Support Let's Encrypt certs (post-install)

[redhatgov]

Support Let's Encrypt certs (post-install)

[liveaverage]

I think this just requires a quick documentation note... we'll leave this out of terraform deployment and have a "Next Steps" or "What's next" section in the readme to focus on:

• Let's Encrypt certs
• CNV
• etc.

Currently testing with:

# Assumes TF_VAR_cluster_name, TF_VAR_* has been set


export CF_Key=$TF_VAR_cf_api_key
export CF_Email=$TF_VAR_cf_email

curl https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh | bash -s -- --issue --dns dns_cf -d "api.${TF_VAR_cluster_name}.${TF_VAR_cluster_basedomain}" -d "*.apps.${TF_VAR_cluster_name}.${TF_VAR_cluster_basedomain}"

EDIT:

Not sure why, but I could not get this to work without installing acme.sh ... I inevitably "installed" it via:

curl https://get.acme.sh | sh

and then executed the following to issue my cert:

/root/.acme.sh/acme.sh --issue --debug 2 --dns dns_cf -d "shifti.us" -d "api.${TF_VAR_cluster_name}.${TF_VAR_cluster_basedomain}" -d "*.apps.${TF_VAR_cluster_name}.${TF_VAR_cluster_basedomain}" --log

Which worked fine:

[Mon Jun  1 21:10:02 EDT 2020] Your cert is in  /root/.acme.sh/shifti.us/shifti.us.cer 
[Mon Jun  1 21:10:02 EDT 2020] Your cert key is in  /root/.acme.sh/shifti.us/shifti.us.key 
[Mon Jun  1 21:10:02 EDT 2020] v2 chain.
[Mon Jun  1 21:10:02 EDT 2020] The intermediate CA cert is in  /root/.acme.sh/shifti.us/ca.cer 
[Mon Jun  1 21:10:02 EDT 2020] And the full chain certs is there:  /root/.acme.sh/shifti.us/fullchain.cer 

Snippet to update ingress controller/router cert still to come.

[liveaverage]

The original article decoupled this better from TF_VARs that might be set. So the TL;DR version:

export KUBECONFIG="<output from tf>" 

export CF_Key=$TF_VAR_cf_api_key
export CF_Email=$TF_VAR_cf_email

export LE_API=$(oc whoami --show-server | cut -f 2 -d ':' | cut -f 3 -d '/' | sed 's/-api././')
export LE_WILDCARD=$(oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.status.domain}')
export CERTDIR=$HOME/certificates

# Install acme.sh
curl https://get.acme.sh | sh

# Request certificate with dns_cf
$HOME/.acme.sh/acme.sh --issue -d ${LE_API} -d *.${LE_WILDCARD} --dns dns_cf

# Install certificate
mkdir -p ${CERTDIR}
$HOME/.acme.sh/acme.sh --install-cert -d ${LE_API} -d *.${LE_WILDCARD} --cert-file ${CERTDIR}/cert.pem --key-file ${CERTDIR}/key.pem --fullchain-file ${CERTDIR}/fullchain.pem --ca-file ${CERTDIR}/ca.cer

# Create router-certs secret and update ingresscontroller to use new cert(s)
oc create secret tls router-certs --cert=${CERTDIR}/fullchain.pem --key=${CERTDIR}/key.pem -n openshift-ingress
oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" }}}'