Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add instructions for component-cert-exoscale #352

Closed
wants to merge 1 commit into from
Closed

Add instructions for component-cert-exoscale #352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions docs/modules/ROOT/pages/how-tos/exoscale/install.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,39 @@ export CSI_ACCESSKEY=$(echo "${csi_credentials}" | jq -r '.key')
export CSI_SECRETKEY=$(echo "${csi_credentials}" | jq -r '.secret')
----

. Create restricted API key for Exoscale cert-manager webhook
+
[source,bash]
----
# Create Exoscale cert-manager webhook IAM role, if it doesn't exist yet in the organization
certwebhook_role_id=$(exo iam role list -O json | \
jq -r '.[] | select(.name=="cert-webhook-exoscale") | .key')
if [ -z "${certwebhook_role_id}" ]; then
echo '{
"default-service-strategy": "deny",
"services": {
"dns": {
"type": "rules",
"rules": [
{
"action": "allow",
"expression": "operation in ['list-dns-domain-records', 'get-dns-domain-record', 'get-operation', 'list-dns-domains', 'create-dns-domain-record', 'delete-dns-domain-record']"
}
]
}
}
}' | \
exo iam role create cert-webhook-exoscale \
--description "Exoscale Cert Webhook: Access to dns operations" \
--policy -
fi
# Create access key
cert_credentials=$(exo iam api-key create -O json \
"${CLUSTER_ID}_cert_webhook" cert-webhook-exoscale)
export CERT_ACCESSKEY=$(echo "${cert_credentials}" | jq -r '.key')
export CERT_SECRETKEY=$(echo "${cert_credentials}" | jq -r '.secret')
----


[#_bootstrap_bucket]
=== Set up S3 bucket for cluster bootstrap
Expand Down Expand Up @@ -225,6 +258,11 @@ vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/appcat/provider-exoscale \
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/exoscale/csi_driver \
s3_access_key=${CSI_ACCESSKEY} \
s3_secret_key=${CSI_SECRETKEY}

# Set the Cert Manager Webhook Credentials
vault kv put clusters/kv/${TENANT_ID}/${CLUSTER_ID}/exoscale/cert_webhook \
s3_access_key=${CERT_ACCESSKEY} \
s3_secret_key=${CERT_SECRETKEY}
----

include::partial$get-hieradata-token-from-vault.adoc[]
Expand Down
16 changes: 1 addition & 15 deletions docs/modules/ROOT/partials/install/finalize_part1.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ fulldomain=$(kubectl -n syn-cert-manager \
echo "$fulldomain"
----

ifeval::["{provider" != "exoscale"]
ifeval::["{acme-dns-update-zone}" == "yes"]
. Add the following CNAME records to the cluster's DNS zone
+
Expand All @@ -55,21 +56,6 @@ _acme-challenge.apps IN CNAME <fulldomain>. <1>
<2> The `_acme-challenge.api` record must be created in the same origin as the `api` record.
<3> The `_acme-challenge.apps` record must be created in the same origin as the `apps` record.
endif::[]
ifeval::["{provider}" == "exoscale"]
. Setup the `_acme-challenge` CNAME records in the cluster's DNS zone
+
[IMPORTANT]
====
The `_acme-challenge` records must be created in the same zone as the cluster's `api` and `apps` records respectively.
The snippet below assumes that the cluster is configured to use the default "apps" domain in the cluster's zone.
====
+
[source,bash]
----
for cname in "api" "apps"; do
exo dns add CNAME "${CLUSTER_DOMAIN}" -n "_acme-challenge.${cname}" -a "${fulldomain}." -t 600
done
----
endif::[]

=== Ensure emergency admin access to the cluster
Expand Down