From bac5a3da45ae1bdf3573a1a4bafc470f77fbc87f Mon Sep 17 00:00:00 2001 From: bjahagir-OpenShift Date: Wed, 22 Jul 2026 18:20:11 +0530 Subject: [PATCH] For OSDOCS-17173 - Cert Manager Operator CQA remediation --- modules/cert-manager-certificate-ingress.adoc | 1 - ...t-manager-common-configuration-fields.adoc | 45 ++++ modules/cert-manager-enable-metrics.adoc | 2 +- ...-explanation-of-certmanager-cr-fields.adoc | 197 ------------------ .../cert-manager-overridable-arguments.adoc | 89 ++++++++ ...ert-manager-overridable-env-variables.adoc | 29 +++ ...nager-overridable-resource-parameters.adoc | 32 +++ ...ger-overridable-scheduling-parameters.adoc | 26 +++ .../cert-manager-creating-certificate.adoc | 5 + .../cert-manager-customizing-api-fields.adoc | 16 ++ .../cert-manager-monitoring.adoc | 1 + 11 files changed, 244 insertions(+), 199 deletions(-) create mode 100644 modules/cert-manager-common-configuration-fields.adoc create mode 100644 modules/cert-manager-overridable-arguments.adoc create mode 100644 modules/cert-manager-overridable-env-variables.adoc create mode 100644 modules/cert-manager-overridable-resource-parameters.adoc create mode 100644 modules/cert-manager-overridable-scheduling-parameters.adoc diff --git a/modules/cert-manager-certificate-ingress.adoc b/modules/cert-manager-certificate-ingress.adoc index bac3f973ff02..066970fb3ba5 100644 --- a/modules/cert-manager-certificate-ingress.adoc +++ b/modules/cert-manager-certificate-ingress.adoc @@ -17,7 +17,6 @@ Before using the procedure, ensure you understand the following Ingress Controll * The secret name is referenced in the Ingress Controller configuration. If you want to replace the default ingress certificate or use different secret name in Ingress Controller configuration, you must patch or edit the configuration to apply the change. This operation triggers a rolling update for router pods where new router pods load the new cert/key pair. -For more information, see this link:https://access.redhat.com/solutions/4542531[Red{nbsp}Hat Knowledgebase Solution]. ==== .Prerequisites diff --git a/modules/cert-manager-common-configuration-fields.adoc b/modules/cert-manager-common-configuration-fields.adoc new file mode 100644 index 000000000000..641bfa77291c --- /dev/null +++ b/modules/cert-manager-common-configuration-fields.adoc @@ -0,0 +1,45 @@ +// Module included in the following assemblies: +// +// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc + +:_mod-docs-content-type: REFERENCE +[id="cert-manager-common-configuration-fields_{context}"] += Common configurable fields in the CertManager CR for the cert-manager components + +[role="_abstract"] +The following table lists the common fields that you can configure in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR. + +.Common configurable fields in the CertManager CR for the cert-manager components +[cols=".^2,.^2,.^6a",options="header"] +|==== + +|Field|Type|Description + +|`overrideArgs` +|`string` +|You can override the supported arguments for the cert-manager components. + +|`overrideEnv` +|`dict` +|You can override the supported environment variables for the cert-manager controller. This field is only supported for the cert-manager controller component. + +|`overrideReplicas` +|`int` +|You can configure the replicas for the cert-manager components. The default value is `1`. For production environments, the following replica counts are recommended: + +* controller: 2 + +* cainjector: 2 + +* webhook: At least 3. + + +|`overrideResources` +|`object` +|You can configure the CPU and memory limits for the cert-manager components. + +|`overrideScheduling` +|`object` +|You can configure the pod scheduling constraints for the cert-manager components. + +|==== diff --git a/modules/cert-manager-enable-metrics.adoc b/modules/cert-manager-enable-metrics.adoc index af33707c2770..99595eb47cf7 100644 --- a/modules/cert-manager-enable-metrics.adoc +++ b/modules/cert-manager-enable-metrics.adoc @@ -6,7 +6,7 @@ [id="cert-manager-enable-metrics_{context}"] = Configuring metrics collection for {cert-manager-operator} operands by using a ServiceMonitor -[role="_abstract"]] +[role="_abstract"] The {cert-manager-operator} operands expose metrics by default on port `9402` at the `/metrics` service endpoint. You can configure metrics collection for the cert-manager operands by creating a `ServiceMonitor` custom resource (CR) that enables Prometheus Operator to collect custom metrics. For more information, see "Configuring user workload monitoring". .Prerequisites diff --git a/modules/cert-manager-explanation-of-certmanager-cr-fields.adoc