Skip to content

Commit b8ebea9

Browse files
yolossnyolossn
committed
cert-manager: Add cert-manager plugin
Signed-off-by: yolossn <sannagaraj@microsoft.com>
1 parent c677ea6 commit b8ebea9

31 files changed

+34857
-0
lines changed

‎cert-manager/.gitignore

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Dependencies
2+
node_modules/
3+
npm-debug.log
4+
yarn-debug.log
5+
yarn-error.log
6+
.pnpm-debug.log
7+
8+
# Build outputs
9+
dist/
10+
build/
11+
lib/
12+
coverage/
13+
14+
# Environment and config
15+
.env
16+
.env.local
17+
.env.*.local
18+
19+
# IDE and editor files
20+
.idea/
21+
.vscode/
22+
*.swp
23+
*.swo
24+
.DS_Store
25+
26+
# Cache and temporary files
27+
.npm
28+
.eslintcache
29+
.tsbuildinfo
30+
.DS_Store

‎cert-manager/README.md

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
# cert-manager
2+
3+
Cert-manager plugin for Headlamp.
4+
5+
This is the default template README for [Headlamp Plugins](https://github.com/headlamp-k8s/headlamp).
6+
7+
- The description of your plugin should go here.
8+
- You should also edit the package.json file meta data (like name and description).
9+
10+
## Developing Headlamp plugins
11+
12+
For more information on developing Headlamp plugins, please refer to:
13+
14+
- [Getting Started](https://headlamp.dev/docs/latest/development/plugins/), How to create a new Headlamp plugin.
15+
- [API Reference](https://headlamp.dev/docs/latest/development/api/), API documentation for what you can do
16+
- [UI Component Storybook](https://headlamp.dev/docs/latest/development/frontend/#storybook), pre-existing components you can use when creating your plugin.
17+
- [Plugin Examples](https://github.com/headlamp-k8s/headlamp/tree/main/plugins/examples), Example plugins you can look at to see how it's done.
18+
19+
## Cert-manager CRDs:
20+
21+
- certificates.cert-manager.io
22+
- certificaterequests.cert-manager.io
23+
- orders.acme.cert-manager.io
24+
- challenges.acme.cert-manager.io
25+
- clusterissuers.cert-manager.io
26+
- issuers.cert-manager.io
27+
- clusterissuers.cert-manager.io
28+
29+
## Lifecycle:
30+
31+
Certificate -> CertificateRequest -> Order -> Challenge -> Secret
32+
33+
1. **Certificate** (Starting Point)
34+
35+
- This is the main custom resource the user creates
36+
- It defines what the user wants: domain names, which issuer to use, and where to store the resulting certificate
37+
- States: Pending → Ready or Failed
38+
39+
2. **CertificateRequest**
40+
41+
- Created automatically by the Certificate controller
42+
- Contains the Certificate Signing Request (CSR) and issuer reference
43+
- Acts as a one-time request for a certificate
44+
- States: Pending → Ready or Failed
45+
46+
3. **Order** (ACME specific)
47+
48+
- Generated by the CertificateRequest when using ACME issuers (like Let's Encrypt)
49+
- Manages the domain validation process
50+
- States: Pending → Processing → Valid/Invalid → Ready
51+
52+
4. **Challenge** (ACME specific)
53+
54+
- Created by the Order resource
55+
- Proves domain ownership to the ACME server
56+
- Two main types:
57+
- HTTP01: Places a file on the web server
58+
- DNS01: Creates a TXT record in the DNS
59+
- States: Pending → Present → Valid/Invalid
60+
61+
5. **Secret**
62+
- Final output containing:
63+
- The private key
64+
- The signed certificate
65+
- The CA certificate chain
66+
- Created/updated once the Challenge is successful
67+
68+
The flow works like this:
69+
70+
1. The user creates a Certificate resource
71+
2. Cert-manager creates a CertificateRequest
72+
3. For ACME issuers, an Order is created
73+
4. The Order creates one or more Challenges
74+
5. Once Challenges are validated, the certificate is issued
75+
6. The certificate is stored in a Kubernetes Secret
76+
77+
This process is automated and will repeat when the certificate needs renewal (typically around 30 days before expiration).
78+
79+
State diagram
80+
81+
```mermaid
82+
graph TD
83+
Start((●)) --> Cert[Certificate]
84+
85+
%% Content and states for Certificate
86+
CertNote["Defines desired state:
87+
- Domain names
88+
- Issuer reference
89+
- Secret name
90+
91+
States:
92+
- Pending
93+
- Ready
94+
- Failed"]
95+
Cert --- CertNote
96+
97+
%% Main flow with feedback
98+
Cert -->|creates| CR[CertificateRequest]
99+
CR -->|updates status| Cert
100+
Cert -->|creates| Secret[Secret]
101+
102+
%% Content and states for CertificateRequest
103+
CRNote["Contains:
104+
- CSR
105+
- Issuer ref
106+
107+
States:
108+
- Pending
109+
- Ready
110+
- Failed"]
111+
CR --- CRNote
112+
113+
%% Order and Challenge flow
114+
CR -->|generates| Order[Order]
115+
Order -->|updates status| CR
116+
117+
%% Content and states for Order
118+
OrderNote["Purpose:
119+
- Domain validation
120+
- Certificate retrieval
121+
122+
States:
123+
- Pending
124+
- Valid
125+
- Invalid
126+
- Processing
127+
- Ready"]
128+
Order --- OrderNote
129+
130+
Order -->|creates| Challenge[Challenge]
131+
Challenge -->|updates status| Order
132+
133+
%% Content and states for Challenge
134+
ChallengeNote["Purpose:
135+
- Domain ownership proof
136+
- HTTP01/DNS01
137+
138+
States:
139+
- Pending
140+
- Present
141+
- Valid
142+
- Invalid"]
143+
Challenge --- ChallengeNote
144+
145+
%% Content for Secret
146+
SecretNote["Contains:
147+
- TLS private key
148+
- Signed certificate
149+
- CA chain
150+
151+
States:
152+
- Present/Absent"]
153+
Secret --- SecretNote
154+
155+
%% Styling
156+
style Start fill:#666,stroke:#666
157+
style Cert fill:#333,stroke:#666,color:#fff
158+
style CR fill:#333,stroke:#666,color:#fff
159+
style Order fill:#333,stroke:#666,color:#fff
160+
style Challenge fill:#333,stroke:#666,color:#fff
161+
style Secret fill:#333,stroke:#666,color:#fff
162+
163+
%% Note styling
164+
style CertNote fill:#ffffd0,stroke:#bbb
165+
style CRNote fill:#ffffd0,stroke:#bbb
166+
style OrderNote fill:#ffffd0,stroke:#bbb
167+
style ChallengeNote fill:#ffffd0,stroke:#bbb
168+
style SecretNote fill:#ffffd0,stroke:#bbb
169+
170+
```

0 commit comments

Comments
 (0)