Skip to content

Commit 7951cf4

Browse files
lexfreilexfrei
committed
fix(cert-manager): enable the Gateway API solver in the controller
With the platform Gateway enabled, the ClusterIssuers in cert-manager-issuers and the per-tenant Issuers rendered for TenantGateway carry an http01.gatewayHTTPRoute solver, but the controller only honours that solver when Gateway API support is switched on, and the vendored chart leaves it off. Every HTTP-01 challenge behind the Gateway then fails with "gateway api is not enabled" and no ACME certificate is issued. Pass a ControllerConfiguration with enableGatewayAPI to the host cert-manager through the component values of its platform Package. The host always ships the Gateway API CRDs and orders cert-manager after them, so the flag is safe on every variant. It is not a default of the system/cert-manager chart: the same chart is installed into tenant clusters, where the CRDs are an opt-in addon and a controller started with Gateway API support and no CRDs exits at startup. The tenant side keeps opting in on its own. Signed-off-by: Aleksei Sviridkin <[email protected]> Assisted-By: Claude <[email protected]>
1 parent a5d12e7 commit 7951cf4

3 files changed

Lines changed: 178 additions & 1 deletion

File tree

‎packages/core/platform/templates/bundles/system.yaml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,24 @@
173173

174174
# Common Packages
175175
{{include "cozystack.platform.package.default" (list "cozystack.gateway-api-crds" $) }}
176-
{{include "cozystack.platform.package.default" (list "cozystack.cert-manager" $) }}
176+
{{- /* The ClusterIssuers of cert-manager-issuers and the per-tenant Issuers
177+
rendered for TenantGateway both use an http01.gatewayHTTPRoute solver
178+
when the Gateway is enabled, and the controller refuses that solver
179+
unless Gateway API support is switched on: every such challenge fails
180+
with "gateway api is not enabled" and no certificate is issued. Safe to
181+
switch on for every host variant because cozystack.gateway-api-crds is
182+
emitted above unconditionally and the cert-manager source depends on
183+
it. Threaded here rather than set as a default of system/cert-manager:
184+
the same chart is installed into tenant clusters, where the CRDs are an
185+
opt-in addon and a controller started with enableGatewayAPI and no
186+
CRDs exits at startup. */ -}}
187+
{{- $certManagerConfig := dict
188+
"apiVersion" "controller.config.cert-manager.io/v1alpha1"
189+
"kind" "ControllerConfiguration"
190+
"enableGatewayAPI" true -}}
191+
{{- $certManagerValues := dict "cert-manager" (dict "config" $certManagerConfig) -}}
192+
{{- $certManagerComponents := dict "cert-manager" (dict "values" $certManagerValues) -}}
193+
{{include "cozystack.platform.package" (list "cozystack.cert-manager" "default" $ $certManagerComponents) }}
177194
{{- /* Disable hazard guard. The vendored cozy-ouroboros chart (0.8.0)
178195
ships a pre-delete Helm hook that sed-strips the BEGIN/END
179196
block from kube-system/coredns Corefile when the chart is

‎packages/core/platform/tests/bundles_cert_manager_gateway_api_test.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
suite: cert-manager Gateway API solver bundle wiring
2+
templates:
3+
- templates/bundles/system.yaml
4+
- templates/sources.yaml
5+
release:
6+
name: cozystack
7+
namespace: cozy-system
8+
tests:
9+
# With the Gateway enabled, the platform's ClusterIssuers and the per-tenant
10+
# Issuers both carry an http01.gatewayHTTPRoute solver, and the controller
11+
# refuses it unless Gateway API support is on: every challenge fails with
12+
# "gateway api is not enabled". The flag rides on the Package's component
13+
# values, not on a default of system/cert-manager, because that chart is also
14+
# installed into tenant clusters without the CRDs, where the same flag makes
15+
# the controller exit at startup. These tests pin the host side of that split.
16+
- it: enables the Gateway API solver on the host cert-manager (isp-full)
17+
template: templates/bundles/system.yaml
18+
set:
19+
bundles:
20+
system:
21+
enabled: true
22+
variant: isp-full
23+
documentSelector:
24+
path: metadata.name
25+
value: cozystack.cert-manager
26+
asserts:
27+
- equal:
28+
path: spec.components.cert-manager.values.cert-manager.config
29+
value:
30+
apiVersion: controller.config.cert-manager.io/v1alpha1
31+
kind: ControllerConfiguration
32+
enableGatewayAPI: true
33+
34+
- it: enables it on the hosted variant too (isp-hosted)
35+
template: templates/bundles/system.yaml
36+
set:
37+
bundles:
38+
system:
39+
enabled: true
40+
variant: isp-hosted
41+
iaas:
42+
enabled: false
43+
documentSelector:
44+
path: metadata.name
45+
value: cozystack.cert-manager
46+
asserts:
47+
- equal:
48+
path: spec.components.cert-manager.values.cert-manager.config.enableGatewayAPI
49+
value: true
50+
51+
# What makes the flag safe on the host: the CRDs ship on every variant and
52+
# cert-manager is ordered after them. Losing either turns the flag into the
53+
# tenant failure mode described above.
54+
- it: ships the Gateway API CRDs on the hosted variant as well (isp-hosted)
55+
template: templates/bundles/system.yaml
56+
set:
57+
bundles:
58+
system:
59+
enabled: true
60+
variant: isp-hosted
61+
iaas:
62+
enabled: false
63+
asserts:
64+
- containsDocument:
65+
apiVersion: cozystack.io/v1alpha1
66+
kind: Package
67+
name: cozystack.gateway-api-crds
68+
any: true
69+
70+
- it: orders cert-manager after the Gateway API CRDs
71+
template: templates/sources.yaml
72+
documentSelector:
73+
path: metadata.name
74+
value: cozystack.cert-manager
75+
asserts:
76+
- contains:
77+
path: spec.variants[0].dependsOn
78+
content: cozystack.gateway-api-crds