b/modules/cert-manager-explanation-of-certmanager-cr-fields.adoc index f842219d4268..656fd7f548cf 100644 --- a/modules/cert-manager-explanation-of-certmanager-cr-fields.adoc +++ b/modules/cert-manager-explanation-of-certmanager-cr-fields.adoc @@ -14,200 +14,3 @@ The core components of the {cert-manager-operator} are as follows: * Cert-manager controller: You can use the `spec.controllerConfig` field to configure the cert‑manager controller pod. * Webhook: You can use the `spec.webhookConfig` field to configure the webhook pod, which handles validation and mutation requests. * CA injector: You can use the `spec.cainjectorConfig` field to configure the CA injector pod. - -[id="cert-manager-common-configuration-fields_{context}"] -== Common configurable fields in the CertManager CR for the cert-manager components - -The following table lists the common fields that you can configure in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR. - -.Common configurable fields in the CertManager CR for the cert-manager components -[cols=".^2,.^2,.^6a",options="header"] -|==== - -|Field|Type|Description - -|`overrideArgs` -|`string` -|You can override the supported arguments for the cert-manager components. - -|`overrideEnv` -|`dict` -|You can override the supported environment variables for the cert-manager controller. This field is only supported for the cert-manager controller component. - -|`overrideReplicas` -|`int` -|You can configure the replicas for the cert-manager components. The default value is `1`. For production environments, the following replica counts are recommended: - -* controller: 2 - -* cainjector: 2 - -* webhook: At least 3. - -For more information, see link:https://cert-manager.io/docs/installation/best-practice/#high-availability[High Availability]. - -|`overrideResources` -|`object` -|You can configure the CPU and memory limits for the cert-manager components. - -|`overrideScheduling` -|`object` -|You can configure the pod scheduling constraints for the cert-manager components. - -|==== - -[id="cert-manager-overridable-arguments_{context}"] -== Overridable arguments for the cert-manager components - -You can configure the overridable arguments for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR. - -The following table describes the overridable arguments for the cert-manager components: - -.Overridable arguments for the cert-manager components -[cols=".^5a,.^2,.^4a",options="header"] -|==== - -|Argument|Component|Description - -|`--dns01-recursive-nameservers=` -|Controller -|Provide a comma-separated list of nameservers to query for the DNS-01 self check. The nameservers can be specified either as `:`, for example, `1.1.1.1:53`, or use DNS over HTTPS (DoH), for example, `\https://1.1.1.1/dns-query`. - -[NOTE] -==== -DNS over HTTPS (DoH) is supported starting only from {cert-manager-operator} version 1.13.0 and later. -==== - -|`--dns01-recursive-nameservers-only` -|Controller -|Specify to only use recursive nameservers instead of checking the authoritative nameservers associated with that domain. - -|`--acme-http01-solver-nameservers=:` -|Controller -|Provide a comma-separated list of `:` nameservers to query for the Automated Certificate Management Environment (ACME) HTTP01 self check. For example, `--acme-http01-solver-nameservers=1.1.1.1:53`. - -|`--metrics-listen-address=:` -|Controller -|Specify the host and port for the metrics endpoint. The default value is `--metrics-listen-address=0.0.0.0:9402`. - -|`--issuer-ambient-credentials` -|Controller -|You can use this argument to configure an ACME Issuer to solve DNS-01 challenges by using ambient credentials. - -|`--enable-certificate-owner-ref` -|Controller -|This argument sets the certificate resource as an owner of the secret where the TLS certificate is stored. For more information, see "Deleting a TLS secret automatically upon Certificate removal". - -|`--acme-http01-solver-resource-limits-cpu` -|Controller -|Defines the maximum CPU limit for ACME HTTP‑01 solver pods. The default value is `100m`. - -|`--acme-http01-solver-resource-limits-memory` -|Controller -|Defines the maximum memory limit for ACME HTTP‑01 solver pods. The default value is `64Mi`. - -|`--acme-http01-solver-resource-request-cpu` -|Controller -|Defines the minimum CPU request for ACME HTTP‑01 solver pods. The default value is `10m`. - -|`--acme-http01-solver-resource-request-memory` -|Controller -|Defines the minimum memory request for ACME HTTP‑01 solver pods. The default value is `64Mi`. - -|`--certificate-request-minimum-backoff-duration` -|Controller -|Specify the minimum backoff duration for certificate requests. The