Alternative letsencrypt challenges and custom provided tls certificates#854
Open
filippomc wants to merge 5 commits into
Open
Alternative letsencrypt challenges and custom provided tls certificates#854filippomc wants to merge 5 commits into
filippomc wants to merge 5 commits into
Conversation
filippomc
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Adds configurable Let’s Encrypt / cert-manager behavior to the Cloud Harness Helm chart so deployments can (a) switch ACME solvers (e.g., dns01) and (b) disable ACME entirely to use externally managed TLS certificates, with accompanying model + docs updates.
Changes:
- Introduces
ingress.letsencrypt.enabled,privateKeySecretName,solvers, andsecretsin Helm values and renders them into the cert-managerIssuer(plus optional credentialSecretcreation). - Updates Ingress/Gateway annotations to be conditional on Let’s Encrypt being enabled.
- Updates OpenAPI + generated model docs and adds end-user documentation for the new TLS/Let’s Encrypt options.
Reviewed changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| libraries/models/docs/GatewayGlobalConfigAllOfLetsencrypt.md | Updates generated model docs to include new Let’s Encrypt fields. |
| libraries/models/docs/ExtraContainerConfig.md | Fixes property name documentation (command). |
| libraries/models/cloudharness_model/models/gateway_global_config_all_of_letsencrypt.py | Extends model with enabled, solver and secret configuration, and private key secret name aliasing. |
| libraries/models/api/openapi.yaml | Adds new schema properties for Let’s Encrypt configuration. |
| docs/README.md | Adds a docs index link to the ingress/TLS documentation. |
| docs/model/GatewayGlobalConfigAllOfLetsencrypt.md | Updates generated docs copy for the extended Let’s Encrypt model. |
| docs/ingress-domains-proxies.md | Adds detailed guidance for solvers, dns01 secrets, and “bring your own certs”. |
| deployment-configuration/helm/values.yaml | Adds new ingress.letsencrypt options and documentation comments. |
| deployment-configuration/helm/templates/ingress.yaml | Skips cert-manager annotations when Let’s Encrypt is disabled. |
| deployment-configuration/helm/templates/httproute.yaml | Skips Gateway cert-manager annotation when Let’s Encrypt is disabled. |
| deployment-configuration/helm/templates/certs/letsencrypt.yaml | Adds optional credential Secret rendering and configurable Issuer fields (private key secret name, solvers). |
| namespace: {{ $.Values.namespace }} | ||
| type: Opaque | ||
| stringData: | ||
| {{ toYaml $data | indent 2 }} |
| kind: Secret | ||
| metadata: | ||
| name: {{ $name }} | ||
| namespace: {{ $.Values.namespace }} |
Comment on lines
+316
to
+320
| annotation on every generated Ingress/Gateway. TLS is still wired through — | ||
| each app's Ingress references a Secret named `tls-secret-<appName>` which you | ||
| must populate yourself (cloud load-balancer integration, sealed-secrets, an | ||
| internal CA, ESO, etc.): | ||
|
|
Comment on lines
+47
to
+48
| # wildcard, internal CA, air-gapped) — the per-app `tls-secret-<name>` Secrets | ||
| # must then exist in the namespace. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
|
||
|
|
||
| from __future__ import annotations | ||
| import pprint |
|
|
||
| from __future__ import annotations | ||
| import pprint | ||
| import re # noqa: F401 |
| from __future__ import annotations | ||
| import pprint | ||
| import re # noqa: F401 | ||
| import json |
|
|
||
|
|
||
| from cloudharness_model.base_model import CloudHarnessBaseModel | ||
| from pydantic import BaseModel, Field, field_validator, StrictStr, StrictBool, StrictInt, StrictFloat |
|
|
||
|
|
||
| from __future__ import annotations | ||
| import pprint |
|
|
||
| from __future__ import annotations | ||
| import pprint | ||
| import re # noqa: F401 |
| from __future__ import annotations | ||
| import pprint | ||
| import re # noqa: F401 | ||
| import json |
|
|
||
| from cloudharness_model.base_model import CloudHarnessBaseModel | ||
| from pydantic import BaseModel, Field, field_validator, StrictStr, StrictBool, StrictInt, StrictFloat | ||
| from typing import ClassVar, List, Dict, Any, Union, Optional, Annotated |
|
|
||
|
|
||
| from cloudharness_model.base_model import CloudHarnessBaseModel | ||
| from pydantic import BaseModel, Field, field_validator, StrictStr, StrictBool, StrictInt, StrictFloat |
| from cloudharness_model.base_model import CloudHarnessBaseModel | ||
| from pydantic import BaseModel, Field, field_validator, StrictStr, StrictBool, StrictInt, StrictFloat | ||
| from typing import ClassVar, List, Dict, Any, Union, Optional, Annotated | ||
| import importlib |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes CH-265
Implemented solution
Added options to the main values.yaml to:
How to test this PR
This functionality is built to be 100% backwards compatible, so the old http challenge is in place.
Check docs on docs/ingress-domains-proxies.md to see how to define alternative challenges
Sanity checks:
Breaking changes (select one):
breaking-changeand the migration procedure is well described abovePossible deployment updates issues (select one):
alert:deploymentTest coverage (select one):
Documentation (select one):
Nice to have (if relevant):