CertManager automatic discover

[squakez]

We can identify the presence of the operator and create the custom resources to issue certificates automatically.

[github-actions]

This issue has been automatically marked as stale due to 90 days of inactivity.
It will be closed if no further activity occurs within 15 days.
If you think that’s incorrect or the issue should never stale, please simply write any comment.
Thanks for your contributions!

[pkalsi97]

@squakez
As per my understanding we need to do the following

1. Camel K should be able to detect if cert-manager is installed.
2. Create Certificate CR
3. Mount that secret (by name) into pod

If you are not working on this already I can take a stab at it.

[squakez]

That's correct. I think we can verify the existence of Cert Manager custom resources definition (like we do for Knative, for example) and try to autotune the Cert Manager Issuer when the Ingress trait is provided. Feel free to have a look and run some experiment to see what it makes sense.

[pkalsi97]

@squakez I am thinking of implementing this approach

1. To detect Cert-Manager we can use cert-manager.io/v1 via ServerResourcesForGroupVersion(), return false if CRD not found, no error.
2. Extend the ingress-trait -> tlsIssuerName , tlsIssuerKind
3. Automatic cert creation:

• Trigger conditions: TLSHosts set + TLSSecretName empty + TLSIssuerName provided
• Check cert-manager availability at runtime, only when needed.
• Create certmanagerv1.Certificate with Secret name, Labels integration, References issuer, DNSNames

4. Separate RBAC files for cert-manager resources (Certificates, Issuers, ClusterIssuers)

user sets tls-issuer-name
         |
         v
  ingress trait runs
         |
         v
  cert-manager installed? ---no---> do nothing
         |
        yes
         |
         v
  create Certificate CR
         |
         v
  cert-manager issues secret
         |
         v
  ingress uses secret for TLS

What do you think about this approach ? am I missing something ?

[squakez]

I think we can make it much easier by leveraging the annotated ingress resources: https://cert-manager.io/docs/usage/ingress/ - I think what we need is the verify the existence of the clusterIssuer and, if it exists, just add the annotation, so that the Cert Manager operator manages it. We can start looking for ClusterIssuer as a default, and, if missing, any namespaced Issuer. It could be an auto (default false) option to perform the logic. Beside that we can have the user providing the name of the issuer forcefully, so, the operator only verify the existence of the CertManager and the issuer. Hope it makes sense. What could be challenging (and funny at the same time) is the e2e where we can have a real https call with some autogenerated certificate.

[pkalsi97]

@squakez thanks for this approach. I'll look into this. I plan to work on it and finish it before the coming Saturday!

[squakez]

@squakez thanks for this approach. I'll look into this. I plan to work on it and finish it before the coming Saturday!

No rush, take your time and, above all, have fun!