default value is `1h0m0s`. - -|`--concurrent-workers` -|Controller -|The number of concurrent workers for each controller. The default value is `5`. - -|`--kube-api-qps` -|Controller -|The maximum number of queries per second sent to the Kubernetes API server. The default value is `20`. - -|`--kube-api-burst` -|Controller -|The maximum burst of queries per second sent to the Kubernetes API server. Must be greater than or equal to `--kube-api-qps`. The default value is `50`. - -|`--max-concurrent-challenges` -|Controller -|The maximum number of ACME challenges that can run concurrently. The default value is `60`. - -|`--v=` -|Controller, Webhook, CA injector -|Specify the log level verbosity to determine the verbosity of log messages. - -|==== - -[id="cert-manager-overridable-env-variables_{context}"] -== Overridable environment variables for the cert-manager controller - -You can configure the overridable environment variables for the cert-manager controller in the `spec.controllerConfig.overrideEnv` field in the `CertManager` CR. - -The following table describes the overridable environment variables for the cert-manager controller: - -.Overridable environment variables for the cert-manager controller -[cols=".^2,.^2",options="header"] -|==== - -|Environment variable|Description - -|`HTTP_PROXY` -|Proxy server for outgoing HTTP requests. - -|`HTTPS_PROXY` -|Proxy server for outgoing HTTPS requests. - -|`NO_PROXY` -|Comma‑separated list of hosts that bypass the proxy. - -|==== - -[id="cert-manager-overridable-resource-parameters_{context}"] -== Overridable resource parameters for the cert-manager components - -You can configure the CPU and memory limits for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR. - -The following table describes the overridable resource parameters for the cert-manager components: - -.Overridable resource parameters for the cert-manager components -[cols=".^2,.^2",options="header"] -|==== - -|Field|Description - -|`overrideResources.limits.cpu` -|Defines the maximum amount of CPU that a component pod can use. - -|`overrideResources.limits.memory` -|Defines the maximum amount of memory that a component pod can use. - -|`overrideResources.requests.cpu` -|Defines the minimum amount of CPU requested by the scheduler for a component pod. - -|`overrideResources.requests.memory` -|Defines the minimum amount of memory requested by the scheduler for a component pod. - -|==== - -[id="cert-manager-overridable-scheduling-parameters_{context}"] -== Overridable scheduling parameters for the cert-manager components - -You can configure the pod scheduling constraints for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig` field, and `spec.cainjectorConfig` sections in the `CertManager` CR. - -The following table describes the pod scheduling parameters for the cert-manager components: - -.Overridable scheduling parameters for the cert-manager components -[cols=".^2,.^2",options="header"] -|==== - -|Field|Description - -|`overrideScheduling.nodeSelector` -|Key‑value pairs to constrain pods to specific nodes. - -|`overrideScheduling.tolerations` -|List of tolerations to schedule pods on tainted nodes. - -|==== diff --git a/modules/cert-manager-overridable-arguments.adoc b/modules/cert-manager-overridable-arguments.adoc new file mode 100644 index 000000000000..0178eeecf546 --- /dev/null +++ b/modules/cert-manager-overridable-arguments.adoc @@ -0,0 +1,89 @@ +// Module included in the following assemblies: +// +// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc + +:_mod-docs-content-type: REFERENCE +[id="cert-manager-overridable-arguments_{context}"] += Overridable arguments for the cert-manager components + +[role="_abstract"] +You can configure the overridable arguments for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR to customize the cert-manager controller, webhook, and cainjector components. + +The following table describes the overridable arguments for the cert-manager components: + +.Overridable arguments for the cert-manager components +[cols=".^5a,.^2,.