From bbeba1a35481f8a352984f798f1af34166abd27b Mon Sep 17 00:00:00 2001 From: chiragkyal Date: Fri, 28 Nov 2025 18:20:55 +0530 Subject: [PATCH] Add QuickStart guides for CM Signed-off-by: chiragkyal --- ...ole.openshift.io_v1_consoleyamlsample.yaml | 26 +++ ...ole.openshift.io_v1_consoleyamlsample.yaml | 24 +++ ...ole.openshift.io_v1_consolequickstart.yaml | 203 ++++++++++++++++++ ...ole.openshift.io_v1_consoleyamlsample.yaml | 18 ++ .../cert-manager-acme-issuer-sample.yaml | 25 +++ .../cert-manager-certificate-sample.yaml | 25 +++ .../cert-manager-example-quickstart.yaml | 200 +++++++++++++++++ .../console/cert-manager-issuer-sample.yaml | 19 ++ config/console/kustomization.yaml | 6 + config/manifests/kustomization.yaml | 1 + 10 files changed, 547 insertions(+) create mode 100644 bundle/manifests/cert-manager-acme-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml create mode 100644 bundle/manifests/cert-manager-certificate-sample_console.openshift.io_v1_consoleyamlsample.yaml create mode 100644 bundle/manifests/cert-manager-example_console.openshift.io_v1_consolequickstart.yaml create mode 100644 bundle/manifests/cert-manager-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml create mode 100644 config/console/cert-manager-acme-issuer-sample.yaml create mode 100644 config/console/cert-manager-certificate-sample.yaml create mode 100644 config/console/cert-manager-example-quickstart.yaml create mode 100644 config/console/cert-manager-issuer-sample.yaml create mode 100644 config/console/kustomization.yaml diff --git a/bundle/manifests/cert-manager-acme-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml b/bundle/manifests/cert-manager-acme-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml new file mode 100644 index 000000000..492f33491 --- /dev/null +++ b/bundle/manifests/cert-manager-acme-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml @@ -0,0 +1,26 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleYAMLSample +metadata: + name: cert-manager-acme-issuer-sample +spec: + description: An example ACME Issuer for Let's Encrypt production certificates with + HTTP-01 challenge + targetResource: + apiVersion: cert-manager.io/v1 + kind: Issuer + title: Example ACME Issuer (Let's Encrypt) + yaml: |- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + name: letsencrypt-prod + namespace: default + spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-prod-account-key + solvers: + - http01: + ingress: + ingressClassName: openshift-default diff --git a/bundle/manifests/cert-manager-certificate-sample_console.openshift.io_v1_consoleyamlsample.yaml b/bundle/manifests/cert-manager-certificate-sample_console.openshift.io_v1_consoleyamlsample.yaml new file mode 100644 index 000000000..fc3b5209d --- /dev/null +++ b/bundle/manifests/cert-manager-certificate-sample_console.openshift.io_v1_consoleyamlsample.yaml @@ -0,0 +1,24 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleYAMLSample +metadata: + name: cert-manager-certificate-sample +spec: + description: A simple Certificate example + targetResource: + apiVersion: cert-manager.io/v1 + kind: Certificate + title: Example Certificate + yaml: |- + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: example-cert + namespace: default + spec: + secretName: example-tls + commonName: example.com + dnsNames: + - example.com + issuerRef: + name: selfsigned-issuer + kind: Issuer diff --git a/bundle/manifests/cert-manager-example_console.openshift.io_v1_consolequickstart.yaml b/bundle/manifests/cert-manager-example_console.openshift.io_v1_consolequickstart.yaml new file mode 100644 index 000000000..37847c281 --- /dev/null +++ b/bundle/manifests/cert-manager-example_console.openshift.io_v1_consolequickstart.yaml @@ -0,0 +1,203 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleQuickStart +metadata: + annotations: + capability.openshift.io/name: Console + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + name: cert-manager-example +spec: + conclusion: |- + Great job! You've successfully created your first Issuer and Certificate. + + ### Next Steps: + + - For production, use Let's Encrypt (ACME Issuer) instead of self-signed certificates + - Explore ClusterIssuer for cluster-wide certificate management + - Check out the [cert-manager documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift) to learn more + description: Create and issue TLS certificates using the cert-manager Operator for + Red Hat OpenShift + displayName: cert-manager Operator for Red Hat OpenShift Example + durationMinutes: 10 + introduction: |- + # cert-manager Operator for Red Hat OpenShift + + The cert-manager Operator for Red Hat OpenShift enables you to create