Chapter 3. Custom issuers for cert-manager

Procedure

1. Create a custom issuer in a file named rootca-custom.yaml:

   apiVersion: cert-manager.io/v1
   kind: Issuer
   metadata:
     name: <issuer_name>
   spec:
     ca:
       secretName: <secret_name>

   where:

   <issuer_name>

   Specifies the name of your custom issuer, for example, rootca-ingress-custom.

   <secret_name>

   Specifies the name of the Secret CR used by the certificate for your custom issuer. If you do not include a secret, one is created automatically.

2. Create a certificate in a file named ca-issuer-certificate.yaml:

   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: <issuer_name>
   spec:
     commonName: <issuer_name>
     isCA: true
     duration: <hours>
     privateKey:
       algorithm: RSA
       size: 3072
     issuerRef:
       name: selfsigned-issuer
       kind: Issuer
     secretName: <secret-name>

   where:

   <issuer_name>

   Specifies the name of your custom issuer. This matches the issuer created in the first step.

   <hours>

   Specifies the duration in hours, for example, a value of 87600h is equivalent to 3650 days, or about 10 years.

   <secret_name>

   Specifies the name of the Secret CR used by the certificate for your custom issuer. If you do not include a secret, one is created automatically.

3. Create the issuer and certificate:

   $ oc create -f rootca-custom.yaml
   $ oc create -f ca-issuer-certificate.yaml

4. Add the custom issuer to the TLS service definition in the control plane CR file.

   1. If your custom issuer is an ingress issuer, the customer issuer is defined under the ingress attribute as shown below:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: openstack-control-plane
      spec:
        tls:
           ingress:
             enabled: true
             ca:
               customIssuer: <issuer_name>
         ...

      where:

      <issuer_name>

      Specifies the name of your custom issuer. This matches the issuer created in the first step.

   2. If your custom issuer is an internal issuer, the custom issuer is defined at the pod level under the internal attribute as shown below:

      apiVersion: core.openstack.org/v1beta1
      kind: OpenStackControlPlane
      metadata:
        name: myctlplane
      spec:
        tls:
           ingress:
             enabled: true
           podLevel:
             enabled: true
             internal:
               ca:
                 customIssuer: <issuer_name>

      where:

      <issuer_name>

      Specifies the name of your custom issuer. This matches the issuer created in the first step.