Skip to content

README.md

Latest commit

 

History

History
54 lines (42 loc) · 2.58 KB

README.md

File metadata and controls

54 lines (42 loc) · 2.58 KB
Raw

cert-manager-issuers

Self-signed root CA + ClusterIssuers for local Fleet TLS. Depends on jetstack/cert-manager being installed in the same cluster (the helmfile.yaml.gotmpl needs: clause enforces this).

Why

Fleet's UI bundle persists the auth token in a __Host-token cookie marked Secure. Browsers refuse to set __Host--prefixed and Secure cookies over plain HTTP — so without HTTPS, login succeeds at the API level but every follow-up request goes out as Authorization: Bearer null, 401s, and the UI bounces back to /login.

Let's Encrypt cannot reach a minikube cluster behind NAT (and nip.io hosts on private IPs aren't validatable anyway), so this chart sets up a single self-signed root CA that lives inside the cluster.

Chain

ClusterIssuer/fleet-selfsigned   (SelfSigned — bootstrap only)
        │
        └─► Certificate/fleet-root-ca         (isCA=true, 10y default, in cert-manager ns)
                │
                └─► ClusterIssuer/fleet-ca    (CA — issues every leaf cert in the cluster)

Anything annotated with cert-manager.io/cluster-issuer: fleet-ca (or referencing it via issuerRef) gets an auto-managed leaf cert. The cluster currently uses fleet-ca for:

  • Fleet ingress serving cert (Secret/fleet-tls in fleet)
  • ingress-nginx admission-webhook serving cert (Secret/ingress-nginx-admission in ingress-nginx)

Values

Key Default Description
certManagerNamespace cert-manager Namespace where the root CA Cert + Secret live
rootCA.secretName fleet-root-ca Name of the kubernetes.io/tls Secret holding the root CA
rootCA.commonName "Fleet Local Root CA" CN baked into the root cert (used by task fleet:trust-ca)
rootCA.duration 87600h (10 years) Root CA lifetime
rootCA.renewBefore 720h (30 days) cert-manager renews when this much time remains

Trust on the host

task fleet:trust-ca extracts the root cert from secret/fleet-root-ca and imports it into the host trust store (macOS System keychain or Linux /usr/local/share/ca-certificates/). The task is idempotent and short-circuits on CI=true, FLEET_SKIP_TRUST=1, or when the cert is already trusted.