Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update cert-manager to 1.1.0 and use ingressShims for automated Certificates. #400

Merged
merged 24 commits into from
Dec 9, 2020
Merged

Update cert-manager to 1.1.0 and use ingressShims for automated Certificates. #400

merged 24 commits into from
Dec 9, 2020

Conversation

willgraf
Copy link
Contributor

@willgraf willgraf commented Dec 4, 2020 •
edited
Loading

Features

  • Deploy CertificateIssuers with a new helmfile using the incubator/raw chart.
  • Add a post-sync hook to give cert-manager time to initialize before the certificate-issuers are deployed.
  • Using ingressShims and ingress annotations to automatically deploy Certificates.
  • Use GCP_DNS_SOLVER_NAME, GCP_CLOUD_DNS_SERVICE_ACCOUNT, and CERTIFICATE_MANAGER_CLUSTER_ISSUER to template the service accounts and active issuer.

Bugfixes

willgraf added 24 commits November 2, 2020 22:02
@willgraf
bump patch version of cert-manager.
7ff57cb
@willgraf
new cert-manager uses cloudDNS not clouddns
730fd70
@willgraf
v1 API is out, not v1alpha2.
4a867d4
@willgraf
New task gke/create/certificate-manager-secret.
64d6dbf 
Cannot create a namespace before the cluster is created, but the service account comes first.
@willgraf
Merge branch 'stable' into bugfix/cert-manager
65bfe8a
@willgraf
move certificate resources into the helmfile using incubator/raw
812981e
@willgraf
Use workload identity to link the GSA and KSA for DNS.
ed3efea
@willgraf
Add new env var CERTIFICATE_MANAGER_CLUSTER_ISSUER to control default…
86f5d79 
… cert issuer
@willgraf
Use kubernetes.io/tls-acme annotation for automatic secret deployment
d34632f
@willgraf
env not getenv
20e2dfd
@willgraf
env not getenv
b175232
@willgraf
Use GCP_DNS_SOLVER_NAME and GCP_CLOUD_DNS_SERVICE_ACCOUNT to format t…
5493cf9 
…he DNS workload id sa
@willgraf
Split the different cert-manager releases into different helmfiles.
8ac9308
@willgraf
add some fancy cloudposse configs to wait between the cert-manager an…
f7c8e9b 
…d issuers.
@willgraf
Revert workload identity back to static credentials.
de056cc
@willgraf
randomize the SA name
347afbc
@willgraf
needs has to reference a release in the same helmfile.
5f331f0
@willgraf
Certificate issuers should be in same helmfile as cert-manager
58d0a84
@willgraf
Fix broken ingress template in frontend
9c40d99 
Variables must be defined at the top, as the current context changes inside the "range" loop.
@willgraf
Remove create/certificates make command
0fdcbb2
@willgraf
Un-randomize DNS solver SA name and use the full var name to create t…
f4ef8b6 
…he key.
@willgraf
Add gke/destroy/certifiate-manager-secret to clean up created SA keys.
ef21e68 
Fixes #391
@willgraf
Move key creation to create/cert-manager-secret and only destroy if c…
6638fa2 
…ertmanager is enabled.
@willgraf
Update patch version of frontend chart (fixes bad ingress templating)
f3b1af8
@willgraf willgraf merged commit 029bb52 into stable Dec 9, 2020
@willgraf willgraf deleted the bugfix/cert-manager branch December 9, 2020 21:33
This was referenced Dec 9, 2020
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@willgraf