Skip to content

Commit cfbca6e

Browse files
sebrandon1sebrandon1
committed
OCPBUGS-85579: Move Console resources from bundle to runtime with capability detection
Remove ConsoleYAMLSample and ConsoleQuickStart manifests from the OLM bundle and create them at runtime only when the Console capability is enabled on the cluster. On consoleless RAN/RDS clusters, the operator now skips Console resource creation instead of failing during InstallPlan execution. This follows the pattern established by cluster-monitoring-operator (PR #2011, OCPBUGS-14922) for handling optional Console resources in OLM-managed operators. Changes: - Remove 4 Console manifests from bundle/manifests/ - Remove config/console from kustomize manifests generation - Add console_resources.go controller that checks ClusterVersion capabilities before creating Console resources via dynamic client - Use library-go ApplyUnstructuredResourceImproved for idempotent create-or-update with change detection - Add Console YAML files to bindata/ for runtime embedding - Add RBAC for console.openshift.io and clusterversions via kubebuilder markers - Remove ineffective capability.openshift.io/name annotations
1 parent 454cb88 commit cfbca6e

17 files changed

Lines changed: 942 additions & 221 deletions

bundle/manifests/cert-manager-acme-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml renamed to bindata/console/cert-manager-acme-issuer-sample.yaml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
11
apiVersion: console.openshift.io/v1
22
kind: ConsoleYAMLSample
33
metadata:
4-
annotations:
5-
capability.openshift.io/name: Console
64
name: cert-manager-acme-issuer-sample
75
spec:
8-
description: An example ACME Issuer for Let's Encrypt production certificates with
9-
HTTP-01 challenge
106
targetResource:
117
apiVersion: cert-manager.io/v1
128
kind: Issuer
139
title: Example ACME Issuer (Let's Encrypt)
10+
description: An example ACME Issuer for Let's Encrypt production certificates with HTTP-01 challenge
1411
yaml: |-
1512
apiVersion: cert-manager.io/v1
1613
kind: Issuer

bundle/manifests/cert-manager-certificate-sample_console.openshift.io_v1_consoleyamlsample.yaml renamed to bindata/console/cert-manager-certificate-sample.yaml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
11
apiVersion: console.openshift.io/v1
22
kind: ConsoleYAMLSample
33
metadata:
4-
annotations:
5-
capability.openshift.io/name: Console
64
name: cert-manager-certificate-sample
75
spec:
8-
description: A simple Certificate example
96
targetResource:
107
apiVersion: cert-manager.io/v1
118
kind: Certificate
129
title: Example Certificate
10+
description: A simple Certificate example
1311
yaml: |-
1412
apiVersion: cert-manager.io/v1
1513
kind: Certificate
@@ -24,3 +22,4 @@ spec:
2422
issuerRef:
2523
name: selfsigned-issuer
2624
kind: Issuer
25+

