mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
76b9e55102
With the platform Gateway enabled, the ClusterIssuers in cert-manager-issuers and the per-tenant Issuers rendered for TenantGateway carry an http01.gatewayHTTPRoute solver, but the controller only honours that solver when Gateway API support is switched on, and the vendored chart leaves it off. Every HTTP-01 challenge behind the Gateway then fails with "gateway api is not enabled" and no ACME certificate is issued. Pass a ControllerConfiguration with enableGatewayAPI to the host cert-manager through the component values of its platform Package. The host always ships the Gateway API CRDs and orders cert-manager after them, so the flag is safe on every variant. It is not a default of the system/cert-manager chart: the same chart is installed into tenant clusters, where the CRDs are an opt-in addon and a controller started with Gateway API support and no CRDs exits at startup. The tenant side keeps opting in on its own. Signed-off-by: Aleksei Sviridkin <f@lex.la> Assisted-by: LLM
83 lines
3.0 KiB
YAML
83 lines
3.0 KiB
YAML
suite: cert-manager controller config wiring
|
|
|
|
# The host enables the Gateway API solver by passing a ControllerConfiguration
|
|
# through this chart's `config` value from the platform bundle. It is not a
|
|
# default of this package on purpose: the same chart is installed into tenant
|
|
# clusters, where the Gateway API CRDs are an opt-in addon, and a controller
|
|
# started with enableGatewayAPI and no CRDs exits at startup and crashloops.
|
|
#
|
|
# The first two tests pin the chart side of that contract with the exact
|
|
# payload the host passes: a re-vendored chart that stops rendering `config`
|
|
# into the ConfigMap, or stops mounting it and naming it in --config, would
|
|
# turn the host flag into a silent no-op. The third pins the neutral default,
|
|
# which is what keeps tenant clusters without the CRDs alive.
|
|
|
|
templates:
|
|
- charts/cert-manager/templates/controller-config.yaml
|
|
- charts/cert-manager/templates/deployment.yaml
|
|
|
|
release:
|
|
name: cert-manager
|
|
namespace: cozy-cert-manager
|
|
|
|
tests:
|
|
- it: renders a ControllerConfiguration passed through config into the controller ConfigMap
|
|
template: charts/cert-manager/templates/controller-config.yaml
|
|
set:
|
|
cert-manager:
|
|
config:
|
|
apiVersion: controller.config.cert-manager.io/v1alpha1
|
|
kind: ControllerConfiguration
|
|
enableGatewayAPI: true
|
|
asserts:
|
|
- isKind:
|
|
of: ConfigMap
|
|
- equal:
|
|
path: metadata.name
|
|
value: cert-manager
|
|
- matchRegex:
|
|
path: data["config.yaml"]
|
|
pattern: '(?m)^apiVersion: controller\.config\.cert-manager\.io/v1alpha1$'
|
|
- matchRegex:
|
|
path: data["config.yaml"]
|
|
pattern: '(?m)^kind: ControllerConfiguration$'
|
|
- matchRegex:
|
|
path: data["config.yaml"]
|
|
pattern: '(?m)^enableGatewayAPI: true$'
|
|
|
|
- it: mounts that ConfigMap into the controller and names it in --config
|
|
template: charts/cert-manager/templates/deployment.yaml
|
|
set:
|
|
cert-manager:
|
|
config:
|
|
apiVersion: controller.config.cert-manager.io/v1alpha1
|
|
kind: ControllerConfiguration
|
|
enableGatewayAPI: true
|
|
asserts:
|
|
- isKind:
|
|
of: Deployment
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: --config=/var/cert-manager/config/config.yaml
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: config
|
|
mountPath: /var/cert-manager/config
|
|
- contains:
|
|
path: spec.template.spec.volumes
|
|
content:
|
|
name: config
|
|
configMap:
|
|
name: cert-manager
|
|
|
|
- it: ships no controller config by default, so the Gateway API solver stays off unless the installer asks
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
template: charts/cert-manager/templates/controller-config.yaml
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: --config=/var/cert-manager/config/config.yaml
|
|
template: charts/cert-manager/templates/deployment.yaml
|