Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement certificate management #193

Closed
jhmarina opened this issue Oct 27, 2022 · 3 comments · Fixed by s3gw-tech/s3gw-charts#65
Closed

Implement certificate management #193

jhmarina opened this issue Oct 27, 2022 · 3 comments · Fixed by s3gw-tech/s3gw-charts#65
Assignees
@m-ildefons @giubacc
Labels
area/kubernetes k8s and related kind/enhancement Change that positively impacts existing code
Milestone
v0.10.0

Comments

@jhmarina
Copy link
Contributor

What needs to be done

Implement certificate management.

Why it needs to be done

To allow accepting SSL connections.

Acceptance Criteria

Additional Information
@jhmarina jhmarina added the kind/quality Quality improvements, Refactoring, Automation via CI, E2E, Integration, CLI or REST API label Oct 27, 2022
@jhmarina jhmarina added this to S3GW Oct 27, 2022
@jhmarina jhmarina moved this to Backlog in S3GW Oct 27, 2022
@jhmarina jhmarina added this to the v1.0.0 milestone Nov 23, 2022
@giubacc giubacc mentioned this issue Nov 23, 2022
Merged
3 tasks
@jhmarina jhmarina mentioned this issue Nov 23, 2022
Closed
@giubacc giubacc mentioned this issue Nov 23, 2022
Closed
@giubacc
Copy link

giubacc commented Nov 23, 2022

@m-ildefons I'm also making experiments with certificate management since it is a hot topic for the integration with Epinio.
Let's remember to coordinate before proposing PRs.

@giubacc giubacc self-assigned this Nov 23, 2022
@giubacc giubacc added kind/enhancement Change that positively impacts existing code area/kubernetes k8s and related and removed kind/quality Quality improvements, Refactoring, Automation via CI, E2E, Integration, CLI or REST API labels Nov 23, 2022
@giubacc
Copy link

giubacc commented Nov 24, 2022

I suggest to go with: https://cert-manager.io/
This is already used by Epinio project and Rancher

@Martin-Weiss
Copy link

The helm chart should allow to specify the clusterIssuer or Issuer that should be used with the ingress so that the SSL certificates can be created and maintaied automatically by cert-manager.

giubacc referenced this issue in giubacc/s3gw-charts Nov 25, 2022
First draft for certificate management with cert-manager
4c149e3 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
@giubacc giubacc mentioned this issue Nov 25, 2022
Merged
3 tasks
giubacc referenced this issue in giubacc/s3gw-charts Nov 25, 2022
First draft for certificate management with cert-manager
dbf4b88 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 29, 2022
second draft for certificate management with cert-manager
15dc074 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 29, 2022
second draft for certificate management with cert-manager
0207315 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
@giubacc giubacc moved this from Backlog to In Progress 🏗️ in S3GW Nov 29, 2022
giubacc referenced this issue in giubacc/s3gw-charts Nov 29, 2022
second draft for certificate management with cert-manager
850dd67 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 29, 2022
second draft for certificate management with cert-manager
4148a41 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 29, 2022
certificate management with cert-manager
9ce1665 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
certificate management with cert-manager
aa6d359 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
certificate management with cert-manager
2cae798 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
certificate management with cert-manager
96ad6c8 
Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
d19b732 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
bbe22b3 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
15dadb8 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
c877fa9 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
3759c3c 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
7ef8b22 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
b120e31 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
ffdc148 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Nov 30, 2022
TLS Certificate Management
8aa11aa 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca
    - s3gw-letsencrypt
  - s3gw-ca can be used to generate self-signed certificates.
  - s3gw-letsencrypt should be used for production environments.
  - Please, note that when using a certificate manager, the s3gw-ca
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Dec 5, 2022
TLS Certificate Management
54a1a48 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca-issuer
    - s3gw-letsencrypt-issuer
  - s3gw-ca-issuer can be used to generate self-signed certificates.
  - s3gw-letsencrypt-issuer should be used for production environments.
  - Please, note that when using a certificate manager, s3gw-ca-issuer
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Dec 5, 2022
TLS Certificate Management
5b06ebb 
  - Ability to use an optional certificate manager: cert-manager,
    to automatically provision TLS certificates. When using such feature,
    cert-manager is a prerequisite.
  - Usage of cert-manager is enabled by default and can be controlled by
    the chart field:
    - useCertManager
  - The certificate manager will provision certificates for:
    - S3 service's ingress (public domain)
    - UI service's ingress (public domain)
    - S3 service's internal endpoint (Kubernetes private domain)
  - When installing a certificate manager, the user can choose between
    two predefined ClusterIssuer:
    - s3gw-ca-issuer
    - s3gw-letsencrypt-issuer
  - s3gw-ca-issuer can be used to generate self-signed certificates.
  - s3gw-letsencrypt-issuer should be used for production environments.
  - Please, note that when using a certificate manager, s3gw-ca-issuer
    ClusterIssuer will be used for generating certificates for the S3 service's
    internal endpoint.
  - When the user chooses not to employ a certificate manager,
    TLS secrets must be filled manually. A series of fields
    have been added to the chart for this purpose:
    - tls.publicDomain.crt
    - tls.publicDomain.key
    - tls.privateDomain.crt
    - tls.privateDomain.key
    - tls.ui.publicDomain.crt
    - tls.ui.publicDomain.key
  - The user can choose a custom ClusterIssuer by setting the chart fields:
    - useCustomTlsIssuer and customTlsIssuer
  - Removed configuration options superseded by the newly added variables:
    - `tls.crt`, `tls.key`
    - `ui.tls.crt`, `ui.tls.key`

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Dec 6, 2022
TLS Certificate Management
f63acfd 
- Ability to use an optional certificate manager: cert-manager,
  to automatically provision TLS certificates. When using such feature,
  cert-manager installation is a prerequisite.
- Usage of cert-manager is enabled by default and can be disabled
  with the flag:
  - useCertManager
- cert-manager namespace can be set with the following chart field:
  - certManagerNamespace
- cert-manager will provision certificates for:
  - S3 service's ingress (public domain)
  - UI service's ingress (public domain)
  - S3 service's internal endpoint (Kubernetes private domain)
- When using cert-manager, the user can choose between
  two predefined ClusterIssuer:
  - s3gw-issuer
  - s3gw-letsencrypt-issuer
- s3gw-issuer can be used to generate self-signed certificates.
- s3gw-letsencrypt-issuer should be used for production environments.
- Please, note that when using a certificate manager, the s3gw-issuer
  ClusterIssuer will be used for generating certificates for the S3 service's
  internal endpoint.
- When the user chooses not to employ cert-manager,
  TLS secrets must be filled manually. The following fields
  have been added to the chart for this purpose:
  - tls.publicDomain.crt
  - tls.publicDomain.key
  - tls.privateDomain.crt
  - tls.privateDomain.key
  - tls.ui.publicDomain.crt
  - tls.ui.publicDomain.key
- The user can choose a custom ClusterIssuer by setting the following chart fields:
  - useCustomTlsIssuer and customTlsIssuer
- Configuration options superseded by the newly added variables:
  - tls.crt, tls.key
  - ui.tls.crt, ui.tls.key

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
@giubacc giubacc moved this from In Progress 🏗️ to In Review 👀 in S3GW Dec 9, 2022
@giubacc giubacc assigned irq0 and unassigned irq0 Dec 9, 2022
giubacc referenced this issue in giubacc/s3gw-charts Dec 12, 2022
TLS Certificate Management
6f7df75 
- Ability to use an optional certificate manager: cert-manager,
  to automatically provision TLS certificates. When using such feature,
  cert-manager installation is a prerequisite.
- Usage of cert-manager is enabled by default and can be disabled
  with the flag:
  - useCertManager
- cert-manager namespace can be set with the following chart field:
  - certManagerNamespace
- cert-manager will provision certificates for:
  - S3 service's ingress (public domain)
  - UI service's ingress (public domain)
  - S3 service's internal endpoint (Kubernetes private domain)
- When using cert-manager, the user can choose between
  two predefined ClusterIssuer:
  - s3gw-issuer
  - s3gw-letsencrypt-issuer
- s3gw-issuer can be used to generate self-signed certificates.
- s3gw-letsencrypt-issuer should be used for production environments.
- Please, note that when using a certificate manager, the s3gw-issuer
  ClusterIssuer will be used for generating certificates for the S3 service's
  internal endpoint.
- When the user chooses not to employ cert-manager,
  TLS secrets must be filled manually. The following fields
  have been added to the chart for this purpose:
  - tls.publicDomain.crt
  - tls.publicDomain.key
  - tls.privateDomain.crt
  - tls.privateDomain.key
  - tls.ui.publicDomain.crt
  - tls.ui.publicDomain.key
- The user can choose a custom ClusterIssuer by setting the following chart fields:
  - useCustomTlsIssuer and customTlsIssuer
- Configuration options superseded by the newly added variables:
  - tls.crt, tls.key
  - ui.tls.crt, ui.tls.key