and sign TLS certificates from an external PKI for your workloads + running on an OpenShift cluster. + + ### Expected Learning + + With this Quick Start, you will learn about the following CRDs provided by the cert-manager operator: + 1. **Issuer** - defines a certificate authority that can sign certificates + 2. **Certificate** - defines the desired certificate and its properties + + This Quick Start will walk you through creating your first certificate: + - Create a self-signed Issuer (for testing) + - Create a Certificate signed by that Issuer + - View the generated certificate in a Kubernetes Secret + - Learn how to use it in your applications + + **Note**: For production, you would use Let's Encrypt (ACME), HashiCorp Vault, or your organization's CA instead of self-signed certificates. + prerequisites: + - You completed the "Install the cert-manager Operator for Red Hat OpenShift" quick + start. + - You have a namespace in which to deploy the example CRs. + tags: + - example + - operator + - certificates + tasks: + - description: |- + ### To navigate to the installed operator: + 1. Go to the **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section of the navigation. + 2. In the **Search by name** field, type `cert-manager`. + 3. Look for **cert-manager Operator for Red Hat OpenShift**. If you had completed the prerequisite Quick Start, the tile should appear. + 4. Click on the installed operator + + You will be brought to the **Operator Details** page and be presented with **Provided APIs** + review: + failedTaskHelp: This task isn't verified yet. Try the task again. + instructions: |- + #### Verify you see a list of **Provided APIs**: + The list should include `Issuer`, `ClusterIssuer`, and `Certificate` + summary: + failed: Try the steps again. + success: You are in the right place, and ready to start the rest of the Quick + Start + title: Navigate to installed cert-manager operator + - description: |- + ### Create or select a project to work in + 1. Find the **Project** dropdown menu at the top of the screen. + 2. Select or create the project in which you want to work in. + + **Note**: For this example, we'll create an `Issuer` which is namespace-scoped. If you want to issue certificates + across multiple namespaces, you can create a `ClusterIssuer` instead. + review: + failedTaskHelp: Try the task again. + instructions: '#### Verify the name in the **Project** dropdown menu is the + expected project' + summary: + failed: Try the steps again. + success: You are in the right place. + title: Select a project + - description: |- + ### To create a self-signed Issuer + + An Issuer represents a certificate authority that can sign certificates. We'll create a self-signed Issuer + for this example. This is useful for testing and development. + + 1. Find the `Issuer` Custom Resource in the list of **Provided APIs** or in the top side-scrolling menu bar. + - From the list of **Provided APIs**, click the **Create instance** link. + - From the **top side-scrolling menu bar**, click **Issuer** and then click **Create Issuer**. + + 2. Switch to **YAML view** in the editor. + + 3. On the right sidebar, look for the **Samples** section and select **"Example Self-Signed Issuer"**. + + 4. Click **Try it** to populate the editor with the sample YAML. + + 5. Click the **Create** button to create the Issuer. + review: + failedTaskHelp: This task isn't verified yet. Try the task again. + instructions: |- + #### Verify the Issuer was successfully created: + 1. You should see the Issuer listed with the name `selfsigned-issuer` + 2. Check that the **Ready** condition shows **True** in the Conditions section + summary: + failed: Try the steps again. + success: You just created a self-signed Issuer! Now we can create certificates. + title: Create a self-signed Issuer + - description: |- + ### To create a Certificate + + Now we'll create a certificate that will be signed by our Issuer. + + 1. Find the `Certificate` Custom Resource in the list of **Provided APIs** or in the top side-scrolling menu bar. + - From the list of **Provided APIs**, click the **Create instance** link. + - From the **top side-scrolling menu bar**, click **Certificate** and then click **Create Certificate**. + + 2. Switch to **YAML view** in the editor. + + 3. On the right sidebar, look for the **Samples** section and select **"Example Certificate"**. + + 4. Click **Try it** to populate the editor with the sample YAML. + + 5. Click the **Create** button to create the Certificate. + review: + failedTaskHelp: This task isn't verified yet. Try the task again. + instructions: |- + #### Verify the Certificate was successfully created: + 1. You