Merge pull request #408 from rackerlabs/cluster-issuer

cardoe · web-flow · commit a315f0fba3c9 · 2024-10-25T13:01:03.000Z
feat: refactor cert-manager issuer for better default
diff --git a/apps/appsets/components.yaml b/apps/appsets/components.yaml
@@ -50,9 +50,6 @@ spec:
                               - op: replace
                                 path: /spec/tls/0/hosts/0
                                 value: dex.{{index .metadata.annotations "dns_zone" }}
-                              - op: replace
-                                path: '/metadata/annotations/cert-manager.io~1cluster-issuer'
-                                value: 'understack-cluster-issuer'
                     - repoURL: '{{index .metadata.annotations "uc_deploy_git_url"}}'
                       targetRevision: '{{index .metadata.annotations "uc_deploy_ref"}}'
                       ref: deploy
@@ -85,9 +82,6 @@ spec:
                         releaseName: nautobot
                         valuesObject:
                           ingress:
-                            annotations:
-                              cert-manager.io/cluster-issuer: 'understack-cluster-issuer'
-                              nginx.ingress.kubernetes.io/backend-protocol: HTTPS
                             hostname: 'nautobot.{{index .metadata.annotations "dns_zone" }}'
                         valueFiles:
                           - $understack/components/nautobot/nautobot-values.yaml
@@ -158,9 +152,6 @@ spec:
                             - op: replace
                               path: /spec/tls/0/hosts/0
                               value: workflows.{{index .metadata.annotations "dns_zone" }}
-                            - op: replace
-                              path: '/metadata/annotations/cert-manager.io~1cluster-issuer'
-                              value: 'understack-cluster-issuer'
                 - component: argo-events
                   skipComponent: '{{has "argo-events" ((default "[]" (index .metadata.annotations "uc_skip_components") | fromJson))}}'
                   sources:
diff --git a/components/argo/ingress.yaml b/components/argo/ingress.yaml
@@ -3,7 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    cert-manager.io/cluster-issuer: selfsigned-cluster-issuer
+    cert-manager.io/cluster-issuer: understack-cluster-issuer
     nginx.ingress.kubernetes.io/backend-protocol: HTTPS
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
   name: argo-workflows
diff --git a/components/dex/ingress.yaml b/components/dex/ingress.yaml
@@ -3,7 +3,7 @@ kind: Ingress
 metadata:
   name: dex
   annotations:
-    cert-manager.io/cluster-issuer: selfsigned-cluster-issuer
+    cert-manager.io/cluster-issuer: understack-cluster-issuer
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
 spec:
   ingressClassName: nginx
diff --git a/components/glance/aio-values.yaml b/components/glance/aio-values.yaml
@@ -17,12 +17,25 @@ endpoints:
         public: 443
     scheme:
       public: https
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: glance-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
 
 network:
   # configure OpenStack Helm to use Undercloud's ingress
   # instead of expecting the ingress controller provided
   # by OpenStack Helm
   use_external_ingress_controller: true
+  api:
+    ingress:
+      annotations:
+        nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
 
 # Glance storage backend
 # we'll switch to radosgw in the future
diff --git a/components/horizon/aio-values.yaml b/components/horizon/aio-values.yaml
@@ -14,11 +14,27 @@ conf:
         allowed_hosts:
           - '*'
 
+endpoints:
+  dashboard:
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: keystone-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
+
 network:
   # configure OpenStack Helm to use Undercloud's ingress
   # instead of expecting the ingress controller provided
   # by OpenStack Helm
   use_external_ingress_controller: true
+  dashboard:
+    ingress:
+      annotations:
+        nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
 
 # (nicholas.kuechler) updating the jobs list to remove the 'horizon-db-init' job.
 dependencies:
diff --git a/components/ironic/aio-values.yaml b/components/ironic/aio-values.yaml
@@ -82,6 +82,13 @@ endpoints:
         public: 443
     scheme:
       public: https
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: ironic-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
 
 network:
   api:
@@ -92,6 +99,8 @@ network:
         cluster: "nginx-openstack"
       annotations:
         nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
     external_policy_local: false
     node_port:
       enabled: false
diff --git a/components/keystone/aio-values.yaml b/components/keystone/aio-values.yaml
@@ -98,6 +98,12 @@ network:
   # instead of expecting the ingress controller provided
   # by OpenStack Helm
   use_external_ingress_controller: true
+  api:
+    ingress:
+      annotations:
+        nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
 
