Remove SelfSigned issuer from released transport-encryption artifac…

…ts (#7905)

* Remove SelfSigned issuer from released `transport-encryption` artifacts

Using a SelfSigned issuer is not recommended by cert-manager and
currently we're shipping it in the tranport-encryption feature
artifact.

Moving forward, we will not ship a SelfSigned issuer in the
`eventing-tls-networking.yaml` artifacts and we will document,
as a prerequisite, how to create a `ClusterIssuer` for eventing
components so that by users can bring their own choosen issuers [1].

[1] https://cert-manager.io/docs/concepts/issuer/

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

* Apply TLS configs for the entire tests suite

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

---------

Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com>

hack/generate-yamls.sh

@@ -97,7 +97,7 @@ ko resolve ${KO_YAML_FLAGS} -f config/brokers/mt-channel-broker/ | "${LABEL_YAML
 ko resolve ${KO_YAML_FLAGS} -Rf config/channels/in-memory-channel/ | "${LABEL_YAML_CMD[@]}" > "${EVENTING_IN_MEMORY_CHANNEL_YAML}"
 
 # Create eventing TLS yaml
-ko resolve ${KO_YAML_FLAGS} -Rf config/tls/ \
+ko resolve ${KO_YAML_FLAGS} \
   -Rf config/channels/in-memory-channel-tls/ \
   -Rf config/brokers/mt-channel-broker-tls/ \
   | "${LABEL_YAML_CMD[@]}" > "${EVENTING_TLS_YAML}"

config/tls/trust-manager/bundle.yaml → test/config/tls/bundle.yaml

@@ -21,7 +21,7 @@ spec:
     # Include a bundle of publicly trusted certificates which can be
     # used to validate most TLS certificates on the internet, such as
     # those issued by Let's Encrypt, Google, Amazon and others.
-    - useDefaultCAs: true
+    - useDefaultCAs: false
 
     # A Secret in the "trust" namespace; see "Trust Namespace" below for further details
     - secret:

test/config/tls/placeholder.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2020 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package tls is a placeholder that allows us to pull in config files
+// via go mod vendor.
+package tls

test/e2e-common.sh

@@ -42,6 +42,8 @@ readonly MT_CHANNEL_BASED_BROKER_CONFIG_DIR="config/brokers/mt-channel-broker"
 # MT Channel Based Broker config.
 readonly MT_CHANNEL_BASED_BROKER_DEFAULT_CONFIG="config/core/configmaps/default-broker.yaml"
 
+readonly EVENTING_TLS_TEST_CONFIG_DIR="test/config/tls"
+
 # Config tracing config.
 readonly CONFIG_TRACING_CONFIG="test/config/config-tracing.yaml"
 
@@ -183,6 +185,8 @@ function install_knative_eventing() {
   sed "s/namespace: ${KNATIVE_DEFAULT_NAMESPACE}/namespace: ${SYSTEM_NAMESPACE}/g" "${CONFIG_TRACING_CONFIG}" > "${TMP_CONFIG_TRACING_CONFIG}"
   kubectl replace -f "${TMP_CONFIG_TRACING_CONFIG}"
 
+  kubectl apply -Rf "${EVENTING_TLS_TEST_CONFIG_DIR}"
+
   scale_controlplane eventing-webhook eventing-controller
 
   wait_until_pods_running "${SYSTEM_NAMESPACE}" || fail_test "Knative Eventing did not come up"