‎bindata/console/cert-manager-example-quickstart.yaml‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
apiVersion: console.openshift.io/v1
2+
kind: ConsoleQuickStart
3+
metadata:
4+
name: cert-manager-example
5+
annotations:
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
spec:
10+
displayName: cert-manager Operator for Red Hat OpenShift Example
11+
tags:
12+
- example
13+
- operator
14+
- certificates
15+
durationMinutes: 10
16+
prerequisites:
17+
- You completed the "Install the cert-manager Operator for Red Hat OpenShift" quick start.
18+
- You have a namespace in which to deploy the example CRs.
19+
description: |-
20+
Create and issue TLS certificates using the cert-manager Operator for Red Hat OpenShift
21+
introduction: |-
22+
# cert-manager Operator for Red Hat OpenShift
23+
24+
The cert-manager Operator for Red Hat OpenShift enables you to create and sign TLS certificates from an external PKI for your workloads
25+
running on an OpenShift cluster.
26+
27+
### Expected Learning
28+
29+
With this Quick Start, you will learn about the following CRDs provided by the cert-manager operator:
30+
1. **Issuer** - defines a certificate authority that can sign certificates
31+
2. **Certificate** - defines the desired certificate and its properties
32+
33+
This Quick Start will walk you through creating your first certificate:
34+
- Create a self-signed Issuer (for testing)
35+
- Create a Certificate signed by that Issuer
36+
- View the generated certificate in a Kubernetes Secret
37+
- Learn how to use it in your applications
38+
39+
**Note**: For production, you would use Let's Encrypt (ACME), HashiCorp Vault, or your organization's CA instead of self-signed certificates.
40+
tasks:
41+
- title: Navigate to installed cert-manager operator
42+
description: |-
43+
### To navigate to the installed operator:
44+
1. Go to the **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section of the navigation.
45+
2. In the **Search by name** field, type `cert-manager`.
46+
3. Look for **cert-manager Operator for Red Hat OpenShift**. If you had completed the prerequisite Quick Start, the tile should appear.
47+
4. Click on the installed operator
48+
49+
You will be brought to the **Operator Details** page and be presented with **Provided APIs**
50+
review:
51+
instructions: |-
52+
#### Verify you see a list of **Provided APIs**:
53+
The list should include `Issuer`, `ClusterIssuer`, and `Certificate`
54+
failedTaskHelp: This task isn't verified yet. Try the task again.
55+
summary:
56+
success: You are in the right place, and ready to start the rest of the Quick Start
57+
failed: Try the steps again.
58+
- title: Select a project
59+
description: |-
60+
### Create or select a project to work in
61+
1. Find the **Project** dropdown menu at the top of the screen.
62+
2. Select or create the project in which you want to work in.
63+
64+
**Note**: For this example, we'll create an `Issuer` which is namespace-scoped. If you want to issue certificates
65+
across multiple namespaces, you can create a `ClusterIssuer` instead.
66+
review:
67+
instructions: |-
68+
#### Verify the name in the **Project** dropdown menu is the expected project
69+
failedTaskHelp: Try the task again.
70+
summary:
71+
success: You are in the right place.
72+
failed: Try the steps again.
73+
- title: Create a self-signed Issuer
74+
description: |-
75+
### To create a self-signed Issuer
76+
77+
An Issuer represents a certificate authority that can sign certificates. We'll create a self-signed Issuer
78+
for this example. This is useful for testing and development.
79+
80+
1. Find the `Issuer` Custom Resource in the list of **Provided APIs** or in the top side-scrolling menu bar.
81+
- From the list of **Provided APIs**, click the **Create instance** link.
82+
- From the **top side-scrolling menu bar**, click **Issuer** and then click **Create Issuer**.
83+
84+
2. Switch to **YAML view** in the editor.
85+
86+
3. On the right sidebar, look for the **Samples** section and select **"Example Self-Signed Issuer"**.
87+
88+
4. Click **Try it** to populate the editor with the sample YAML.
89+
90+
5. Click the **Create** button to create the Issuer.
91+
review:
92+
instructions: |-
93+
#### Verify the Issuer was successfully created:
94+
1. You should see the Issuer listed with the name `selfsigned-issuer`
95+
2. Check that the **Ready** condition shows **True** in the Conditions section
96+
failedTaskHelp: This task isn't verified yet. Try the task again.
97+
summary:
98+
success: You just created a self-signed Issuer! Now we can create certificates.
99+
failed: Try the steps again.
100+
- title: Create a Certificate
101+
description: |-
102+
### To create a Certificate
103+
104+
Now we'll create a certificate that will be signed by our Issuer.
105+
106+
1. Find the `Certificate` Custom Resource in the list of **Provided APIs** or in the top side-scrolling menu bar.
107+
- From the list of **Provided APIs**, click the **Create instance** link.
108+
- From the **top side-scrolling menu bar**, click **Certificate** and then click **Create Certificate**.
109+
110+
2. Switch to **YAML view** in the editor.
111+
112+
3. On the right sidebar, look for the **Samples** section and select **"Example Certificate"**.
113+
114+
4. Click **Try it** to populate the editor with the sample YAML.
115+
116+
5. Click the **Create** button to create the Certificate.
117+
review:
118+
instructions: |-
119+
#### Verify the Certificate was successfully created:
120+
1. You should see the Certificate listed with the name `example-cert`.
121+
2. Check that the **Ready** condition shows **True**.
122+
3. Navigate to the [Workloads]{{highlight qs-nav-workloads}} section and click **Secrets**
123+
4. You should see a new Secret named `example-tls`.
124+
failedTaskHelp: This task isn't verified yet. Try the task again.
125+
summary:
126+
success: You just created your first certificate! cert-manager has issued it and stored it in a Secret.
127+
failed: Try the steps again.
128+
- title: View the certificate
129+
description: |-
130+
### To inspect the certificate
131+
132+
Let's look at the Secret that contains the certificate.
133+
134+
1. Make sure you're in the [Workloads]{{highlight qs-nav-workloads}} section, click **Secrets**.
135+
2. Click on the **example-tls** Secret.
136+
3. You should see the certificate data with keys:
137+
- `tls.crt` - The certificate.
138+
- `tls.key` - The private key.
139+
- `ca.crt` - The CA certificate.
140+
review:
141+
instructions: |-
142+
#### Verify you can see the certificate data:
143+
Is the Secret `example-tls` present with `tls.crt` and `tls.key`?
144+
failedTaskHelp: This task isn't verified yet. Try the task again.
145+
summary:
146+
success: Great! Your certificate is ready to use.
147+
failed: Try the steps again.
148+
- title: Use the certificate
149+
description: |-
150+
### How to use certificates
151+
152+
Now you can use this certificate in your applications. Here's a simple example for an OpenShift Route:
153+
154+
```yaml
155+
apiVersion: route.openshift.io/v1
156+
kind: Route
157+
metadata:
158+
name: my-app
159+
spec:
160+
to:
161+
kind: Service
162+
name: my-service
163+
tls:
164+
termination: edge
165+
externalCertificate:
166+
name: example-tls
167+
```
168+
169+
Or in an Ingress:
170+
171+
```yaml
172+
apiVersion: networking.k8s.io/v1
173+
kind: Ingress
174+
metadata:
175+
name: my-app
176+
spec:
177+
tls:
178+
- secretName: example-tls
179+
rules:
180+
- host: example.com
181+
```
182+
183+
**Note**: cert-manager will automatically renew certificates before they expire!
184+
review:
185+
instructions: |-
186+
#### Do you understand how to use certificates?
187+
Certificates can be referenced in Routes and Ingress resources.
188+
failedTaskHelp: Review the examples above.
189+
summary:
190+
success: You now know how to create and use certificates!
191+
failed: Review the examples again.
192+
conclusion: |-
193+
Great job! You've successfully created your first Issuer and Certificate.
194+
195+
### Next Steps:
196+
197+
- For production, use Let's Encrypt (ACME Issuer) instead of self-signed certificates
198+
- Explore ClusterIssuer for cluster-wide certificate management
199+
- Check out the [cert-manager documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift) to learn more

bundle/manifests/cert-manager-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml renamed to bindata/console/cert-manager-issuer-sample.yaml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
11
apiVersion: console.openshift.io/v1
22
kind: ConsoleYAMLSample
33
metadata:
4-
annotations:
5-
capability.openshift.io/name: Console
64
name: cert-manager-issuer-sample
75
spec:
8-
description: A simple self-signed Issuer for development and testing
96
targetResource:
107
apiVersion: cert-manager.io/v1
118
kind: Issuer
129
title: Example Self-Signed Issuer
10+
description: A simple self-signed Issuer for development and testing
1311
yaml: |-
1412
apiVersion: cert-manager.io/v1
1513
kind: Issuer
@@ -18,3 +16,4 @@ spec:
1816
namespace: default
1917
spec:
2018
selfSigned: {}
19+

0 commit comments

Comments
 (0)