 dependencies:
   static:
@@ -317,6 +323,13 @@ endpoints:
     port:
       api:
         public: 443
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: keystone-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
 
 manifests:
   job_credential_cleanup: false
diff --git a/components/nautobot/nautobot-values.yaml b/components/nautobot/nautobot-values.yaml
@@ -66,5 +66,5 @@ ingress:
   tls: true
   secretName: "nautobot-ingress-tls"
   annotations:
-    cert-manager.io/cluster-issuer: selfsigned-cluster-issuer
+    cert-manager.io/cluster-issuer: understack-cluster-issuer
     nginx.ingress.kubernetes.io/backend-protocol: HTTPS
diff --git a/components/neutron/aio-values.yaml b/components/neutron/aio-values.yaml
@@ -17,6 +17,13 @@ endpoints:
         public: 443
     scheme:
       public: https
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: neutron-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
 
 
 network:
@@ -28,6 +35,12 @@ network:
   # instead of expecting the ingress controller provided
   # by OpenStack Helm
   use_external_ingress_controller: true
+  server:
+    ingress:
+      annotations:
+        nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
 
 conf:
   plugins:
diff --git a/components/nova/aio-values.yaml b/components/nova/aio-values.yaml
@@ -24,6 +24,13 @@ endpoints:
         public: 443
     scheme:
       public: https
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: nova-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
 
 network:
   # we're using ironic and actual switches
@@ -34,6 +41,12 @@ network:
   # instead of expecting the ingress controller provided
   # by OpenStack Helm
   use_external_ingress_controller: true
+  osapi:
+    ingress:
+      annotations:
+        nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
 
 conf:
   ceph:
diff --git a/components/openstack-secrets.tpl.yaml b/components/openstack-secrets.tpl.yaml
@@ -33,12 +33,6 @@ endpoints:
     host_fqdn_override:
       public:
         host: keystone.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: keystone-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
   # 'oslo_cache' is the memcache layer
   oslo_cache:
@@ -108,77 +102,41 @@ endpoints:
     host_fqdn_override:
       public:
         host: ironic.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: ironic-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
   # 'image' is the glance service
   image:
     # set our public facing URL
     host_fqdn_override:
       public:
         host: glance.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: glance-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
   # 'network' is the neutron service
   network:
     # set our public facing URL
     host_fqdn_override:
       public:
         host: neutron.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: neutron-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
   # 'compute' is the nova service
   compute:
     # set our public facing URL
     host_fqdn_override:
       public:
         host: nova.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: nova-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
   # 'placement' is the nova service
   placement:
     # set our public facing URL
     host_fqdn_override:
       public:
         host: placement.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: placement-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
   # 'dashboard' is the horizon service
   dashboard:
     # set our public facing URL
     host_fqdn_override:
       public:
         host: horizon.${DNS_ZONE}
-        tls:
-          # must match the value in the top level 'secrets' key for the public endpoint
-          secretName: horizon-tls-public
-          issuerRef:
-            name: understack-cluster-issuer
-            kind: ClusterIssuer
 
 # necessary cause the ingress definition in openstack-helm-infra helm-toolkit hardcodes this
 secrets:
diff --git a/components/placement/aio-values.yaml b/components/placement/aio-values.yaml
@@ -6,6 +6,12 @@ network:
   # instead of expecting the ingress controller provided
   # by OpenStack Helm
   use_external_ingress_controller: true
+  api:
+    ingress:
+      annotations:
+        nginx.ingress.kubernetes.io/rewrite-target: /
+        # set our default issuer
+        cert-manager.io/cluster-issuer: understack-cluster-issuer
 
 # (nicholas.kuechler) updating the jobs list to remove the 'placement-db-init' job.
 dependencies:
@@ -63,3 +69,10 @@ endpoints:
     port:
       api:
         public: 443
+    host_fqdn_override:
+      public:
+        tls:
+          secretName: placement-tls-public
+          issuerRef:
+            name: understack-cluster-issuer
+            kind: ClusterIssuer
diff --git a/scripts/gitops-secrets-gen.sh b/scripts/gitops-secrets-gen.sh
@@ -144,7 +144,7 @@ if [ ! -f "${DEST_DIR}/cert-manager/cluster-issuer.yaml" ]; then
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: ${DEPLOY_NAME}-cluster-issuer
+  name: understack-cluster-issuer
   annotations:
     argocd.argoproj.io/sync-wave: "5"
 spec:
