Support ACME certificates for managed ingress domains

Signed-off-by: Ryan Djurovich <git@ryan0x44.com>

Author: ryan0x44

charts/platform-certs/templates/ingress-certificate-crp.yaml

@@ -17,11 +17,13 @@ spec:
         - "platform-traefik"
   allowed:
     # Deny commonName - must not be present
-    # Platform Traefik owns ingress TLS termination; allow any DNS name from
-    # this namespace while keeping CA and client certificate issuance blocked.
+    # Platform Traefik owns ingress TLS termination. Permit only the configured
+    # apex and wildcard names from its namespace.
     dnsNames:
       required: true
-      values: ["*"]
+      validations:
+        - rule: {{ printf "self in %s" (toJson .Values.platform.certs.ingress.dnsNames) | quote }}
+          message: "DNS SAN must be one of the configured ingress names"
     # Restrict to server auth only
     usages:
       - "digital signature"

charts/platform-certs/values.schema.json

@@ -105,9 +105,16 @@
                     }
                   },
                   "required": ["issuerName"]
+                },
+                "dnsNames": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
                 }
               },
-              "required": ["acme", "selfsigned"]
+              "required": ["acme", "selfsigned", "dnsNames"]
             },
             "secretSync": {
               "type": "object",

charts/platform-certs/values.yaml

@@ -19,6 +19,7 @@ platform:
         solvers: []
       selfsigned:
         issuerName: platform-ingress-selfsigned-clusterissuer
+      dnsNames: []
     secretSync:
       enabled: false
       image:

charts/platform-components/templates/namespaces.yaml

@@ -42,6 +42,9 @@ metadata:
   name: {{ $app.namespace }}
   annotations:
     helm.sh/resource-policy: keep
+{{- with $app.namespaceAnnotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
   labels:
     app.kubernetes.io/managed-by: Helm
 {{- if and $tbEnabled (eq $app.namespace $tbNamespace) }}

charts/platform-components/values.schema.json

@@ -77,6 +77,12 @@
         "manageNamespace": {
           "type": "boolean"
         },
+        "namespaceAnnotations": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
         "core": {
           "type": "boolean",
           "description": "When true, the Podplane CLI treats this component as core and will refuse to uninstall it."

charts/platform-components/values.yaml

@@ -167,16 +167,16 @@ platform:
     #   platform-certs:
     #     platform:
     #       certs:
-    #         acme:
-    #           enabled: true
-    #           server: https://acme-v02.api.letsencrypt.org/directory
-    #           email: ops@example.com
-    #           solvers:
-    #             - dnsZones:
-    #                 - example.com
-    #               route53:
-    #                 hostedZoneID: Z123456789
-    #                 roleArn: arn:aws:iam::123456789012:role/podplane-cert-manager-dns01
+    #         ingress:
+    #           acme:
+    #             enabled: true
+    #             server: https://acme-v02.api.letsencrypt.org/directory
+    #             email: ops@example.com
+    #             solvers:
+    #               - dnsZones:
+    #                   - example.com
+    #                 route53:
+    #                   hostedZoneID: Z123456789
     #   traefik:
     #     platform:
     #       traefik:

charts/traefik/templates/traefik-certificates.yaml

@@ -5,6 +5,7 @@
 {{- $ingress := .Values.platform.traefik.ingress -}}
 {{- range $ingress.domains }}
 {{- $zone := include "podplane.traefik.domainName" . }}
+{{- $issuerRef := default $ingress.issuerRef .issuerRef }}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -17,8 +18,8 @@ spec:
     size: 256
     rotationPolicy: Always
   issuerRef:
-    kind: {{ $ingress.issuerRef.kind }}
-    name: {{ $ingress.issuerRef.name }}
+    kind: {{ $issuerRef.kind }}
+    name: {{ $issuerRef.name }}
   dnsNames:
     - {{ $zone | quote }}
     - {{ printf "*.%s" $zone | quote }}

charts/traefik/values.schema.json

@@ -60,6 +60,21 @@
                       },
                       "default": {
                         "type": "boolean"
+                      },
+                      "issuerRef": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "properties": {
+                          "kind": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "name": {
+                            "type": "string",
+                            "minLength": 1
+                          }
+                        },
+                        "required": ["kind", "name"]
                       }
                     },
                     "required": ["zone"]