.werft/build: Issue certificates during preparation phase #9076
Conversation
ArthurSens
force-pushed
the
arthursens/preview-envs-on-harvester-8998
branch
from
764f761 to
e52e9b2
Compare
Signed-off-by: ArthurSens <arthursens2005@gmail.com>
ArthurSens
force-pushed
the
arthursens/preview-envs-on-harvester-8998
branch
from
e52e9b2 to
3486970
Compare
|
Currently struggling to issue certificates due to:
|
| for (const sd of params.additionalSubdomains) { | ||
| subdomains.push(sd); | ||
| } | ||
|
|
||
| try { | ||
| exec(`echo "Domain: ${params.domain}, Subdomains: ${subdomains}"`, {slice: shellOpts.slice}) |
There was a problem hiding this comment.
| exec(`echo "Domain: ${params.domain}, Subdomains: ${subdomains}"`, {slice: shellOpts.slice}) |
It sounds like the GCP service account used by CertManager does not have access to the domain preview.gitpod-dev.com |
Thanks Mo, do you know where I can change this configuration? I get kinda lost when navigating through DNS configuration in GCP 😅 |
|
@ArthurSens The cluster-issuer that manages |
Hmmmm I see... do you see a way to move forward? 🤔 |
Signed-off-by: ArthurSens <arthursens2005@gmail.com>
Signed-off-by: ArthurSens <arthursens2005@gmail.com>
|
Thanks for all the help, just tested and it worked for both core-dev and harvester previews :) Ready for a review round |
Signed-off-by: ArthurSens arthursens2005@gmail.com
Description
Moves the issuing of certificates to the
preparephase (before the containers' build). The certificate can be issued while build is still running and will be cached in core-dev'scertsnamespace.The cached certificate will be copied to the appropriate preview environment after it is ready to use.
Known problems (at the moment)
Certificates for both core-dev and harvester are sharing (and overriding) the same Certificate CR in core-dev. When transitioning from core-dev to harvester (or vice-versa) the preview domain changes and the certificate is not valid anymore.
I'll remove the draft after and finish making each preview type to have their own Certificate resource
Related Issue(s)
Fixes #8998
How to test
Release Notes