Skip to content

Commit 53b1487

Browse files
nogueiraandersonclaude
nogueiraanderson
and
claude
committed
Implement automatic SSL certificate configuration for OpenShift clusters
- Add Let's Encrypt support via cert-manager for OpenShift routes - Add AWS ACM certificate management for LoadBalancer services - Implement DNS automation with Route53 - Auto-switch PMM to LoadBalancer when SSL is enabled - Add ACM certificate creation with DNS validation Changes: - New vars/openshiftSSL.groovy library for Let's Encrypt management - New vars/awsCertificates.groovy library for ACM and Route53 - Enhanced openshift_cluster_create pipeline with SSL parameters - Modified deployPMM() to support ACM certificates automatically Related to: PMM-14242 Co-Authored-By: Claude <[email protected]>
1 parent 53769c4 commit 53b1487

File tree

5 files changed

+1527
-4
lines changed

5 files changed

+1527
-4
lines changed

‎cloud/jenkins/openshift-cluster-create.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,37 @@
145145
description: "Product/project tag for billing allocation"
146146
trim: true
147147

148+
# === SSL Certificate Configuration ===
149+
- bool:
150+
name: ENABLE_SSL
151+
default: false
152+
description: "Enable automatic SSL certificate configuration for cluster services"
153+
- choice:
154+
name: SSL_METHOD
155+
choices:
156+
- "acm"
157+
- "letsencrypt"
158+
description: "SSL certificate provider (AWS ACM or Let's Encrypt via cert-manager)"
159+
- string:
160+
name: SSL_EMAIL
161+
default: "[email protected]"
162+
description: "Email address for Let's Encrypt registration (required for letsencrypt method)"
163+
trim: true
164+
- bool:
165+
name: USE_STAGING_CERT
166+
default: false
167+
description: "Use Let's Encrypt staging certificates for testing (avoids rate limits)"
168+
- string:
169+
name: CONSOLE_CUSTOM_DOMAIN
170+
default: ""
171+
description: "Custom domain for OpenShift console (optional, auto-generates if empty)"
172+
trim: true
173+
- string:
174+
name: PMM_CUSTOM_DOMAIN
175+
default: ""
176+
description: "Custom domain for PMM interface (optional, auto-generates if empty)"
177+
trim: true
178+
148179
# === Advanced Options ===
149180
- string:
150181
name: BASE_DOMAIN

‎cloud/jenkins/openshift_cluster_create.groovy‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,13 @@ Starting cluster creation process...
372372
pmmHelmChartVersion: params.PMM_HELM_CHART_VERSION,
373373
pmmImageRepository: params.PMM_IMAGE_REPOSITORY,
374374
pmmAdminPassword: params.PMM_ADMIN_PASSWORD ?: '<GENERATED>', // Default to auto-generation
375+
// SSL Configuration
376+
enableSSL: params.ENABLE_SSL,
377+
sslMethod: params.SSL_METHOD,
378+
sslEmail: params.SSL_EMAIL,
379+
useStaging: params.USE_STAGING_CERT,
380+
consoleCustomDomain: params.CONSOLE_CUSTOM_DOMAIN,
381+
pmmCustomDomain: params.PMM_CUSTOM_DOMAIN,
375382
buildUser: env.BUILD_USER_ID ?: 'jenkins',
376383
accessKey: AWS_ACCESS_KEY_ID,
377384
secretKey: AWS_SECRET_ACCESS_KEY
@@ -410,6 +417,103 @@ Starting cluster creation process...
410417
}
411418
}
412419

