Skip to content

Commit 5d76bf6

Browse files
snarayan-redhatsnarayan-redhat
authored
Merge pull request #59726 from xenolinux/cert-manager-customizing-api-fields
OSDOCS#6020: cert-manager: Customizing API fields
2 parents 5effd3a + d9025b4 commit 5d76bf6

File tree

4 files changed

+208
-0
lines changed

4 files changed

+208
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1015,6 +1015,8 @@ Topics:
10151015
File: cert-manager-monitoring
10161016
- Name: Configuring the egress proxy for the cert-manager Operator for Red Hat OpenShift
10171017
File: cert-manager-operator-proxy
1018+
- Name: Customizing cert-manager by using the cert-manager Operator API fields
1019+
File: cert-manager-customizing-api-fields
10181020
- Name: Uninstalling the cert-manager Operator for Red Hat OpenShift
10191021
File: cert-manager-operator-uninstall
10201022
- Name: Viewing audit logs

‎modules/cert-manager-override-arguments.adoc‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-override-arguments_{context}"]
7+
= Customizing cert-manager by overriding arguments from the cert-manager Operator API
8+
9+
You can override the supported arguments for the {cert-manager-operator} by adding a `spec.controllerConfig` section in the `CertManager` resource.
10+
11+
.Prerequisites
12+
13+
* You have access to the {product-title} cluster as a user with the `cluster-admin` role.
14+
15+
.Procedure
16+
17+
. Edit the `CertManager` resource by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ oc edit certmanager cluster
22+
----
23+
24+
. Add a `spec.controllerConfig` section with the following override arguments:
25+
+
26+
[source,yaml]
27+
----
28+
apiVersion: operator.openshift.io/v1alpha1
29+
kind: CertManager
30+
metadata:
31+
name: cluster
32+
...
33+
spec:
34+
...
35+
controllerConfig:
36+
overrideArgs:
37+
- '--dns01-recursive-nameservers=<host>:<port>' <1>
38+
- '--dns01-recursive-nameservers-only' <2>
39+
- '--acme-http01-solver-nameservers=<host>:<port>' <3>
40+
- '--v=<verbosity_level>' <4>
41+
- '--metrics-listen-address=<host>:<port>' <5>
42+
webhookConfig:
43+
overrideArgs:
44+
- '--v=4' <4>
45+
cainjectorConfig:
46+
overrideArgs:
47+
- '--v=2' <4>
48+
----
49+
<1> Provide a comma-separated list of `<host>:<port>` nameservers to query for the DNS-01 self check. For example, `--dns01-recursive-nameservers=1.1.1.1:53`.
50+
<2> Specify to only use recursive nameservers instead of checking the authoritative nameservers associated with that domain.
51+
<3> Provide a comma-separated list of `<host>:<port>` nameservers to query for the ACME HTTP01 self check. For example, `--acme-http01-solver-nameservers=1.1.1.1:53`.
52+
<4> Specify to set the log level verbosity to determine the verbosity of log messages.
53+
<5> Specify the host and port for the metrics endpoint. The default value is `--metrics-listen-address=0.0.0.0:9402`.
54+
55+
. Save your changes and quit the text editor to apply your changes.
56+
57+
.Verification
58+
59+
* Verify that arguments are updated for cert-manager pods by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc get pods -n cert-manager -o yaml
64+
----
65+
+
66+
.Example output
67+
[source,yaml]
68+
----
69+
...
70+
metadata:
71+
name: cert-manager-6d4b5d4c97-kldwl
72+
namespace: cert-manager
73+
...
74+
spec:
75+
containers:
76+
- args:
77+
- --acme-http01-solver-nameservers=1.1.1.1:53
78+
- --cluster-resource-namespace=$(POD_NAMESPACE)
79+
- --dns01-recursive-nameservers=1.1.1.1:53
80+
- --dns01-recursive-nameservers-only
81+
- --leader-election-namespace=kube-system
82+
- --max-concurrent-challenges=60
83+
- --metrics-listen-address=0.0.0.0:9042
84+
- --v=6
85+
...
86+
metadata:
87+
name: cert-manager-cainjector-866c4fd758-ltxxj
88+
namespace: cert-manager
89+
...
90+
spec:
91+
containers:
92+
- args:
93+
- --leader-election-namespace=kube-system
94+
- --v=2
95+
...
96+
metadata:
97+
name: cert-manager-webhook-6d48f88495-c88gd
98+
namespace: cert-manager
99+
...
100+
spec:
101+
containers:
102+
- args:
103+
...
104+
- --v=4
105+
----

