feat(cert_manager): enable automated test issuer and certificate provisioning

Add self-signed ClusterIssuer and test Certificate deployment to cert_manager role for verifying cert-manager functionality, while refactoring uyuni role to use self-signed issuer locally instead of external Let's Encrypt references and introduce database credential secrets generation.

roles/cert_manager/defaults/main.yml

@@ -8,3 +8,5 @@ cert_manager_crds_version: "v1.16.0"
 cert_manager_use_helm: true
 
 cert_manager_args: []
+
+cert_manager_deploy_test_issuer: true

roles/cert_manager/tasks/helm.yml

@@ -50,3 +50,50 @@
     PATH: "/usr/local/bin:/usr/bin:/bin"
   register: _helm_install
   changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
+
+- name: Deploy | Self-signed ClusterIssuer
+  ansible.builtin.template:
+    src: self-signed-issuer.yml.j2
+    dest: /tmp/self-signed-issuer.yml
+    mode: "0600"
+  when: cert_manager_deploy_test_issuer | default(true)
+
+- name: Apply | Self-signed ClusterIssuer
+  ansible.builtin.command: >
+    kubectl apply -f /tmp/self-signed-issuer.yml
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _issuer_apply
+  changed_when: false
+  failed_when: _issuer_apply.rc != 0
+  when: cert_manager_deploy_test_issuer | default(true)
+
+- name: Deploy | Test Certificate
+  ansible.builtin.template:
+    src: test-certificate.yml.j2
+    dest: /tmp/test-certificate.yml
+    mode: "0600"
+  when: cert_manager_deploy_test_issuer | default(true)
+
+- name: Apply | Test Certificate
+  ansible.builtin.command: >
+    kubectl apply -f /tmp/test-certificate.yml
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _certificate_apply
+  changed_when: false
+  failed_when: _certificate_apply.rc != 0
+  when: cert_manager_deploy_test_issuer | default(true)
+
+- name: Wait | Certificate ready
+  ansible.builtin.command: >
+    kubectl wait --for=condition=Ready certificate/test-certificate -n default --timeout=120s
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _cert_wait
+  changed_when: false
+  failed_when: _cert_wait.rc != 0
+  when: cert_manager_deploy_test_issuer | default(true)

roles/cert_manager/templates/self-signed-issuer.yml.j2

@@ -0,0 +1,7 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}

roles/cert_manager/templates/test-certificate.yml.j2

@@ -0,0 +1,27 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: test-certificate
+  namespace: default
+spec:
+  secretName: test-certificate-secret
+  duration: 2160h
+  renewBefore: 360h
+  subject:
+    organizations:
+      - Test Org
+  isCA: false
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  usages:
+    - server auth
+    - client auth
+  dnsNames:
+    - test.local.mrwho.ru
+    - "*.test.local.mrwho.ru"
+  issuerRef:
+    name: self-signed-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

roles/uyuni/defaults/main.yml

@@ -7,13 +7,6 @@ uyuni_helm_values:
   global.fqdn: uyuni.local.mrwho.ru
   ingress.enabled: true
   ingress.type: traefik
- # ingress.annotations."cert-manager.io/cluster-issuer": "letsencrypt-prod"
-uyuni_tls_cert: null
-uyuni_tls_key: null
-db_tls_cert: null
-db_tls_key: null
-uyuni_ca_cert: null
-db_ca_cert: null
 uyuni_create_certificates: true
 uyuni_certificates:
   - name: uyuni-ingress-cert
@@ -21,14 +14,16 @@ uyuni_certificates:
     secretName: uyuni-cert
     dnsNames:
       - uyuni.local.mrwho.ru
-    issuerRef:
-      name: letsencrypt-prod
-      kind: ClusterIssuer
   - name: uyuni-db-cert
     namespace: uyuni-server
     secretName: db-cert
     dnsNames:
       - uyuni.local.mrwho.ru
-    issuerRef:
-      name: letsencrypt-prod
-      kind: ClusterIssuer
+uyuni_db_admin_password: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"
+uyuni_db_admin_user: uyuni
+uyuni_db_name: uyuni
+uyuni_db_user: uyuni
+uyuni_db_report_user: uyuni_report
+uyuni_db_report_password: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"
+uyuni_admin_user: admin
+uyuni_admin_password: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"

