Skip to content

Commit 6add645

Browse files
joaquimrochajoaquimrocha
authored
Merge pull request #143 from headlamp-k8s/cert-manager
Add cert-manager plugin
2 parents e0615aa + 46ab8ff commit 6add645

37 files changed

+35406
-0
lines changed

‎cert-manager/.gitignore

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Dependencies
2+
node_modules/
3+
npm-debug.log
4+
yarn-debug.log
5+
yarn-error.log
6+
.pnpm-debug.log
7+
8+
# Build outputs
9+
dist/
10+
build/
11+
lib/
12+
coverage/
13+
14+
# Environment and config
15+
.env
16+
.env.local
17+
.env.*.local
18+
19+
# IDE and editor files
20+
.idea/
21+
.vscode/
22+
*.swp
23+
*.swo
24+
.DS_Store
25+
26+
# Cache and temporary files
27+
.npm
28+
.eslintcache
29+
.tsbuildinfo
30+
.DS_Store

‎cert-manager/README.md

+229
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
# cert-manager
2+
3+
cert-manager plugin for Headlamp adds a new item (cert-manager) to the sidebar to give users a way to view and manage cert-manager resources.
4+
5+
## Demo
6+
7+
<video src="https://github.com/user-attachments/assets/3bd40e22-94bc-4624-b7be-d303e3688dd9" width="300"></video>
8+
9+
## cert-manager CRDs:
10+
11+
- certificates.cert-manager.io
12+
- certificaterequests.cert-manager.io
13+
- orders.acme.cert-manager.io
14+
- challenges.acme.cert-manager.io
15+
- clusterissuers.cert-manager.io
16+
- issuers.cert-manager.io
17+
- clusterissuers.cert-manager.io
18+
19+
## Lifecycle:
20+
21+
Certificate -> CertificateRequest -> Order -> Challenge -> Secret
22+
23+
1. **Certificate** (Starting Point)
24+
25+
- This is the main custom resource the user creates
26+
- It defines what the user wants: domain names, which issuer to use, and where to store the resulting certificate
27+
- States: Pending → Ready or Failed
28+
29+
2. **CertificateRequest**
30+
31+
- Created automatically by the Certificate controller
32+
- Contains the Certificate Signing Request (CSR) and issuer reference
33+
- Acts as a one-time request for a certificate
34+
- States: Pending → Ready or Failed
35+
36+
3. **Order** (ACME specific)
37+
38+
- Generated by the CertificateRequest when using ACME issuers (like Let's Encrypt)
39+
- Manages the domain validation process
40+
- States: Pending → Processing → Valid/Invalid → Ready
41+
42+
4. **Challenge** (ACME specific)
43+
44+
- Created by the Order resource
45+
- Proves domain ownership to the ACME server
46+
- Two main types:
47+
- HTTP01: Places a file on the web server
48+
- DNS01: Creates a TXT record in the DNS
49+
- States: Pending → Present → Valid/Invalid
50+
51+
5. **Secret**
52+
- Final output containing:
53+
- The private key
54+
- The signed certificate
55+
- The CA certificate chain
56+
- Created/updated once the Challenge is successful
57+
58+
The flow works like this:
59+
60+
1. The user creates a Certificate resource
61+
2. cert-manager creates a CertificateRequest
62+
3. For ACME issuers, an Order is created
63+
4. The Order creates one or more Challenges
64+
5. Once Challenges are validated, the certificate is issued
65+
6. The certificate is stored in a Kubernetes Secret
66+
67+
This process is automated and will repeat when the certificate needs renewal (typically around 30 days before expiration).
68+
69+
State diagram
70+
71+
```mermaid
72+
graph TD
73+
Start((●)) --> Cert[Certificate]
74+
75+
%% Content and states for Certificate
76+
CertNote["Defines desired state:
77+
- Domain names
78+
- Issuer reference
79+
- Secret name
80+
81+
States:
82+
- Pending
83+
- Ready
84+
- Failed"]
85+