should see the Certificate listed with the name `example-cert`. + 2. Check that the **Ready** condition shows **True**. + 3. Navigate to the [Workloads]{{highlight qs-nav-workloads}} section and click **Secrets** + 4. You should see a new Secret named `example-tls`. + summary: + failed: Try the steps again. + success: You just created your first certificate! cert-manager has issued it + and stored it in a Secret. + title: Create a Certificate + - description: |- + ### To inspect the certificate + + Let's look at the Secret that contains the certificate. + + 1. Make sure you're in the [Workloads]{{highlight qs-nav-workloads}} section, click **Secrets**. + 2. Click on the **example-tls** Secret. + 3. You should see the certificate data with keys: + - `tls.crt` - The certificate. + - `tls.key` - The private key. + - `ca.crt` - The CA certificate. + review: + failedTaskHelp: This task isn't verified yet. Try the task again. + instructions: |- + #### Verify you can see the certificate data: + Is the Secret `example-tls` present with `tls.crt` and `tls.key`? + summary: + failed: Try the steps again. + success: Great! Your certificate is ready to use. + title: View the certificate + - description: |- + ### How to use certificates + + Now you can use this certificate in your applications. Here's a simple example for an OpenShift Route: + + ```yaml + apiVersion: route.openshift.io/v1 + kind: Route + metadata: + name: my-app + spec: + to: + kind: Service + name: my-service + tls: + termination: edge + externalCertificate: + name: example-tls + ``` + + Or in an Ingress: + + ```yaml + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: my-app + spec: + tls: + - secretName: example-tls + rules: + - host: example.com + ``` + + **Note**: cert-manager will automatically renew certificates before they expire! + review: + failedTaskHelp: Review the examples above. + instructions: |- + #### Do you understand how to use certificates? + Certificates can be referenced in Routes and Ingress resources. + summary: + failed: Review the examples again. + success: You now know how to create and use certificates! + title: Use the certificate diff --git a/bundle/manifests/cert-manager-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml b/bundle/manifests/cert-manager-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml new file mode 100644 index 000000000..52a5659fd --- /dev/null +++ b/bundle/manifests/cert-manager-issuer-sample_console.openshift.io_v1_consoleyamlsample.yaml @@ -0,0 +1,18 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleYAMLSample +metadata: + name: cert-manager-issuer-sample +spec: + description: A simple self-signed Issuer for development and testing + targetResource: + apiVersion: cert-manager.io/v1 + kind: Issuer + title: Example Self-Signed Issuer + yaml: |- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + name: selfsigned-issuer + namespace: default + spec: + selfSigned: {} diff --git a/config/console/cert-manager-acme-issuer-sample.yaml b/config/console/cert-manager-acme-issuer-sample.yaml new file mode 100644 index 000000000..40e3d7e4a --- /dev/null +++ b/config/console/cert-manager-acme-issuer-sample.yaml @@ -0,0 +1,25 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleYAMLSample +metadata: + name: cert-manager-acme-issuer-sample +spec: + targetResource: + apiVersion: cert-manager.io/v1 + kind: Issuer + title: Example ACME Issuer (Let's Encrypt) + description: An example ACME Issuer for Let's Encrypt production certificates with HTTP-01 challenge + yaml: |- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + name: letsencrypt-prod + namespace: default + spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-prod-account-key + solvers: + - http01: + ingress: + ingressClassName: openshift-default diff --git a/config/console/cert-manager-certificate-sample.yaml b/config/console/cert-manager-certificate-sample.yaml new file mode 100644 index 000000000..b83b514ac --- /dev/null +++ b/config/console/cert-manager-certificate-sample.yaml @@ -0,0 +1,25 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleYAMLSample +metadata: + name: cert-manager-certificate-sample +spec: + targetResource: + apiVersion: cert-manager.io/v1 + kind: Certificate + title: Example Certificate + description: A simple Certificate example + yaml: |- + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: example-cert + namespace: default + spec: + secretName: example-tls + commonName: example.com + dnsNames: + - example.com + issuerRef: + name: selfsigned-issuer + kind: Issuer + diff --git a/config/console/cert-manager-example-quickstart.yaml b/config/console/cert-manager-example-quickstart.yaml new file mode 