roles/uyuni/tasks/main.yml

@@ -7,67 +7,119 @@
     kubeconfig: "{{ uyuni_kubeconfig }}"
     state: present
 
-- name: Create uyuni-ingress-cert Certificate
+- name: Create uyuni-selfsigned-issuer Issuer
   kubernetes.core.k8s:
+    api_version: cert-manager.io/v1
+    kind: Issuer
+    name: uyuni-selfsigned-issuer
+    namespace: "{{ uyuni_namespace }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
+    definition:
+      spec:
+        selfSigned: {}
+    state: present
+  when: uyuni_create_certificates | bool
+
+- name: Create uyuni Certificates
+  kubernetes.core.k8s:
+    api_version: cert-manager.io/v1
+    kind: Certificate
+    name: "{{ item.name }}"
+    namespace: "{{ item.namespace | default(uyuni_namespace) }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
+    definition:
+      spec:
+        secretName: "{{ item.secretName }}"
+        dnsNames: "{{ item.dnsNames }}"
+        issuerRef:
+          name: uyuni-selfsigned-issuer
+          kind: Issuer
+    state: present
+  loop: "{{ uyuni_certificates }}"
+  when: uyuni_create_certificates | bool
+
+- name: Wait for uyuni-ingress-cert certificate to be ready
+  kubernetes.core.k8s_info:
     api_version: cert-manager.io/v1
     kind: Certificate
     name: uyuni-ingress-cert
     namespace: "{{ uyuni_namespace }}"
     kubeconfig: "{{ uyuni_kubeconfig }}"
-    definition:
-      spec:
-        secretName: uyuni-cert
-        dnsNames:
-          - uyuni.local.mrwho.ru
-        issuerRef:
-          name: letsencrypt-prod
-          kind: ClusterIssuer
-    state: present
+  register: _uyuni_cert_status
+  until: _uyuni_cert_status.resources[0].status.conditions | selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length > 0
+  retries: 60
+  delay: 10
   when: uyuni_create_certificates | bool
 
-- name: Create uyuni-db-cert Certificate
-  kubernetes.core.k8s:
+- name: Wait for uyuni-db-cert certificate to be ready
+  kubernetes.core.k8s_info:
     api_version: cert-manager.io/v1
     kind: Certificate
     name: uyuni-db-cert
     namespace: "{{ uyuni_namespace }}"
     kubeconfig: "{{ uyuni_kubeconfig }}"
+  register: _db_cert_status
+  until: _db_cert_status.resources[0].status.conditions | selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length > 0
+  retries: 60
+  delay: 10
+  when: uyuni_create_certificates | bool
+
+- name: Create db-admin-credentials secret
+  kubernetes.core.k8s:
+    api_version: v1
+    kind: Secret
+    name: db-admin-credentials
+    namespace: "{{ uyuni_namespace }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
     definition:
-      spec:
-        secretName: db-cert
-        dnsNames:
-          - uyuni.local.mrwho.ru
-        issuerRef:
-          name: letsencrypt-prod
-          kind: ClusterIssuer
+      type: Opaque
+      data:
+        username: "{{ uyuni_db_admin_user | b64encode }}"
+        password: "{{ uyuni_db_admin_password | b64encode }}"
+        database: "{{ uyuni_db_name | b64encode }}"
     state: present
-  when: uyuni_create_certificates | bool
 
-- name: Wait for uyuni-ingress-cert secret
-  kubernetes.core.k8s_info:
+- name: Create db-credentials secret
+  kubernetes.core.k8s:
     api_version: v1
     kind: Secret
-    name: uyuni-cert
+    name: db-credentials
     namespace: "{{ uyuni_namespace }}"
     kubeconfig: "{{ uyuni_kubeconfig }}"
-  register: _uyuni_cert_secret
-  until: _uyuni_cert_secret.resources | length > 0
-  retries: 60
-  delay: 10
-  when: uyuni_create_certificates | bool
+    definition:
+      type: Opaque
+      data:
+        username: "{{ uyuni_db_user | b64encode }}"
+        password: "{{ uyuni_db_admin_password | b64encode }}"
+    state: present
 
-- name: Wait for uyuni-db-cert secret
-  kubernetes.core.k8s_info:
+- name: Create reportdb-credentials secret
+  kubernetes.core.k8s:
     api_version: v1
     kind: Secret
-    name: db-cert
+    name: reportdb-credentials
     namespace: "{{ uyuni_namespace }}"
     kubeconfig: "{{ uyuni_kubeconfig }}"
-  register: _db_cert_secret
-  until: _db_cert_secret.resources | length > 0
-  retries: 60
-  delay: 10
-  when: uyuni_create_certificates | bool
+    definition:
+      type: Opaque
+      data:
+        username: "{{ uyuni_db_report_user | b64encode }}"
+        password: "{{ uyuni_db_report_password | b64encode }}"
+    state: present
+
+- name: Create admin-credentials secret
+  kubernetes.core.k8s:
+    api_version: v1
+    kind: Secret
+    name: admin-credentials
+    namespace: "{{ uyuni_namespace }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
+    definition:
+      type: Opaque
+      data:
+        username: "{{ uyuni_admin_user | b64encode }}"
+        password: "{{ uyuni_admin_password | b64encode }}"
+    state: present
 
 - name: Include Helm installation
   ansible.builtin.include_tasks: helm.yml