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Dec 13, 2022
TLS Certificate Management
c3dacb1 
- Ability to use an optional certificate manager: cert-manager,
  to automatically provision TLS certificates. When using such feature,
  cert-manager installation is a prerequisite.
- Usage of cert-manager is enabled by default and can be disabled
  with the flag:
  - useCertManager
- cert-manager namespace can be set with the following chart field:
  - certManagerNamespace
- cert-manager will provision certificates for:
  - S3 service's ingress (public domain)
  - UI service's ingress (public domain)
  - S3 service's internal endpoint (Kubernetes private domain)
- When using cert-manager, the user can choose between
  two predefined ClusterIssuer:
  - s3gw-issuer
  - s3gw-letsencrypt-issuer
- s3gw-issuer can be used to generate self-signed certificates.
- s3gw-letsencrypt-issuer should be used for production environments.
- Please, note that when using a certificate manager, the s3gw-issuer
  ClusterIssuer will be used for generating certificates for the S3 service's
  internal endpoint.
- When the user chooses not to employ cert-manager,
  TLS secrets must be filled manually. The following fields
  have been added to the chart for this purpose:
  - tls.publicDomain.crt
  - tls.publicDomain.key
  - tls.privateDomain.crt
  - tls.privateDomain.key
  - tls.ui.publicDomain.crt
  - tls.ui.publicDomain.key
- The user can choose a custom ClusterIssuer by setting the following chart fields:
  - useCustomTlsIssuer and customTlsIssuer
- Configuration options superseded by the newly added variables:
  - tls.crt, tls.key
  - ui.tls.crt, ui.tls.key

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
giubacc referenced this issue in giubacc/s3gw-charts Dec 13, 2022
TLS Certificate Management
ffbcad1 
- Ability to use an optional certificate manager: cert-manager,
  to automatically provision TLS certificates. When using such feature,
  cert-manager installation is a prerequisite.
- Usage of cert-manager is enabled by default and can be disabled
  with the flag:
  - useCertManager
- cert-manager namespace can be set with the following chart field:
  - certManagerNamespace
- cert-manager will provision certificates for:
  - S3 service's ingress (public domain)
  - UI service's ingress (public domain)
  - S3 service's internal endpoint (Kubernetes private domain)
- When using cert-manager, the user can choose between
  two predefined ClusterIssuer:
  - s3gw-issuer
  - s3gw-letsencrypt-issuer
- s3gw-issuer can be used to generate self-signed certificates.
- s3gw-letsencrypt-issuer should be used for production environments.
- Please, note that when using a certificate manager, the s3gw-issuer
  ClusterIssuer will be used for generating certificates for the S3 service's
  internal endpoint.
- When the user chooses not to employ cert-manager,
  TLS secrets must be filled manually. The following fields
  have been added to the chart for this purpose:
  - tls.publicDomain.crt
  - tls.publicDomain.key
  - tls.privateDomain.crt
  - tls.privateDomain.key
  - tls.ui.publicDomain.crt
  - tls.ui.publicDomain.key
- The user can choose a custom ClusterIssuer by setting the following chart fields:
  - useCustomTlsIssuer and customTlsIssuer
- Configuration options superseded by the newly added variables:
  - tls.crt, tls.key
  - ui.tls.crt, ui.tls.key

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
@giubacc giubacc mentioned this issue Dec 16, 2022
Closed
giubacc referenced this issue in giubacc/s3gw-charts Dec 19, 2022
TLS Certificate Management
0a8350a 
- Ability to use an optional certificate manager: cert-manager,
  to automatically provision TLS certificates. When using such feature,
  cert-manager installation is a prerequisite.
- Usage of cert-manager is enabled by default and can be disabled
  with the flag:
  - useCertManager
- cert-manager namespace can be set with the following chart field:
  - certManagerNamespace
- cert-manager will provision certificates for:
  - S3 service's ingress (public domain)
  - UI service's ingress (public domain)
  - S3 service's internal endpoint (Kubernetes private domain)
- When using cert-manager, the user can choose between
  two predefined ClusterIssuer:
  - s3gw-issuer
  - s3gw-letsencrypt-issuer
- s3gw-issuer can be used to generate self-signed certificates.
- s3gw-letsencrypt-issuer should be used for production environments.
- Please, note that when using a certificate manager, the s3gw-issuer
  ClusterIssuer will be used for generating certificates for the S3 service's
  internal endpoint.
- When the user chooses not to employ cert-manager,
  TLS secrets must be filled manually. The following fields
  have been added to the chart for this purpose:
  - tls.publicDomain.crt
  - tls.publicDomain.key
  - tls.privateDomain.crt
  - tls.privateDomain.key
  - tls.ui.publicDomain.crt
  - tls.ui.publicDomain.key
- The user can choose a custom ClusterIssuer by setting the following chart fields:
  - useCustomTlsIssuer and customTlsIssuer
- Configuration options superseded by the newly added variables:
  - tls.crt, tls.key
  - ui.tls.crt, ui.tls.key

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
Repository owner moved this from In Review 👀 to Done ✅ in S3GW Dec 19, 2022
m-ildefons referenced this issue in s3gw-tech/s3gw-charts Jan 4, 2023
@m-ildefons
TLS Certificate Management
59891ab 
- Ability to use an optional certificate manager: cert-manager,
  to automatically provision TLS certificates. When using such feature,
  cert-manager installation is a prerequisite.
- Usage of cert-manager is enabled by default and can be disabled
  with the flag:
  - useCertManager
- cert-manager namespace can be set with the following chart field:
  - certManagerNamespace
- cert-manager will provision certificates for:
  - S3 service's ingress (public domain)
  - UI service's ingress (public domain)
  - S3 service's internal endpoint (Kubernetes private domain)
- When using cert-manager, the user can choose between
  two predefined ClusterIssuer:
  - s3gw-issuer
  - s3gw-letsencrypt-issuer
- s3gw-issuer can be used to generate self-signed certificates.
- s3gw-letsencrypt-issuer should be used for production environments.
- Please, note that when using a certificate manager, the s3gw-issuer
  ClusterIssuer will be used for generating certificates for the S3 service's
  internal endpoint.
- When the user chooses not to employ cert-manager,
  TLS secrets must be filled manually. The following fields
  have been added to the chart for this purpose:
  - tls.publicDomain.crt
  - tls.publicDomain.key
  - tls.privateDomain.crt
  - tls.privateDomain.key
  - tls.ui.publicDomain.crt
  - tls.ui.publicDomain.key
- The user can choose a custom ClusterIssuer by setting the following chart fields:
  - useCustomTlsIssuer and customTlsIssuer
- Configuration options superseded by the newly added variables:
  - tls.crt, tls.key
  - ui.tls.crt, ui.tls.key

Fixes: aquarist-labs/s3gw-tools#193
Signed-off-by: Giuseppe Baccini <giuseppe.baccini@suse.com>
m-ildefons pushed a commit to m-ildefons/s3gw that referenced this issue Feb 6, 2023
Merge pull request s3gw-tech#193 from 0xavi0/fix-dockerfile
26882f3 
tools: Fix test container Dockerfile
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@m-ildefons m-ildefons

@giubacc giubacc

Labels
area/kubernetes k8s and related kind/enhancement Change that positively impacts existing code
Projects
None yet
Milestone
v0.10.0
Development

Successfully merging a pull request may close this issue.

Certificate management giubacc/s3gw-charts
5 participants
@irq0 @jhmarina @Martin-Weiss @m-ildefons @giubacc