feat: add cert-manager integration for Fabric CA#44
Open
Manideep3969 wants to merge 2 commits into
Open
Conversation
Add cert-manager support to the fabric-ca helm chart for ingress TLS termination. This replaces the ssl-passthrough pattern with standard cert-manager-provisioned certificates, enabling publicly-trusted TLS for CA endpoints. Changes: - New template: certificate.yaml (cert-manager Certificate CRD) - Modified: ingress.yaml (cert-manager annotations + TLS block) - Modified: configmap.yaml (conditional --cacert vs --insecure) - Modified: deployment.yaml (volume mount for trusted CA cert) - Modified: values.yaml (certManager config section) - Modified: Chart.yaml (bump to 1.3.0) - Modified: README.md (cert-manager docs, migration guide) - New example: root-ca-certmanager.yaml - New example: ica-orderer-certmanager.yaml Architecture: Two-layer TLS pattern - External: cert-manager terminates TLS at ingress - Internal: Fabric CA keeps its own self-signed TLS (unchanged) - Backward compatible: certManager.enabled=false preserves existing behavior The trustCA option allows ICA init containers to verify parent CA certificates without --insecure, eliminating the CA bootstrap trust vulnerability when cert-manager is active.
…Certificate CRDs The cert-manager ingress-shim auto-creates a Certificate CRD when it sees cert-manager.io/issuer annotations on the ingress, causing duplicates with the explicit certificate.yaml template. Remove the annotations and rely solely on the Certificate CRD template for provisioning. Also switch example values to selfsigned-issuer for local testing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cert-manager integration for Fabric CA
Closes #2
What it does
Adds cert-manager integration to the Fabric CA helm chart, enabling automatic TLS certificate provisioning at the ingress layer while preserving the existing self-signed TLS architecture inside the pod.
Key changes
certificate.yamltemplate — explicit cert-manager Certificate CRDingress.yaml— conditionalbackend-protocol: HTTPSannotation (replacesssl-passthroughwhen cert-manager is enabled)configmap.yaml—CURL_VERIFY_FLAGvariable (switches--cacertvs--insecurebased ontrustCA.enabled)deployment.yaml— optionaltrustCAvolume mount for parent CA certificatevalues.yaml— newcertManagersection withissuerRef,duration,renewBefore,trustCAREADME.md— cert-manager usage documentationArchitecture
Two-layer TLS: cert-manager terminates TLS at the ingress, Fabric CA keeps its self-signed TLS internally. The
ssl-passthroughannotation is removed when cert-manager is enabled and replaced withbackend-protocol: HTTPS.Backward compatibility
certManager.enabled: falseby default — existing deployments are unaffected.Verified on K8s
cert-manager.io/issuerannotations from ingress to prevent duplicate Certificate CRDs