USHIFT-6831: cert-manager Trust manager featuregate and test

assets/optional/cert-manager/manager/kustomization.yaml

@@ -4,6 +4,24 @@ resources:
   - manager.yaml
   - images.yaml
 
+patches:
+  - target:
+      kind: Deployment
+      name: controller-manager
+    patch: |-
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: controller-manager
+      spec:
+        template:
+          spec:
+            containers:
+            - name: cert-manager-operator
+              env:
+              - name: UNSUPPORTED_ADDON_FEATURES
+                value: TrustManager=true
+
 replacements:
   - source:
       kind: ConfigMap
@@ -55,6 +73,16 @@ replacements:
           name: controller-manager
         fieldPaths:
           - spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_ISTIOCSR].value
+  - source:
+      kind: ConfigMap
+      name: cert-manager-images
+      fieldPath: data.cert-manager-trust-manager
+    targets:
+      - select:
+          kind: Deployment
+          name: controller-manager
+        fieldPaths:
+          - spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER].value
   - source:
       kind: ConfigMap
       name: cert-manager-images

test/assets/cert-manager/ca-certificate.yaml.template

@@ -0,0 +1,13 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ca-certificate
+  namespace: ${TRUST_MANAGER_NS}
+spec:
+  isCA: true
+  commonName: test-ca.example.com
+  secretName: ca-certificate-secret
+  issuerRef:
+    name: ${ISSUER_NAME}
+    kind: ClusterIssuer

test/assets/cert-manager/certificate.yaml.template

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ${CERT_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  secretName: ${SECRET_NAME}
+  issuerRef:
+    name: ${ISSUER_NAME}
+    kind: ClusterIssuer
+  commonName: ${CERT_COMMON_NAME}
+  dnsNames:
+  - ${CERT_DNS_NAME}
+  - www.${CERT_DNS_NAME}

test/assets/cert-manager/cluster-issuer.yaml.template

@@ -0,0 +1,7 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ${ISSUER_NAME}
+spec:
+  selfSigned: {}

test/assets/cert-manager/http01-certificate.yaml.template

@@ -0,0 +1,19 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ${HTTP01_CERT_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  commonName: ${DNS_NAME}
+  dnsNames:
+  - ${DNS_NAME}
+  duration: 1h
+  issuerRef:
+    group: cert-manager.io
+    kind: Issuer
+    name: ${HTTP01_ISSUER_NAME}
+  renewBefore: 58m
+  secretName: ${HTTP01_SECRET_NAME}
+  usages:
+  - server auth

test/assets/cert-manager/http01-issuer.yaml.template

@@ -0,0 +1,16 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: ${HTTP01_ISSUER_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  acme:
+    server: "https://pebble.${NAMESPACE}.svc.cluster.local:14000/dir"
+    skipTLSVerify: true
+    privateKeySecretRef:
+      name: acme-account-key
+    solvers:
+    - http01:
+        ingress:
+          ingressClassName: openshift-ingress

test/assets/cert-manager/ingress-rbac.yaml.template

@@ -0,0 +1,25 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-reader
+  namespace: ${NAMESPACE}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["${SECRET_NAME}"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ingress-secret-reader
+  namespace: ${NAMESPACE}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: secret-reader
+subjects:
+- kind: ServiceAccount
+  name: router
+  namespace: openshift-ingress

test/assets/cert-manager/ingress-route.yaml.template

@@ -0,0 +1,16 @@
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: ${ROUTE_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  port:
+    targetPort: 8080
+  tls:
+    externalCertificate:
+      name: ${SECRET_NAME}
+    termination: edge
+  to:
+    kind: Service
+    name: hello-microshift

test/assets/cert-manager/trust-bundle-secret.yaml.template

@@ -0,0 +1,16 @@
+---
+apiVersion: trust.cert-manager.io/v1alpha1
+kind: Bundle
+metadata:
+  name: ${TRUST_MANAGER_BUNDLE_NAME}
+spec:
+  sources:
+    - secret:
+        name: ca-certificate-secret
+        key: tls.crt
+  target:
+    configMap:
+      key: ca-bundle.crt
+    namespaceSelector:
+      matchLabels:
+        kubernetes.io/metadata.name: ${NAMESPACE}

test/assets/cert-manager/trust-bundle-source-secret.yaml.template

@@ -0,0 +1,16 @@
+---
+apiVersion: trust.cert-manager.io/v1alpha1
+kind: Bundle
+metadata:
+  name: ${TRUST_MANAGER_BUNDLE_NAME}
+spec:
+  sources:
+    - secret:
+        name: ca-source-secret
+        key: tls.crt
+  target:
+    configMap:
+      key: ca-bundle.crt
+    namespaceSelector:
+      matchLabels:
+        kubernetes.io/metadata.name: ${NAMESPACE}

test/assets/cert-manager/trust-manager-cr.yaml

@@ -0,0 +1,6 @@
+apiVersion: operator.openshift.io/v1alpha1
+kind: TrustManager
+metadata:
+  name: cluster
+spec:
+  trustManagerConfig: {}

test/resources/common.resource

@@ -149,3 +149,10 @@ Remove Files
         ...    sudo=True    return_stdout=True    return_stderr=True    return_rc=True
         Should Be Equal As Integers    ${rc}    0
     END
+
+Generate File From Template
+    [Documentation]    Generate file from template
+    [Arguments]    ${template_file}    ${out_file}
+    ${template}=    OperatingSystem.Get File    ${template_file}
+    ${message}=    Replace Variables    ${template}
+    OperatingSystem.Create File    ${out_file}    ${message}