‎modules/cert-manager-override-environment-variables.adoc‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-override-environment-variables_{context}"]
7+
= Customizing cert-manager by overriding environment variables from the cert-manager Operator API
8+
9+
You can override the supported environment variables for the {cert-manager-operator} by adding a `spec.controllerConfig` section in the `CertManager` resource.
10+
11+
.Prerequisites
12+
13+
* You have access to the {product-title} cluster as a user with the `cluster-admin` role.
14+
15+
.Procedure
16+
17+
. Edit the `CertManager` resource by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ oc edit certmanager cluster
22+
----
23+
24+
. Add a `spec.controllerConfig` section with the following override arguments:
25+
+
26+
[source,yaml]
27+
----
28+
apiVersion: operator.openshift.io/v1alpha1
29+
kind: CertManager
30+
metadata:
31+
name: cluster
32+
...
33+
spec:
34+
...
35+
controllerConfig:
36+
overrideEnv:
37+
- name: HTTP_PROXY
38+
value: http://<proxy_url> <1>
39+
- name: HTTPS_PROXY
40+
value: https://<proxy_url> <1>
41+
- name: NO_PROXY
42+
value: <ignore_proxy_domains> <2>
43+
----
44+
<1> Replace `<proxy_url>` with the proxy server URL.
45+
<2> Replace `<ignore_proxy_domains>` with a comma separated list of domains. These domains are ignored by the proxy server.
46+
47+
. Save your changes and quit the text editor to apply your changes.
48+
49+
.Verification
50+
51+
. Verify that the cert-manager controller pod is redeployed by running the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc get pods -l app.kubernetes.io/name=cert-manager -n cert-manager
56+
----
57+
+
58+
.Example output
59+
[source,terminal]
60+
----
61+
NAME READY STATUS RESTARTS AGE
62+
cert-manager-bd7fbb9fc-wvbbt 1/1 Running 0 39s
63+
----
64+
65+
. Verify that environment variables are updated for the cert-manager pod by running the following command:
66+
+
67+
[source,terminal]
68+
----
69+
$ oc get pod <redeployed_cert-manager_controller_pod> -n cert-manager -o yaml
70+
----
71+
+
72+
.Example output
73+
[source,yaml]
74+
----
75+
env:
76+
...
77+
- name: HTTP_PROXY
78+
value: http://<PROXY_URL>
79+
- name: HTTPS_PROXY
80+
value: https://<PROXY_URL>
81+
- name: NO_PROXY
82+
value: <IGNORE_PROXY_DOMAINS>
83+
----

‎security/cert_manager_operator/cert-manager-customizing-api-fields.adoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
:_content-type: ASSEMBLY
2+
[id="cert-manager-customizing-api-fields"]
3+
= Customizing cert-manager Operator API fields
4+
include::_attributes/common-attributes.adoc[]
5+
:context: cert-manager-customizing-api-fields
6+
7+
toc::[]
8+
9+
You can customize the {cert-manager-operator} API fields by overriding environment variables and arguments.
10+
11+
[WARNING]
12+
====
13+
To override unsupported arguments, you can add `spec.unsupportedConfigOverrides` section in the `CertManager` resource, but using `spec.unsupportedConfigOverrides` is unsupported.
14+
====
15+
16+
include::modules/cert-manager-override-environment-variables.adoc[leveloffset=+1]
17+
18+
include::modules/cert-manager-override-arguments.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)