Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-8450

cert-manager support for Gateway API

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • cert-manager
    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Gateway API support is GA since OCP 4.19. Users of the Gateway API will need a way to obtain certificates for gateway listeners. Upstream cert-manager has (beta) support for Gateway API since version 1.15: https://cert-manager.io/docs/usage/gateway/

      Note that this integration is not only for convenience (automated creation of Certificate based on Gateway definition) but is needed in order to be able to use cert-manager to obtain Gateway listener certs via the HTTP01 challenge (the Ingress HTTP01 solver won't work for a Gateway cert, as the Gateway takes over the DNS name over Ingress). See https://letsencrypt.org/docs/challenge-types/#dns-01-challenge for details.

      The flag to enable gateway api support in downstream cert-manager build is currently not supported: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift#cert-manager-overridable-arguments_cert-manager-customizing-api-fields

      and the only option is to go the unsupported path:

        unsupportedConfigOverrides:
          controller:
            args:
            - --enable-gateway-api
      

              rh-ee-npng Nick Png
              rhn-engineering-jharting Jozef Hartinger
              None
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                None
                None