420+
stage('Configure SSL Certificates') {
421+
when {
422+
expression { params.ENABLE_SSL && env.CLUSTER_DIR }
423+
}
424+
steps {
425+
script {
426+
echo ""
427+
echo "====================================================================="
428+
echo "Configuring SSL Certificates"
429+
echo "====================================================================="
430+
echo ""
431+
echo "SSL Method: ${params.SSL_METHOD}"
432+
echo "Base Domain: ${params.BASE_DOMAIN}"
433+
434+
def sslConfig = [
435+
clusterName: env.FINAL_CLUSTER_NAME,
436+
baseDomain: params.BASE_DOMAIN,
437+
kubeconfig: env.KUBECONFIG,
438+
method: params.SSL_METHOD,
439+
email: params.SSL_EMAIL,
440+
useStaging: params.USE_STAGING_CERT
441+
]
442+
443+
def sslResults = [:]
444+
445+
if (params.SSL_METHOD == 'letsencrypt') {
446+
echo "Setting up Let's Encrypt certificates..."
447+
448+
// Configure console domain
449+
def consoleDomain = params.CONSOLE_CUSTOM_DOMAIN ?:
450+
"console-${env.FINAL_CLUSTER_NAME}.${params.BASE_DOMAIN}"
451+
452+
sslConfig.consoleDomain = consoleDomain
453+
454+
// Setup Let's Encrypt
455+
sslResults = openshiftSSL.setupLetsEncrypt(sslConfig)
456+
457+
if (sslResults.consoleCert) {
458+
echo "✓ Console certificate configured for: ${consoleDomain}"
459+
env.CONSOLE_SSL_DOMAIN = consoleDomain
460+
}
461+
} else if (params.SSL_METHOD == 'acm') {
462+
echo "Setting up AWS ACM certificates..."
463+
464+
withCredentials([
465+
aws(
466+
credentialsId: 'jenkins-openshift-aws',
467+
accessKeyVariable: 'AWS_ACCESS_KEY_ID',
468+
secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'
469+
)
470+
]) {
471+
def services = []
472+
473+
// Add PMM service if deployed
474+
if (params.DEPLOY_PMM && env.PMM_URL) {
475+
def pmmDomain = params.PMM_CUSTOM_DOMAIN ?:
476+
"pmm-${env.FINAL_CLUSTER_NAME}.${params.BASE_DOMAIN}"
477+
478+
services.add([
479+
name: 'monitoring-service',
480+
namespace: 'pmm-monitoring',
481+
domain: pmmDomain
482+
])
483+
}
484+
485+
sslConfig.services = services
486+
sslConfig.accessKey = AWS_ACCESS_KEY_ID
487+
sslConfig.secretKey = AWS_SECRET_ACCESS_KEY
488+
489+
sslResults = awsCertificates.setupACM(sslConfig)
490+
491+
if (sslResults.services) {
492+
sslResults.services.each { name, config ->
493+
if (config.configured) {
494+
echo "✓ Service ${name} configured with ACM certificate"
495+
if (config.domain) {
496+
echo " Domain: https://${config.domain}"
497+
}
498+
}
499+
}
500+
}
501+
}
502+
}
503+
504+
// Store SSL results for post-creation display
505+
env.SSL_CONFIGURED = sslResults ? 'true' : 'false'
506+
507+
if (sslResults.errors && !sslResults.errors.isEmpty()) {
508+
echo "SSL configuration completed with warnings:"
509+
sslResults.errors.each { error ->
510+
echo " ⚠ ${error}"
511+
}
512+
}
513+
}
514+
}
515+
}
516+
413517
stage('Post-Creation Tasks') {
414518
steps {
415519
script {
@@ -435,6 +539,12 @@ Starting cluster creation process...
435539
echo "------------------"
436540
echo "API URL: ${env.CLUSTER_API_URL}"
437541
echo "Console URL: ${env.CLUSTER_CONSOLE_URL ?: 'Pending...'}"
542+
543+
// Display SSL console URL if configured
544+
if (params.ENABLE_SSL && params.SSL_METHOD == 'letsencrypt' && env.CONSOLE_SSL_DOMAIN) {
545+
echo "Console SSL URL: https://${env.CONSOLE_SSL_DOMAIN}"
546+
}
547+
438548
echo "Kubeconfig: Available in Jenkins artifacts"
439549
echo ""
440550

@@ -460,6 +570,13 @@ Starting cluster creation process...
460570
echo "Access URL: ${env.PMM_URL}"
461571
echo "Username: admin"
462572
echo "Password: ${passwordInfo}"
573+
574+
// Display SSL info if configured
575+
if (params.ENABLE_SSL && params.SSL_METHOD == 'acm' && env.SSL_CONFIGURED == 'true') {
576+
def pmmDomain = params.PMM_CUSTOM_DOMAIN ?:
577+
"pmm-${env.FINAL_CLUSTER_NAME}.${params.BASE_DOMAIN}"
578+
echo "SSL Access: https://${pmmDomain}"
579+
}
463580
echo ""
464581
} else if (params.DEPLOY_PMM) {
465582
echo "PMM DEPLOYMENT STATUS: NOT DEPLOYED"

0 commit comments

Comments
 (0)