feat: generate TLS certificates using cert-manager #820
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What was changed
Add certificates.yaml + secret.yaml to templates
Why?
generate certificates using cert-manager
How was this tested
Deployed cert-manager helm-chart
Deployed temporal helm chart, 0.57.0, using temporal/charts/temporal/tests/certificates.yaml as values.yaml, with my own tls.crt + tls.key
Cert-manager will:
Use the temporal-issuer (which refers to the CA).
Ask the CA (from the tls-certs secret) to sign a new certificate.
Create the temporal-tls-certs secret in the same namespace — this secret will contain:
tls.crt: the signed certificate
tls.key: the private key
Optionally, ca.crt: the CA certificate (if configured)
➜ ~ kubectl get secret -n temporal
NAME TYPE DATA AGE
temporal-tls-certs kubernetes.io/tls 3 3h38m
tls-certs Opaque 2 153m
➜ ~ kubectl get certificate -n temporal
NAME READY SECRET AGE
temporal-cert True temporal-tls-certs 5h35m
➜ ~ kubectl get certificaterequests -n temporal-data
NAME APPROVED DENIED READY ISSUER REQUESTER AGE
temporal-cert-1 True True temporal-issuer system:serviceaccount:cert-manager:test-cert-manager 5h