^4a",options="header"] +|==== + +|Argument|Component|Description + +|`--dns01-recursive-nameservers=` +|Controller +|Provide a comma-separated list of nameservers to query for the DNS-01 self check. The nameservers can be specified either as `:`, for example, `1.1.1.1:53`, or use DNS over HTTPS (DoH), for example, `\https://1.1.1.1/dns-query`. + +[NOTE] +==== +DNS over HTTPS (DoH) is supported starting only from {cert-manager-operator} version 1.13.0 and later. +==== + +|`--dns01-recursive-nameservers-only` +|Controller +|Specify to only use recursive nameservers instead of checking the authoritative nameservers associated with that domain. + +|`--acme-http01-solver-nameservers=:` +|Controller +|Provide a comma-separated list of `:` nameservers to query for the Automated Certificate Management Environment (ACME) HTTP01 self check. For example, `--acme-http01-solver-nameservers=1.1.1.1:53`. + +|`--metrics-listen-address=:` +|Controller +|Specify the host and port for the metrics endpoint. The default value is `--metrics-listen-address=0.0.0.0:9402`. + +|`--issuer-ambient-credentials` +|Controller +|You can use this argument to configure an ACME Issuer to solve DNS-01 challenges by using ambient credentials. + +|`--enable-certificate-owner-ref` +|Controller +|This argument sets the certificate resource as an owner of the secret where the TLS certificate is stored. For more information, see "Deleting a TLS secret automatically upon Certificate removal". + +|`--acme-http01-solver-resource-limits-cpu` +|Controller +|Defines the maximum CPU limit for ACME HTTP‑01 solver pods. The default value is `100m`. + +|`--acme-http01-solver-resource-limits-memory` +|Controller +|Defines the maximum memory limit for ACME HTTP‑01 solver pods. The default value is `64Mi`. + +|`--acme-http01-solver-resource-request-cpu` +|Controller +|Defines the minimum CPU request for ACME HTTP‑01 solver pods. The default value is `10m`. + +|`--acme-http01-solver-resource-request-memory` +|Controller +|Defines the minimum memory request for ACME HTTP‑01 solver pods. The default value is `64Mi`. + +|`--certificate-request-minimum-backoff-duration` +|Controller +|Specify the minimum backoff duration for certificate requests. The default value is `1h0m0s`. + +|`--concurrent-workers` +|Controller +|The number of concurrent workers for each controller. The default value is `5`. + +|`--kube-api-qps` +|Controller +|The maximum number of queries per second sent to the Kubernetes API server. The default value is `20`. + +|`--kube-api-burst` +|Controller +|The maximum burst of queries per second sent to the Kubernetes API server. Must be greater than or equal to `--kube-api-qps`. The default value is `50`. + +|`--max-concurrent-challenges` +|Controller +|The maximum number of ACME challenges that can run concurrently. The default value is `60`. + +|`--v=` +|Controller, Webhook, CA injector +|Specify the log level verbosity to determine the verbosity of log messages. + +|==== \ No newline at end of file diff --git a/modules/cert-manager-overridable-env-variables.adoc b/modules/cert-manager-overridable-env-variables.adoc new file mode 100644 index 000000000000..2e1d5da450ea --- /dev/null +++ b/modules/cert-manager-overridable-env-variables.adoc @@ -0,0 +1,29 @@ +// Module included in the following assemblies: +// +// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc + +:_mod-docs-content-type: REFERENCE +[id="cert-manager-overridable-env-variables_{context}"] += Overridable environment variables for the cert-manager controller + +[role="_abstract"] +You can configure the overridable environment variables for the cert-manager controller in the `spec.controllerConfig.overrideEnv` field in the `CertManager` CR. + +The following table describes the overridable environment variables for the cert-manager controller: + +.Overridable environment variables for the cert-manager controller +[cols=".^2,.^2",options="header"] +|==== + +|Environment variable|Description + +|`HTTP_PROXY` +|Proxy server for outgoing HTTP requests. + +|`HTTPS_PROXY` +|Proxy server for outgoing HTTPS requests. + +|`NO_PROXY` +|Comma‑separated list of hosts that bypass the proxy. + +|==== diff --git a/modules/cert-manager-overridable-resource-parameters.adoc b/modules/cert-manager-overridable-resource-parameters.adoc new file mode 100644 index 000000000000..8943cadc5c3b --- /dev/null +++ b/modules/cert-manager-overridable-resource-parameters.adoc @@ -0,0 +1,32 @@ +// Module included in the following assemblies: +// +// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc + +:_mod-docs-content-type: REFERENCE +[id="cert-manager-overridable-resource-parameters_{context}"] += Overridable resource parameters for the cert-manager components + +[role="_abstract"] +You can configure the CPU and memory limits for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig`, and `spec.cainjectorConfig` sections in the `CertManager` CR. + +The following table describes the overridable resource parameters for the cert-manager components: + +.Overridable resource parameters for the cert-manager components +[cols=".^2,.