Cert --- CertNote
86+
87+
%% Main flow with feedback
88+
Cert -->|creates| CR[CertificateRequest]
89+
CR -->|updates status| Cert
90+
Cert -->|creates| Secret[Secret]
91+
92+
%% Content and states for CertificateRequest
93+
CRNote["Contains:
94+
- CSR
95+
- Issuer ref
96+
97+
States:
98+
- Pending
99+
- Ready
100+
- Failed"]
101+
CR --- CRNote
102+
103+
%% Order and Challenge flow
104+
CR -->|generates| Order[Order]
105+
Order -->|updates status| CR
106+
107+
%% Content and states for Order
108+
OrderNote["Purpose:
109+
- Domain validation
110+
- Certificate retrieval
111+
112+
States:
113+
- Pending
114+
- Valid
115+
- Invalid
116+
- Processing
117+
- Ready"]
118+
Order --- OrderNote
119+
120+
Order -->|creates| Challenge[Challenge]
121+
Challenge -->|updates status| Order
122+
123+
%% Content and states for Challenge
124+
ChallengeNote["Purpose:
125+
- Domain ownership proof
126+
- HTTP01/DNS01
127+
128+
States:
129+
- Pending
130+
- Present
131+
- Valid
132+
- Invalid"]
133+
Challenge --- ChallengeNote
134+
135+
%% Content for Secret
136+
SecretNote["Contains:
137+
- TLS private key
138+
- Signed certificate
139+
- CA chain
140+
141+
States:
142+
- Present/Absent"]
143+
Secret --- SecretNote
144+
145+
%% Styling
146+
style Start fill:#666,stroke:#666
147+
style Cert fill:#333,stroke:#666,color:#fff
148+
style CR fill:#333,stroke:#666,color:#fff
149+
style Order fill:#333,stroke:#666,color:#fff
150+
style Challenge fill:#333,stroke:#666,color:#fff
151+
style Secret fill:#333,stroke:#666,color:#fff
152+
153+
%% Note styling
154+
style CertNote fill:#ffffd0,stroke:#bbb
155+
style CRNote fill:#ffffd0,stroke:#bbb
156+
style OrderNote fill:#ffffd0,stroke:#bbb
157+
style ChallengeNote fill:#ffffd0,stroke:#bbb
158+
style SecretNote fill:#ffffd0,stroke:#bbb
159+
160+
```
161+
162+
# Testing the plugin
163+
164+
## Prerequisites
165+
166+
- A Kubernetes cluster with cert-manager installed
167+
- If you need to install cert-manager, follow the [official installation guide](https://cert-manager.io/docs/installation/)
168+
- Node.js and npm installed on your system
169+
170+
## Steps to Test
171+
172+
1. Clone the plugins repository:
173+
174+
```bash
175+
git clone https://github.com/headlamp-k8s/plugins.git
176+
```
177+
178+
2. Switch to the cert-manager branch:
179+
180+
```bash
181+
git checkout cert-manager
182+
```
183+
184+
3. Navigate to the cert-manager plugin directory:
185+
186+
```bash
187+
cd cert-manager
188+
```
189+
190+
4. Install the required dependencies:
191+
192+
```bash
193+
npm install
194+
```
195+
196+
5. Start the plugin in development mode:
197+
198+
```bash
199+
npm run start
200+
```
201+
202+
6. Launch Headlamp. You should now see "Cert Manager" in the sidebar.
203+
204+
## Optional: Generate Cert-Manager Resources
205+
206+
To test the plugin with sample cert-manager resources:
207+
208+
1. Navigate to the test-files directory:
209+
210+
```bash
211+
cd test-files
212+
```
213+
214+
2. Apply the sample configurations to your cluster:
215+
```bash
216+
kubectl apply -f clusterIssuer.yaml
217+
kubectl apply -f issuer.yaml
218+
kubectl apply -f certificate.yaml
219+
kubectl apply -f order.yaml
220+
kubectl apply -f app.yaml
221+
```
222+
223+
This will create:
224+
225+
- A ClusterIssuer for Let's Encrypt staging
226+
- An Issuer for Let's Encrypt staging
227+
- Two Certificate resources (one using ClusterIssuer, one using Issuer)
228+
- An Order resource
229+
- Sample Nginx deployment with Ingress configurations

0 commit comments

Comments
 (0)