refactor(uyuni): integrate cert-manager for automated TLS certificate provisioning

Replace manual TLS secret creation with cert-manager Certificate resources and automatic secret provisioning, enabling dynamic certificate issuance from Let's Encrypt while improving infrastructure reliability and reducing operational overhead.

playbooks/setup_uyuni.yml

@@ -0,0 +1,6 @@
+---
+- name: Deploy Uyuni Server on Kubernetes
+  hosts: manager_nodes
+  become: false
+  roles:
+    - uyuni

roles/cert_manager/tasks/helm.yml

@@ -1,6 +1,6 @@
 ---
 - name: Helm | Add Jetstack chart repository
-  ansible.builtin.command: helm repo add jetstack https://charts.jetstack.io
+  ansible.builtin.command: helm repo add jetstack https://jetstack.io
   environment:
     KUBECONFIG: "{{ cert_manager_kubeconfig }}"
     PATH: "/usr/local/bin:/usr/bin:/bin"
@@ -27,10 +27,12 @@
 
 - name: Helm | Install or upgrade cert-manager
   ansible.builtin.command: >
-    helm upgrade --install cert-manager jetstack/cert-manager
+    helm repo update && helm upgrade --install cert-manager jetstack/cert-manager
     --namespace {{ cert_manager_namespace }}
     --create-namespace
+    {% if cert_manager_chart_version is defined and cert_manager_chart_version | length > 0 %}
     --version {{ cert_manager_chart_version }}
+    {% endif %}
     {% if cert_manager_args is defined and cert_manager_args | length > 0 %}
     --set args[0]={{ cert_manager_args[0] }}
     {% endif %}

roles/uyuni/defaults/main.yml

@@ -2,12 +2,33 @@
 # role defaults
 uyuni_namespace: uyuni-server
 uyuni_chart_version: 2026.6.0
-uyuni_kubeconfig: /root/.kube/config
+uyuni_kubeconfig: "/home/{{ ansible_user }}/.kube/config"
 uyuni_helm_values:
-  global.fqdn: null
+  global.fqdn: uyuni.local.mrwho.ru
+  ingress.enabled: true
+  ingress.type: traefik
+ # ingress.annotations."cert-manager.io/cluster-issuer": "letsencrypt-prod"
 uyuni_tls_cert: null
 uyuni_tls_key: null
 db_tls_cert: null
 db_tls_key: null
 uyuni_ca_cert: null
 db_ca_cert: null
+uyuni_create_certificates: true
+uyuni_certificates:
+  - name: uyuni-ingress-cert
+    namespace: uyuni-server
+    secretName: uyuni-cert
+    dnsNames:
+      - uyuni.local.mrwho.ru
+    issuerRef:
+      name: letsencrypt-prod
+      kind: ClusterIssuer
+  - name: uyuni-db-cert
+    namespace: uyuni-server
+    secretName: db-cert
+    dnsNames:
+      - uyuni.local.mrwho.ru
+    issuerRef:
+      name: letsencrypt-prod
+      kind: ClusterIssuer

roles/uyuni/tasks/main.yml

@@ -3,62 +3,100 @@
   kubernetes.core.k8s:
     api_version: v1
     kind: Namespace
-    metadata:
     name: "{{ uyuni_namespace }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
     state: present
 
