cnoe-io / idpbuilder

Spin up a complete internal developer platform with only Docker required as a dependency.
https://cloud-native.slack.com/archives/C05TN9WFN5S
Apache License 2.0
149 stars 45 forks source link

issue self signed certificate #316

Closed nabuskey closed 1 week ago

nabuskey commented 1 week ago

fixes: #137 related to: #300 #293

With this PR, idpbuilder will:

  1. Create a self signed certificate.
  2. Create a TLS secret in the ingress-nginx NS.
  3. Use it as the default TLS certificate for ingress-nginx. (you can still use other certs configured at ingress level)
  4. Update ArgoCD's CM to trust the CA.
  5. Create a CM that contains cert to the default NS.

I thought about using cert-manager but decided not to use it. For our purposes, we just need a certificate for ingress-nginx for in-cluster and incoming traffic only. Introducing cert-manager means:

  1. We need to maintain cert-manager manifests.
  2. Slower installation speed. We now need to wait for cert-manager to do its thing and be ready before anything else can continue.
  3. Introduces three pods that will do nothing for the most part.
nabuskey commented 1 week ago

I think I'd rather wait for concrete use cases for cert-manager until we pull it into core. Ready for another round of review.

jessesanford commented 1 week ago

I agree on waiting for more use cases before bringing in cert manager. It should be reasonably easy to roll forward to it when the time comes.

cmoulliard commented 1 week ago

I think I'd rather wait for concrete use cases for cert-manager until we pull it into core. Ready for another round of review.

Cert Manager can help to deal with many use cases like: