-ingress get service/router-custom-domain-ingress
365382
----
366383
+
367384
.Example output
368385
[source,terminal]
369386
----
370-
NAME ENDPOINT DOMAIN STATUS
371-
custom-domain-ingress tfoxdx.custom-domain-ingress.cluster.1234.p1.openshiftapps.com example.com Ready
387+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
388+
router-custom-domain-ingress LoadBalancer 172.30.174.34 a309962c3bd6e42c08cadb9202eca683-1f5bbb64a1f1ec65.elb.us-east-1.amazonaws.com 80:31342/TCP,443:31821/TCP 7m28s
372389
----
373390
+
374391
. Prepare a document with the necessary DNS changes to enable DNS resolution for your custom domain Ingress Controller:
375392
+
376393
[source,terminal]
377394
----
378-
$ INGRESS=$(oc get customdomain.managed.openshift.io/custom-domain-ingress --template={{.status.endpoint}})
395+
$ INGRESS=$(oc -n openshift-ingress get service/router-custom-domain-ingress -ojsonpath="{.status.loadBalancer.ingress[0].hostname}")
379396
$ cat << EOF > "${SCRATCH}/create-cname.json"
380397
{
381398
"Comment":"Add CNAME to custom domain endpoint",
@@ -504,7 +521,7 @@ $ oc -n hello-world annotate route hello-openshift-tls cert-manager.io/issuer-ki
504521
+
505522
[NOTE]
506523
====
507-
It takes 2-3 minutes for the certificate to be created. The renewal of the certificate will automatically be managed by the `cert-manager` Operator as it approaches expiration.
524+
It takes 2-3 minutes for the certificate to be created. The renewal of the certificate will automatically be managed by the cert-manager Operator as it approaches expiration.
508525
====
509526
. Verify the certificate for the route is now trusted:
510527
+

0 commit comments

Comments
 (0)