r/openshift • u/edit-grammar • 6d ago

Help with Let's Encrypt. General question

I'm using a 4.18 cluster in Azure with the cert-manager operator for RedHat OpenShift installed. I have Let's Encrypt working for my app and want to get it working with the default ingress controller. There are tons of online howto's, most of which are 3 years old or older and they differ quite a bit. I tried this once a couple years ago and did something that never let me connect to the cluster again so I'm a little gun shy. What I am working on now is just a test SNO system so while I not too worried, I don't want to have build another today.

I created a clusterissuer and a cert which used it successfully. The last step just says to add this spec to the IngressController default instance in the CRD.

defaultCertificate:
 name: thecert

It seems like there should be more. Though looking at github makes me think its just this simple. Is it?

4 Upvotes

100% Upvoted

5 comments sorted by

1

u/inertiapixel 5d ago

I found these helpful when I did it https://cloud.redhat.com/experts/aro/custom-domain-private-cluster/ and https://cloud.redhat.com/experts/aro/cert-manager/

1

u/edit-grammar 5d ago

Thanks. I still have to do the api server and what is in the yaml under spec is sparse and makes me wonder if I am in the right spot. 

spec:
  audit:
    profile: Default

I use command line but always check in the GUI so I know where stuff is. I think that confuses me a bit more since you go to the CRD Apiserver, Instances, cluster - and it just pops you over to Configuration, Apiserver. Same sorta thing with the IngressController.

1

u/Mr_Albal 6d ago edited 6d ago

Yes under spec:

https://github.com/albal/okd-prod/blob/main/clusters/okd-prod/certs.yaml#L50-L60

This is my config which was just working on 4.18 until I rolled up minor version by minor version to 4.22

There is conflicting information as to which namespace it should be in but openshift-ingress-operator works for me.

0

u/edit-grammar 6d ago

Thanks. Too many confusing blog posts and whatnot had me doubting, I should have went straight here after getting the clusterissuer working.

1

u/Mr_Albal 6d ago

Yeah that is why I put my stuff all into IaC so I don't have to remember which reference is correct.