100644 index 000000000..f1f192aa3 --- /dev/null +++ b/config/console/cert-manager-example-quickstart.yaml @@ -0,0 +1,200 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleQuickStart +metadata: + name: cert-manager-example + annotations: + capability.openshift.io/name: Console + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" +spec: + displayName: cert-manager Operator for Red Hat OpenShift Example + tags: + - example + - operator + - certificates + durationMinutes: 10 + prerequisites: + - You completed the "Install the cert-manager Operator for Red Hat OpenShift" quick start. + - You have a namespace in which to deploy the example CRs. + description: |- + Create and issue TLS certificates using the cert-manager Operator for Red Hat OpenShift + introduction: |- + # cert-manager Operator for Red Hat OpenShift + + The cert-manager Operator for Red Hat OpenShift enables you to create and sign TLS certificates from an external PKI for your workloads + running on an OpenShift cluster. + + ### Expected Learning + + With this Quick Start, you will learn about the following CRDs provided by the cert-manager operator: + 1. **Issuer** - defines a certificate authority that can sign certificates + 2. **Certificate** - defines the desired certificate and its properties + + This Quick Start will walk you through creating your first certificate: + - Create a self-signed Issuer (for testing) + - Create a Certificate signed by that Issuer + - View the generated certificate in a Kubernetes Secret + - Learn how to use it in your applications + + **Note**: For production, you would use Let's Encrypt (ACME), HashiCorp Vault, or your organization's CA instead of self-signed certificates. + tasks: + - title: Navigate to installed cert-manager operator + description: |- + ### To navigate to the installed operator: + 1. Go to the **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section of the navigation. + 2. In the **Search by name** field, type `cert-manager`. + 3. Look for **cert-manager Operator for Red Hat OpenShift**. If you had completed the prerequisite Quick Start, the tile should appear. + 4. Click on the installed operator + + You will be brought to the **Operator Details** page and be presented with **Provided APIs** + review: + instructions: |- + #### Verify you see a list of **Provided APIs**: + The list should include `Issuer`, `ClusterIssuer`, and `Certificate` + failedTaskHelp: This task isn't verified yet. Try the task again. + summary: + success: You are in the right place, and ready to start the rest of the Quick Start + failed: Try the steps again. + - title: Select a project + description: |- + ### Create or select a project to work in + 1. Find the **Project** dropdown menu at the top of the screen. + 2. Select or create the project in which you want to work in. + + **Note**: For this example, we'll create an `Issuer` which is namespace-scoped. If you want to issue certificates + across multiple namespaces, you can create a `ClusterIssuer` instead. + review: + instructions: |- + #### Verify the name in the **Project** dropdown menu is the expected project + failedTaskHelp: Try the task again. + summary: + success: You are in the right place. + failed: Try the steps again. + - title: Create a self-signed Issuer + description: |- + ### To create a self-signed Issuer + + An Issuer represents a certificate authority that can sign certificates. We'll create a self-signed Issuer + for this example. This is useful for testing and development. + + 1. Find the `Issuer` Custom Resource in the list of **Provided APIs** or in the top side-scrolling menu bar. + - From the list of **Provided APIs**, click the **Create instance** link. + - From the **top side-scrolling menu bar**, click **Issuer** and then click **Create Issuer**. + + 2. Switch to **YAML view** in the editor. + + 3. On the right sidebar, look for the **Samples** section and select **"Example Self-Signed Issuer"**. + + 4. Click **Try it** to populate the editor with the sample YAML. + + 5. Click the **Create** button to create the Issuer. + review: + instructions: |- + #### Verify the Issuer was successfully created: + 1. You should see the Issuer listed with the name `selfsigned-issuer` + 2. Check that the **Ready** condition shows **True** in the Conditions section + failedTaskHelp: This task isn't verified yet. Try the task again. + summary: + success: You just created a self-signed Issuer! Now we can create certificates. + failed: Try the steps again. + - title: Create a Certificate + description: |- + ### To create a Certificate + + Now we'll create a certificate that will be signed by our Issuer. + + 1. Find the `Certificate` Custom