‎packages/system/cert-manager/tests/controller_gateway_api_test.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
suite: cert-manager controller config wiring
2+
3+
# The host enables the Gateway API solver by passing a ControllerConfiguration
4+
# through this chart's `config` value from the platform bundle. It is not a
5+
# default of this package on purpose: the same chart is installed into tenant
6+
# clusters, where the Gateway API CRDs are an opt-in addon, and a controller
7+
# started with enableGatewayAPI and no CRDs exits at startup and crashloops.
8+
#
9+
# The first two tests pin the chart side of that contract with the exact
10+
# payload the host passes: a re-vendored chart that stops rendering `config`
11+
# into the ConfigMap, or stops mounting it and naming it in --config, would
12+
# turn the host flag into a silent no-op. The third pins the neutral default,
13+
# which is what keeps tenant clusters without the CRDs alive.
14+
15+
templates:
16+
- charts/cert-manager/templates/controller-config.yaml
17+
- charts/cert-manager/templates/deployment.yaml
18+
19+
release:
20+
name: cert-manager
21+
namespace: cozy-cert-manager
22+
23+
tests:
24+
- it: renders a ControllerConfiguration passed through config into the controller ConfigMap
25+
template: charts/cert-manager/templates/controller-config.yaml
26+
set:
27+
cert-manager:
28+
config:
29+
apiVersion: controller.config.cert-manager.io/v1alpha1
30+
kind: ControllerConfiguration
31+
enableGatewayAPI: true
32+
asserts:
33+
- isKind:
34+
of: ConfigMap
35+
- equal:
36+
path: metadata.name
37+
value: cert-manager
38+
- matchRegex:
39+
path: data["config.yaml"]
40+
pattern: '(?m)^apiVersion: controller\.config\.cert-manager\.io/v1alpha1$'
41+
- matchRegex:
42+
path: data["config.yaml"]
43+
pattern: '(?m)^kind: ControllerConfiguration$'
44+
- matchRegex:
45+
path: data["config.yaml"]
46+
pattern: '(?m)^enableGatewayAPI: true$'
47+
48+
- it: mounts that ConfigMap into the controller and names it in --config
49+
template: charts/cert-manager/templates/deployment.yaml
50+
set:
51+
cert-manager:
52+
config:
53+
apiVersion: controller.config.cert-manager.io/v1alpha1
54+
kind: ControllerConfiguration
55+
enableGatewayAPI: true
56+
asserts:
57+
- isKind:
58+
of: Deployment
59+
- contains:
60+
path: spec.template.spec.containers[0].args
61+
content: --config=/var/cert-manager/config/config.yaml
62+
- contains:
63+
path: spec.template.spec.containers[0].volumeMounts
64+
content:
65+
name: config
66+
mountPath: /var/cert-manager/config
67+
- contains:
68+
path: spec.template.spec.volumes
69+
content:
70+
name: config
71+
configMap:
72+
name: cert-manager
73+
74+
- it: ships no controller config by default, so the Gateway API solver stays off unless the installer asks
75+
asserts:
76+
- hasDocuments:
77+
count: 0
78+
template: charts/cert-manager/templates/controller-config.yaml
79+
- notContains:
80+
path: spec.template.spec.containers[0].args
81+
content: --config=/var/cert-manager/config/config.yaml
82+
template: charts/cert-manager/templates/deployment.yaml

0 commit comments

Comments
 (0)