-- name: Create uyuni TLS certificate secret
+- name: Create uyuni-ingress-cert Certificate
   kubernetes.core.k8s:
+    api_version: cert-manager.io/v1
+    kind: Certificate
+    name: uyuni-ingress-cert
+    namespace: "{{ uyuni_namespace }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
+    definition:
+      spec:
+        secretName: uyuni-cert
+        dnsNames:
+          - uyuni.local.mrwho.ru
+        issuerRef:
+          name: letsencrypt-prod
+          kind: ClusterIssuer
+    state: present
+  when: uyuni_create_certificates | bool
+
+- name: Create uyuni-db-cert Certificate
+  kubernetes.core.k8s:
+    api_version: cert-manager.io/v1
+    kind: Certificate
+    name: uyuni-db-cert
+    namespace: "{{ uyuni_namespace }}"
+    kubeconfig: "{{ uyuni_kubeconfig }}"
+    definition:
+      spec:
+        secretName: db-cert
+        dnsNames:
+          - uyuni.local.mrwho.ru
+        issuerRef:
+          name: letsencrypt-prod
+          kind: ClusterIssuer
+    state: present
+  when: uyuni_create_certificates | bool
+
+- name: Wait for uyuni-ingress-cert secret
+  kubernetes.core.k8s_info:
     api_version: v1
     kind: Secret
-    metadata:
     name: uyuni-cert
     namespace: "{{ uyuni_namespace }}"
-    type: kubernetes.io/tls
+    kubeconfig: "{{ uyuni_kubeconfig }}"
-    data:
+  register: _uyuni_cert_secret
-      tls.crt: "{{ uyuni_tls_cert | b64encode }}"
+  until: _uyuni_cert_secret.resources | length > 0
-      tls.key: "{{ uyuni_tls_key | b64encode }}"
+  retries: 60
-    state: present
+  delay: 10
-  when: uyuni_tls_cert is defined and uyuni_tls_key is defined
+  when: uyuni_create_certificates | bool
 
-- name: Create database TLS certificate secret
+- name: Wait for uyuni-db-cert secret
-  kubernetes.core.k8s:
+  kubernetes.core.k8s_info:
     api_version: v1
     kind: Secret
-    metadata:
     name: db-cert
     namespace: "{{ uyuni_namespace }}"
-    type: kubernetes.io/tls
+    kubeconfig: "{{ uyuni_kubeconfig }}"
-    data:
+  register: _db_cert_secret
-      tls.crt: "{{ db_tls_cert | b64encode }}"
+  until: _db_cert_secret.resources | length > 0
-      tls.key: "{{ db_tls_key | b64encode }}"
+  retries: 60
-    state: present
+  delay: 10
-  when: db_tls_cert is defined and db_tls_key is defined
+  when: uyuni_create_certificates | bool
 
-- name: Create uyuni CA ConfigMap
+- name: Helm | Install or upgrade Uyuni from OCI registry
-  kubernetes.core.k8s:
+  ansible.builtin.command: >
-    api_version: v1
+    helm upgrade --install uyuni-server oci://registry.opensuse.org/uyuni/server-helm
-    kind: ConfigMap
+    --namespace {{ uyuni_namespace }}
-    metadata:
+    --create-namespace
-      name: uyuni-ca
+    --version {{ uyuni_chart_version }}
-      namespace: "{{ uyuni_namespace }}"
+    --set {{ item.key }}={{ item.value }}
-    data:
+    --timeout 20m0s
-      ca.crt: "{{ uyuni_ca_cert | string }}"
+    --wait
-    state: present
+  loop: "{{ uyuni_helm_values | dict2items }}"
-  when: uyuni_ca_cert is defined
+  environment:
+    KUBECONFIG: "{{ uyuni_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _helm_install
+  changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
+  when: uyuni_helm_values is defined
 
-- name: Create database CA ConfigMap
+- name: Helm | Install or upgrade Uyuni from OCI registry (no values)
-  kubernetes.core.k8s:
+  ansible.builtin.command: >
-    api_version: v1
+    helm upgrade --install uyuni-server oci://registry.opensuse.org/uyuni/server-helm
-    kind: ConfigMap
+    --namespace {{ uyuni_namespace }}
-    metadata:
+    --create-namespace
-      name: db-ca
+    --version {{ uyuni_chart_version }}
-      namespace: "{{ uyuni_namespace }}"
+    --timeout 20m0s
-    data:
+    --wait
-      ca.crt: "{{ db_ca_cert | string }}"
+  environment:
-    state: present
+    KUBECONFIG: "{{ uyuni_kubeconfig }}"
-  when: db_ca_cert is defined
+    PATH: "/usr/local/bin:/usr/bin:/bin"
-
+  register: _helm_install_simple
-- name: Include Helm installation
+  changed_when: "'STATUS: deployed' in _helm_install_simple.stdout or 'has been upgraded' in _helm_install_simple.stdout"
-  ansible.builtin.include_tasks: helm.yml
+  when: uyuni_helm_values is not defined
-  run_once: true