Resource in the list of **Provided APIs** or in the top side-scrolling menu bar. + - From the list of **Provided APIs**, click the **Create instance** link. + - From the **top side-scrolling menu bar**, click **Certificate** and then click **Create Certificate**. + + 2. Switch to **YAML view** in the editor. + + 3. On the right sidebar, look for the **Samples** section and select **"Example Certificate"**. + + 4. Click **Try it** to populate the editor with the sample YAML. + + 5. Click the **Create** button to create the Certificate. + review: + instructions: |- + #### Verify the Certificate was successfully created: + 1. You should see the Certificate listed with the name `example-cert`. + 2. Check that the **Ready** condition shows **True**. + 3. Navigate to the [Workloads]{{highlight qs-nav-workloads}} section and click **Secrets** + 4. You should see a new Secret named `example-tls`. + failedTaskHelp: This task isn't verified yet. Try the task again. + summary: + success: You just created your first certificate! cert-manager has issued it and stored it in a Secret. + failed: Try the steps again. + - title: View the certificate + description: |- + ### To inspect the certificate + + Let's look at the Secret that contains the certificate. + + 1. Make sure you're in the [Workloads]{{highlight qs-nav-workloads}} section, click **Secrets**. + 2. Click on the **example-tls** Secret. + 3. You should see the certificate data with keys: + - `tls.crt` - The certificate. + - `tls.key` - The private key. + - `ca.crt` - The CA certificate. + review: + instructions: |- + #### Verify you can see the certificate data: + Is the Secret `example-tls` present with `tls.crt` and `tls.key`? + failedTaskHelp: This task isn't verified yet. Try the task again. + summary: + success: Great! Your certificate is ready to use. + failed: Try the steps again. + - title: Use the certificate + description: |- + ### How to use certificates + + Now you can use this certificate in your applications. Here's a simple example for an OpenShift Route: + + ```yaml + apiVersion: route.openshift.io/v1 + kind: Route + metadata: + name: my-app + spec: + to: + kind: Service + name: my-service + tls: + termination: edge + externalCertificate: + name: example-tls + ``` + + Or in an Ingress: + + ```yaml + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: my-app + spec: + tls: + - secretName: example-tls + rules: + - host: example.com + ``` + + **Note**: cert-manager will automatically renew certificates before they expire! + review: + instructions: |- + #### Do you understand how to use certificates? + Certificates can be referenced in Routes and Ingress resources. + failedTaskHelp: Review the examples above. + summary: + success: You now know how to create and use certificates! + failed: Review the examples again. + conclusion: |- + Great job! You've successfully created your first Issuer and Certificate. + + ### Next Steps: + + - For production, use Let's Encrypt (ACME Issuer) instead of self-signed certificates + - Explore ClusterIssuer for cluster-wide certificate management + - Check out the [cert-manager documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift) to learn more diff --git a/config/console/cert-manager-issuer-sample.yaml b/config/console/cert-manager-issuer-sample.yaml new file mode 100644 index 000000000..3bc9ebd71 --- /dev/null +++ b/config/console/cert-manager-issuer-sample.yaml @@ -0,0 +1,19 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleYAMLSample +metadata: + name: cert-manager-issuer-sample +spec: + targetResource: + apiVersion: cert-manager.io/v1 + kind: Issuer + title: Example Self-Signed Issuer + description: A simple self-signed Issuer for development and testing + yaml: |- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + name: selfsigned-issuer + namespace: default + spec: + selfSigned: {} + diff --git a/config/console/kustomization.yaml b/config/console/kustomization.yaml new file mode 100644 index 000000000..599549b5a --- /dev/null +++ b/config/console/kustomization.yaml @@ -0,0 +1,6 @@ +resources: +- cert-manager-example-quickstart.yaml +- cert-manager-issuer-sample.yaml +- cert-manager-certificate-sample.yaml +- cert-manager-acme-issuer-sample.yaml + diff --git a/config/manifests/kustomization.yaml b/config/manifests/kustomization.yaml index 1bbf49121..0a4b22e0f 100644 --- a/config/manifests/kustomization.yaml +++ b/config/manifests/kustomization.yaml @@ -5,6 +5,7 @@ resources: - ../default - ../samples - ../scorecard +- ../console # [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix. # Do NOT uncomment sections with prefix [CERTMANAGER], as OLM does not support cert-manager.