^2",options="header"] +|==== + +|Field|Description + +|`overrideResources.limits.cpu` +|Defines the maximum amount of CPU that a component pod can use. + +|`overrideResources.limits.memory` +|Defines the maximum amount of memory that a component pod can use. + +|`overrideResources.requests.cpu` +|Defines the minimum amount of CPU requested by the scheduler for a component pod. + +|`overrideResources.requests.memory` +|Defines the minimum amount of memory requested by the scheduler for a component pod. + +|==== \ No newline at end of file diff --git a/modules/cert-manager-overridable-scheduling-parameters.adoc b/modules/cert-manager-overridable-scheduling-parameters.adoc new file mode 100644 index 000000000000..ad1cbf62b058 --- /dev/null +++ b/modules/cert-manager-overridable-scheduling-parameters.adoc @@ -0,0 +1,26 @@ +// Module included in the following assemblies: +// +// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc + +:_mod-docs-content-type: REFERENCE +[id="cert-manager-overridable-scheduling-parameters_{context}"] += Overridable scheduling parameters for the cert-manager components + +[role="_abstract"] +You can configure the pod scheduling constraints for the cert-manager components in the `spec.controllerConfig`, `spec.webhookConfig` field, and `spec.cainjectorConfig` sections in the `CertManager` CR. + +The following table describes the pod scheduling parameters for the cert-manager components: + +.Overridable scheduling parameters for the cert-manager components +[cols=".^2,.^2",options="header"] +|==== + +|Field|Description + +|`overrideScheduling.nodeSelector` +|Key and value pairs to constrain pods to specific nodes. + +|`overrideScheduling.tolerations` +|List of tolerations to schedule pods on tainted nodes. + +|==== diff --git a/security/cert_manager_operator/cert-manager-creating-certificate.adoc b/security/cert_manager_operator/cert-manager-creating-certificate.adoc index 594a000d02ac..56fd433c4f7d 100644 --- a/security/cert_manager_operator/cert-manager-creating-certificate.adoc +++ b/security/cert_manager_operator/cert-manager-creating-certificate.adoc @@ -15,6 +15,11 @@ include::modules/cert-manager-certificate-api-server.adoc[leveloffset=+1] include::modules/cert-manager-certificate-ingress.adoc[leveloffset=+1] +[role="_additional-resources"] +.Additional resources + +* link:https://access.redhat.com/solutions/4542531[Red{nbsp}Hat Knowledgebase Solution]. + [role="_additional-resources"] [id="additional-resources_cert-manager-creating-certificate"] == Additional resources diff --git a/security/cert_manager_operator/cert-manager-customizing-api-fields.adoc b/security/cert_manager_operator/cert-manager-customizing-api-fields.adoc index bdc21307d319..da6d41217247 100644 --- a/security/cert_manager_operator/cert-manager-customizing-api-fields.adoc +++ b/security/cert_manager_operator/cert-manager-customizing-api-fields.adoc @@ -80,6 +80,22 @@ include::modules/cert-manager-explanation-of-certmanager-cr-fields.adoc[leveloff * xref:../../security/cert_manager_operator/cert-manager-customizing-api-fields.adoc#cert-manager-override-flag-controller_cert-manager-customizing-api-fields[Deleting a TLS secret automatically upon Certificate removal] +include::modules/cert-manager-common-configuration-fields.adoc[leveloffset=+2] + +[role="_additional-resources"] +.Additional resources + +* link:https://cert-manager.io/docs/installation/best-practice/#high-availability[High Availability] + +include::modules/cert-manager-overridable-arguments.adoc[leveloffset=+2] + +include::modules/cert-manager-overridable-env-variables.adoc[leveloffset=+2] + +include::modules/cert-manager-overridable-resource-parameters.adoc[leveloffset=+2] + +include::modules/cert-manager-overridable-scheduling-parameters.adoc[leveloffset=+2] + + include::modules/cert-manager-override-environment-variables.adoc[leveloffset=+1] [role="_additional-resources"] diff --git a/security/cert_manager_operator/cert-manager-monitoring.adoc b/security/cert_manager_operator/cert-manager-monitoring.adoc index d35bd6ee6d07..79f146a32185 100644 --- a/security/cert_manager_operator/cert-manager-monitoring.adoc +++ b/security/cert_manager_operator/cert-manager-monitoring.adoc @@ -14,6 +14,7 @@ include::modules/cert-manager-enable-user-workload-monitor.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources + * link:https://docs.redhat.com/en/documentation/monitoring_stack_for_red_hat_openshift/latest/html/configuring_user_workload_monitoring/configuring-metrics-uwm#setting-up-metrics-collection-for-user-defined-projects_configuring-metrics-uwm[Setting up metrics collection for user-defined projects] // Metrics scraping for cert-manager operands by using a ServiceMonitor