Is it possible to supply a custom certificate during installation? about openunison-k8s-login-oidc HOT 9 CLOSED

I worked around point (2) above by creating a cert-manager Certificate resource that populates it in a secret that the Ingress then consumes, this seems to work well.

from openunison-k8s-login-oidc.

Our next release of the operator supports adding annotations to the ingress definition. we'll also support disabling the creation of ou-tls-certificate

from openunison-k8s-login-oidc.

To be more specific, we're using cert-manager (https://cert-manager.io/) to Issue Let's Encrypt certificates, so cert-manager will populate the ou-tls-certificate secret with the Certs from Let's Encrypt, but how to ensure the operator is not going to override it?

maybe we need to remove this section from the OpenUnison manifest?

        - create_data:
            ca_cert: true
            key_size: 2048
            server_name: {{ .Values.network.openunison_host }}
            sign_by_k8s_ca: false
            subject_alternative_names:
              - {{ .Values.network.dashboard_host }}
              {{ if eq .Values.enable_impersonation true }}
              - {{ .Values.network.api_server_host }}
              {{ end }} 
          import_into_ks: certificate
          name: unison-ca
          tls_secret_name: ou-tls-certificate

from openunison-k8s-login-oidc.

this is a reasonable request.

maybe we need to remove this section from the OpenUnison manifest?

Precisely

from openunison-k8s-login-oidc.

great 👍 I'll try that, but I think we're also missing the ability to add an annotation to the ingress:

cert-manager.io/issuer: "letsencrypt-staging"

if I update the ingress manually, will the operator change it back?

from openunison-k8s-login-oidc.

if I update the ingress manually, will the operator change it back?

No. The other option is to create a Certificate object so you don't need to add the annotation

from openunison-k8s-login-oidc.

Just managed to glue this together 😄

1. Removed the ou-tls-certificate create_data block from orchestra
2. added the cert-manager annotation to the ingress

I guess my only ask is to be able to add custom annotations to the generated ingress resource 🙏

This method is preferred because it ensures cert-manager keeps track of all the ingresses and updates them accordingly.

from openunison-k8s-login-oidc.

ohh, wonderful! can't wait for the next release 😄

from openunison-k8s-login-oidc.

Annotations are now supported on the Ingress from the Helm chart

from openunison-k8s-login-oidc.