cached-certificate-operator

CachedCertificate Workflow

When a CachedCertificate is created or updated the operator does the following:

Check for a valid upstream Certificate
- Create if missing and then resync
Wait for upstream Secret to be created
Sync the upstream Secret to the target local secret name
Watch for upstream Secret changes and sync down

Quickstart Install

The process below uses the kustomize files in ./config to enable easy deployment.

# get the latest code
git clone git@github.com:weave-lab/cached-certificate-operator.git
cd cached-certificate-operator

# install operator into the K8s cluster specified in ~/.kube/config
kubectl apply -k config/default

Try out the operator with a self-signed ca

The steps below depend on having cert-manager installed in the cluster.

We do not cover installing cert-manager. Instead see the official cert-manager installation docs.

Create a selfSigned issuer

# wait for cert-manager to come up
kubectl create -f <(cat <<EOF
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
EOF
)

Put some basic certs in

kubectl apply -f config/samples/cache_v1alpha1_cachedcertificate.yaml
kubectl apply -f config/samples/cache_v1alpha1_cachedcertificate-alt.yaml

You should see two valid secrets for the 2 resources fairly quickly:

kubectl get secrets -l cache.weavelab.xyz/synced-from-cache

Create secondary `CachedCertificates` for DNSNames that have already had certs provisioned

kubectl apply -f config/samples/cache_v1alpha1_cachedcertificate-2.yaml
kubectl apply -f config/samples/cache_v1alpha1_cachedcertificate-alt-2.yaml

You should see 4 valid secrets for the 4 resources.

kubectl get secrets -l cache.weavelab.xyz/synced-from-cache

However, if you check for Certificates, you will only see two resources. This is because even though we have 4 total CachedCertificates there are only two unique sets of dnsNames so the operator prevents duplicates from being created.

kubectl get certificates -n cached-certificate-operator-system

Local Development

Create a test kubernetes cluster

The official docs use k3d but any cluster creation tool will work.

k3d cluster create cc-op

NOTE: Be absolutely sure this is done and that your current kubectl context is for your temp cluster before continuing

Install the CRDs

make install

Install the latest cert-manager

This is a bare minimum install with default configuration for cert-manager. It is most likely not ideal for production use but works just fine for local development.

kubectl create -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml

Run the operator locally

make run

Next try the operator by following the instrutctions in [](#Try out the operator with a self-signed ca)

Testing

This operator has both standard unit tests and full-featured integration tests.

All tests can be done using make test

You can also manually install kubebuilder and it's dependencies which will allow you to run a full go test ./... locally or even run tests via your editor!

Setup for test exec without using `make`

K8S_VERSION=1.19.2

sudo mkdir -p /usr/local/kubebuilder

# Get the latest kubebuilder and put it into the expected location
curl -L -o kubebuilder https://go.kubebuilder.io/dl/latest/$(go env GOOS)/$(go env GOARCH)
chmod +x kubebuilder && mv kubebuilder /usr/local/kubebuilder/bin/

# Get full k8s envtest deps and putthem into the expected locatoin
curl -sSLo envtest-bins.tar.gz "https://storage.googleapis.com/kubebuilder-tools/kubebuilder-tools-${K8S_VERSION}-$(go env GOOS)-$(go env GOARCH).tar.gz"
sudo tar -C /usr/local/kubebuilder/ --strip-components=1 -zvxf envtest-bins.tar.gz

# Add kubebuilder to your path
echo 'export PATH=$PATH:/usr/local/kubebuilder/bin' >> ~/.bashrc
. ~/.bashrc

Now go test ./... should work!

weave-lab/cached-certificate-operator