Skip to content

Changes to certificate management #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
craddm merged 33 commits into from
Apr 14, 2026
Merged

Changes to certificate management #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
2f085b1
Remove unused imports
craddm Feb 26, 2026
6827409
Switch to Release for cert-manager, and update
craddm Feb 26, 2026
bb4827f
Rewrite ingress using native pulumi to avoid random strings on tls se…
craddm Feb 20, 2026
e25f6fc
use some of the suggested best practice values for cert manager
craddm Feb 27, 2026
9dc7816
switch to cluster ip and load balancer for Harbor
craddm Mar 2, 2026
229bb87
Generate certificates in each relevant namespace
craddm Mar 3, 2026
d2c376a
Updated isolated cluster cert manager config
craddm Mar 3, 2026
1f0a97f
point argo workflows to minio cert
craddm Mar 3, 2026
e1bc5ae
Add trust manager and create a bundle of trusted certs
craddm Mar 3, 2026
c5fd522
Label relevant namespaces to receive copy of cert bundle
craddm Mar 3, 2026
38d70be
Correct s3 bucket
craddm Mar 3, 2026
374f8eb
Add trust manager network policies
craddm Mar 3, 2026
5722507
Add dev root issuer to trust bundle
craddm Mar 4, 2026
fd95f6d
Remove extra certificate
craddm Mar 4, 2026
7d06557
Always create self signed cert issuer for internal use
craddm Mar 4, 2026
eb9fb9a
update copy workflow to use trusted cert bundle
craddm Mar 4, 2026
116e5a9
Merge branch 'main' into better-certs
craddm Mar 4, 2026
974c0bb
Add required imports
craddm Mar 4, 2026
050e86d
Merge branch 'main' into better-certs
craddm Mar 4, 2026
67393ad
Merge remote-tracking branch 'upstream/main' into better-certs
craddm Mar 9, 2026
35732d7
Merge branch 'main' into better-certs
craddm Mar 17, 2026
4fef4dd
Remove LetsEncrypt
craddm Mar 18, 2026
6df1dd9
Use a minio-specific trust bundle with the right name to be picked up…
craddm Mar 18, 2026
3232d18
remove tls environment config variables from cert manager
craddm Mar 18, 2026
e32d844
Add ca cert bundle to s3 artifact in argo workflows values
craddm Mar 18, 2026
17e57d9
Remove tls environment
craddm Mar 18, 2026
d74cbc7
add all outputs directly
craddm Mar 18, 2026
262fc06
remove superfluous tls environment variables
craddm Mar 18, 2026
8f666eb
remove network rules for contacting letsencrypt
craddm Mar 18, 2026
727a0e8
pass dev issuer to objectstorage
craddm Mar 18, 2026
0459cd4
Merge branch 'main' into better-certs
craddm Mar 26, 2026
ca35347
Merge branch 'main' into better-certs
craddm Apr 1, 2026
634717f
Merge branch 'alan-turing-institute:main' into better-certs
craddm Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
160 changes: 160 additions & 0 deletions infra/fridge/access-cluster/components/cert_manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,11 +52,171 @@ def __init__(
repository_opts=RepositoryOptsArgs(
repo="https://charts.jetstack.io",
),
# Adapted from https://cert-manager.io/docs/installation/best-practice/#best-practice-helm-chart-values
values={
"crds": {"enabled": True},
"extraArgs": [
"--acme-http01-solver-nameservers=8.8.8.8:53,1.1.1.1:53"
],
"global": {
"priorityClass": "system-cluster-critical",
},
"automountServiceAccountToken": False,
"serviceAccount": {
"automountServiceAccountToken": False,
},
"volumes": [
{
"name": "serviceaccount-token",
"projected": {
"defaultMode": 0o444,
"sources": [
{
"serviceAccountToken": {
"expirationSeconds": 3607,
"path": "token",
}
},
{
"configMap": {
"name": "kube-root-ca.crt",
"items": [
{"key": "ca.crt", "path": "ca.crt"}
],
}
},
{
"downwardAPI": {
"items": [
{
"path": "namespace",
"fieldRef": {
"apiVersion": "v1",
"fieldPath": "metadata.namespace",
},
}
]
}
},
],
},
}
],
"volumeMounts": [
{
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
"name": "serviceaccount-token",
"readOnly": True,
}
],
"webhook": {
"replicaCount": 2,
"automountServiceAccountToken": False,
"serviceAccount": {
"automountServiceAccountToken": False,
},
"volumes": [
{
"name": "serviceaccount-token",
"projected": {
"defaultMode": 0o444,
"sources": [
{
"serviceAccountToken": {
"expirationSeconds": 3607,
"path": "token",
}
},
{
"configMap": {
"name": "kube-root-ca.crt",
"items": [
{
"key": "ca.crt",
"path": "ca.crt",
}
],
}
},
{
"downwardAPI": {
"items": [
{
"path": "namespace",
"fieldRef": {
"apiVersion": "v1",
"fieldPath": "metadata.namespace",
},
}
]
}
},
],
},
}
],
"volumeMounts": [
{
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
"name": "serviceaccount-token",
"readOnly": True,
}
],
},
"cainjector": {
"replicaCount": 2,
"automountServiceAccountToken": False,
"serviceAccount": {
"automountServiceAccountToken": False,
},
"volumes": [
{
"name": "serviceaccount-token",
"projected": {
"defaultMode": 0o444,
"sources": [
{
"serviceAccountToken": {
"expirationSeconds": 3607,
"path": "token",
}
},
{
"configMap": {
"name": "kube-root-ca.crt",
"items": [
{
"key": "ca.crt",
"path": "ca.crt",
}
],
}
},
{
"downwardAPI": {
"items": [
{
"path": "namespace",
"fieldRef": {
"apiVersion": "v1",
"fieldPath": "metadata.namespace",
},
}
]
}
},
],
},
}
],
"volumeMounts": [
{
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
"name": "serviceaccount-token",
"readOnly": True,
}
],
},
},
opts=ResourceOptions.merge(
child_opts,
Expand Down
3 changes: 1 addition & 2 deletions infra/fridge/isolated-cluster/__main__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,6 @@ def patch_namespace(name: str, pss: PodSecurityStandard) -> NamespacePatch:
args=components.CertManagerArgs(
config=config,
k8s_environment=k8s_environment,
tls_environment=tls_environment,
),
)

Expand Down Expand Up @@ -93,7 +92,7 @@ def patch_namespace(name: str, pss: PodSecurityStandard) -> NamespacePatch:
"minio",
args=components.ObjectStorageArgs(
config=config,
tls_environment=tls_environment,
cluster_issuer=cert_manager.cert_manager_dev_issuer,
storage_classes=storage_classes,
),
opts=ResourceOptions(
Expand Down
Loading
Loading