1e0a190aa6
Story: 2009836 Task: 45655 Signed-off-by: Elisamara Aoki Goncalves <elisamaraaoki.goncalves@windriver.com> Change-Id: I93eb5e8e873c29d01d5311a45c252d481c306243
84 lines
2.7 KiB
ReStructuredText
84 lines
2.7 KiB
ReStructuredText
|
|
.. gks1588335341933
|
|
.. _the-cert-manager-bootstrap-process:
|
|
|
|
===================================
|
|
Configure cert-manager at Bootstrap
|
|
===================================
|
|
|
|
Both ``nginx-ingress-controller`` and ``cert-manager`` are packaged as |prod|
|
|
system applications. They are uploaded and applied, by default at bootstrap
|
|
time with defaults appropriate to most use cases, but their configuration can
|
|
be modified at bootstrap.
|
|
|
|
To override the default configuration add an applications section in
|
|
``$HOME/localhost.yml``, as shown below:
|
|
|
|
.. code-block:: none
|
|
|
|
applications:
|
|
- usr/local/share/applications/helm/nginx-ingress-controller-{version}.tgz:
|
|
overrides:
|
|
- chart: appOne-ChartOne
|
|
namespace: kube-system
|
|
values-path: /home/sysinv/appOne-ChartOne-overrides.yaml
|
|
- chart: appOne-ChartTwo
|
|
namespace: kube-system
|
|
values-path: /home/sysinv/appOne-ChartTwo-overrides.yaml
|
|
- /usr/local/share/applications/helm/cert-manager-{version}.tgz:
|
|
overrides:
|
|
- chart: appTwo-ChartOne
|
|
namespace: kube-system
|
|
values-path: /home/sysinv/appTwo-ChartOne-overrides.yaml
|
|
|
|
.. note::
|
|
|
|
Semantically, ``nginx-ingress-controller`` and ``cert-manager`` are
|
|
mandatory and must be in this order, otherwise bootstrap fails.
|
|
|
|
At a high-level, the default configuration for the two mandatory applications is:
|
|
|
|
|
|
.. _the-cert-manager-bootstrap-process-ul-dxm-q2v-nlb:
|
|
|
|
- ``nginx-ingress-controller``
|
|
|
|
|
|
- Runs as a DaemonSet only on controllers.
|
|
|
|
- Uses host networking, which means it can use any port numbers.
|
|
|
|
- Does not change the nginx default ports of 80 and 443.
|
|
|
|
- Has a default backend.
|
|
|
|
|
|
- ``cert-manager``
|
|
|
|
|
|
- Runs as a Deployment only on controllers.
|
|
|
|
- Runs with a podAntiAffinity rule to prevent multiple pods of
|
|
deployment from running on the same node.
|
|
|
|
- The deployment replicaCount is set to 1 for bootstrap.
|
|
|
|
.. note::
|
|
|
|
replicaCount can NOT be changed at bootstrap time. The second controller
|
|
must be configured and unlocked before replicaCount can be set to 2.
|
|
|
|
The Helm Chart Values that you can override are described on the following
|
|
web pages:
|
|
|
|
|
|
.. _the-cert-manager-bootstrap-process-ul-d4j-khv-nlb:
|
|
|
|
- ``nginx-ingress-controller``
|
|
|
|
`https://github.com/kubernetes/ingress-nginx/blob/controller-v1.1.1/charts/ingress-nginx/values.yaml <https://github.com/kubernetes/ingress-nginx/blob/controller-v1.1.1/charts/ingress-nginx/values.yaml>`__
|
|
|
|
- ``cert-manager``
|
|
|
|
`https://github.com/cert-manager/cert-manager/blob/release-1.7/deploy/charts/cert-manager/values.yaml <https://github.com/cert-manager/cert-manager/blob/release-1.7/deploy/charts/cert-manager/values.yaml>`__
|