issue self signed certificate #316
Conversation
nimakaviani
left a comment
There was a problem hiding this comment.
Thanks for this. made a few minor comments. otherwise looks good.
I hear your points on the use of self-signed certs and it makes sense in the context of idpBuidler alone. However, if we try to move towards an AppSet strategy that also happens to apply to external clusters, then I wonder whether the idea of using CertManager has a stronger ground.
If users will have cert-manager installed to their clusters by default, and if the idpBuilder is supposed to pave the path for them to eventually transitioin from a dev / test environment to a prod env, shall we just bite the bullet and pay the extra cost of enabling them with the cert-manager in the test environment too?
that said, given the amount of work put into this, this works as an interim solution. But lets revisit this as we move towards expanding on the deployment strategy.
Signed-off-by: Manabu McCloskey <manabu.mccloskey@gmail.com>
Signed-off-by: Manabu McCloskey <manabu.mccloskey@gmail.com>
|
I think I'd rather wait for concrete use cases for cert-manager until we pull it into core. Ready for another round of review. |
|
I agree on waiting for more use cases before bringing in cert manager. It should be reasonably easy to roll forward to it when the time comes. |
Cert Manager can help to deal with many use cases like:
|
fixes: #137
related to: #300 #293
With this PR, idpbuilder will:
I thought about using cert-manager but decided not to use it. For our purposes, we just need a certificate for ingress-nginx for in-cluster and incoming traffic only. Introducing cert-manager means: