Migrate aggregated APIService TLS from hardcoded Secret to cert-manager

artifacts/apiservice.yaml

@@ -2,8 +2,10 @@ apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
   name: v1alpha1.config.sdcio.dev
+  annotations:
+    # let cert-manager fill in caBundle from the sdc-ca cert's secret
+    cert-manager.io/inject-ca-from: sdc-system/sdc-ca
 spec:
-  insecureSkipTLSVerify: true
   group: config.sdcio.dev
   groupPriorityMinimum: 1000
   versionPriority: 15
@@ -12,4 +14,3 @@ spec:
     namespace: sdc-system
     port: 6443
   version: v1alpha1
-  #caBundle: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURZekNDQWt1Z0F3SUJBZ0lKQUtKY0FOZ3htSG1TTUEwR0NTcUdTSWIzRFFFQkN3VUFNR1V4Q3pBSkJnTlYKQkFZVEFuVnVNUXN3Q1FZRFZRUUlEQUp6ZERFS01BZ0dBMVVFQnd3QmJERUtNQWdHQTFVRUNnd0JiekVMTUFrRwpBMVVFQ3d3Q2IzVXhKREFpQmdOVkJBTU1HMkpoYzJsakxXTmxjblJwWm1sallYUmxMV0YxZEdodmNtbDBlVEFlCkZ3MHlNakF6TXpFd09URTNOVE5hRncweU16QXpNekV3T1RFM05UTmFNR1V4Q3pBSkJnTlZCQVlUQW5WdU1Rc3cKQ1FZRFZRUUlEQUp6ZERFS01BZ0dBMVVFQnd3QmJERUtNQWdHQTFVRUNnd0JiekVMTUFrR0ExVUVDd3dDYjNVeApKREFpQmdOVkJBTU1HMkpoYzJsakxXTmxjblJwWm1sallYUmxMV0YxZEdodmNtbDBlVENDQVNJd0RRWUpLb1pJCmh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTUJwMHRhNU92Vy9VcVlsR1RMZnVsam9HYkFwVnB4MW1CbUwKR0dHOUhOZmJkVWxoQ1FtMVNYK3V6dllyQ05EZEJRMWdBYWVEa1lxOWNMbnN4YU92R25peHJ1WllUV1gyaU9maQpjRTZxRUVRTm05MmxRRnBvbnBneXI2dFc3dDhkMGRNcEVVNTlYUlQzdXRGZGhHRVJUYi94clR0c1RpaUp4Vk1jCmxFSzh3ajZjLytONitHNHZEcVBydkF5cFBJaUJtbkhwVE9tbmhOdjhSeXVXc3VXVEJwb0JTMUVjbTg1VlY3MEUKUGFpYSs3bDczLzArWmFzcTBHeklCdkx4S0ZiVHVYZHh2a0REY1M5c0FuTytVcHg1YUxhbjgrR25UTWd6NzR6Vgp3WDRuSFU1blFxYkZSSC9TQzVXeGNYczJXL0JNZllBRUk2ckhnUTBKNjJiMTBSZk0vQmNDQXdFQUFhTVdNQlF3CkVnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFxUXM5eUdsalBFcUgKVHF6REpEa29DbXlTWmQ0S3VVSEpPcjY1QmhmYmppKzBsSC9Rbk9mdHdpd1FvajhwSFlnejVmZGZJa3JMTFU1KwpwMzh0cSs5QllsOFNudXd6U2EzQ2VpYUlncHUvL05xaCtieDRad1liNFJmVnZmSU5NdUZJaUhLUFBJUm1QRmlECjZJQjl0WFNrSmNmanhHd1NLRmhLSGszYU9EbmsxNUlyTDA0U040S0ZER1dncnI0WkJoL1RYT25XVmRpMHRBN3kKT2lmRkpRdWt1anhNVDRUU3ZtcmtjZW5Ubk84VEZTMk03SGVPZDRLYm14QUJFR3ZzaGZ0V2tXUGh0ZW1IYVJXYwpVOEh2SG8xS1M4cGdyYVdxMU5jMjErdHJoQS9uaGRtaWRDbW1DOHZSQ1MwU1cxZE90Q3ZJRzhpVUpIeDVKMklGCnhjUGt3aHYrN1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="

artifacts/certificate-apiserver.yaml

@@ -0,0 +1,36 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: api-server-cert
+  namespace: sdc-system
+  labels:
+    app.kubernetes.io/name: sdc-api-server
+    sdcio.dev/config-server: "true"
+spec:
+  secretName: api-server-cert
+  secretTemplate:
+    labels:
+      app.kubernetes.io/name: sdc-api-server
+      sdcio.dev/config-server: "true"
+  duration: 8760h   # 1 year
+  renewBefore: 360h # 15 days
+  subject:
+    organizations:
+      - sdc
+  commonName: api-server.sdc-system.svc
+  dnsNames:
+    - api-server
+    - api-server.sdc-system
+    - api-server.sdc-system.svc
+    - api-server.sdc-system.svc.cluster.local
+  usages:
+    - server auth
+    - client auth
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+  issuerRef:
+    name: sdc-ca-issuer
+    kind: Issuer
+    group: cert-manager.io

artifacts/certificate-sdc-ca.yaml

@@ -0,0 +1,24 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: sdc-ca
+  namespace: sdc-system
+  labels:
+    app.kubernetes.io/name: sdc-ca
+    sdcio.dev/config-server: "true"
+spec:
+  isCA: true
+  commonName: sdc-ca
+  secretName: sdc-ca-secret
+  duration: 87600h   # 10 years
+  renewBefore: 720h  # 30 days
+  subject:
+    organizations:
+      - sdc
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-cluster-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

artifacts/certmanager/install.md

@@ -1 +1,33 @@
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml
+# cert-manager
+
+The config-server uses [cert-manager](https://cert-manager.io) to issue the
+TLS certificate served by the aggregated API server. Install cert-manager on
+the cluster before applying the SDC manifests.
+
+## Install cert-manager
+
+```bash
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml
+
+kubectl -n cert-manager rollout status deploy/cert-manager
+kubectl -n cert-manager rollout status deploy/cert-manager-cainjector
+kubectl -n cert-manager rollout status deploy/cert-manager-webhook
+```
+
+
+## Trust chain
+
+SDC ships an in-cluster PKI built on cert-manager's
+[self-signed bootstrapping pattern](https://cert-manager.io/docs/configuration/selfsigned/#bootstrapping-ca-issuers):
+
+- A cluster-scoped self-signed `ClusterIssuer` bootstraps the chain.
+- It signs the SDC root CA — an `isCA: true` `Certificate` (`sdc-ca`) stored
+  in the `sdc-ca-secret` Secret.
+- A namespaced `Issuer` (`sdc-ca-issuer`) consumes that secret to sign SDC
+  workload certificates, including the api-server's serving cert.
+- The aggregated `APIService` is annotated with
+  `cert-manager.io/inject-ca-from`. cert-manager's `cainjector` keeps its
+  `spec.caBundle` in sync with the SDC root CA, so kube-apiserver can
+  validate the aggregated API server when proxying requests to it.
+
+Renewals (both leaf and CA) are managed by cert-manager.

artifacts/certmanager/clusterissuer.yaml → artifacts/clusterissuer-selfsigned.yaml

@@ -3,4 +3,4 @@ kind: ClusterIssuer
 metadata:
   name: selfsigned-cluster-issuer
 spec:
-  selfSigned: {}
+  selfSigned: {}

artifacts/issuer-sdc-ca.yaml

@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: sdc-ca-issuer
+  namespace: sdc-system
+  labels:
+    app.kubernetes.io/name: sdc-ca-issuer
+    sdcio.dev/config-server: "true"
+spec:
+  ca:
+    secretName: sdc-ca-secret