PMM-14242: Implement automatic SSL certificate configuration for OpenShift clusters

[nogueiraanderson]

Automatic SSL Certificate Configuration for OpenShift Clusters

Jira Ticket: PMM-14242 - Add SSL certificate automation for OpenShift clusters

Problem

OpenShift clusters created through Jenkins require manual SSL certificate configuration for both the console and PMM services. This involves:

• Manually installing cert-manager operator and creating Let's Encrypt issuers
• Creating certificates and applying them to routes
• Configuring AWS ACM certificates for LoadBalancer services
• Creating Route53 DNS records manually
• Different procedures for different service types (routes vs LoadBalancers)

Solution

Implemented comprehensive SSL automation that:

• Automatically configures Let's Encrypt certificates for OpenShift console routes
• Manages AWS ACM certificates for PMM LoadBalancer services
• Creates DNS validation records for new ACM certificates
• Auto-switches PMM to LoadBalancer service type when SSL is enabled
• Handles Route53 DNS record creation automatically
• Provides unified SSL configuration stage in the pipeline

Changes

New Libraries:

• vars/openshiftSSL.groovy - Let's Encrypt certificate management via cert-manager
• vars/awsCertificates.groovy - AWS ACM certificate and Route53 DNS automation

Modified Files:

• cloud/jenkins/openshift-cluster-create.yml - Added SSL configuration parameters section
• cloud/jenkins/openshift_cluster_create.groovy - Added SSL configuration stage
• vars/openshiftCluster.groovy - Enhanced deployPMM() with automatic SSL support

Example

Before:

// Manual SSL configuration required after cluster creation
// No SSL parameters available
stage('Deploy PMM') {
    // PMM deployed with ClusterIP, no SSL
    openshiftCluster.deployPMM(params)
}

After:

// Automatic SSL configuration
stage('Configure SSL Certificates') {
    when {
        expression { params.ENABLE_SSL == true }
    }
    steps {
        script {
            // Automatically configures Let's Encrypt for console
            // Automatically configures ACM for PMM if deployed
            def sslConfig = [
                enableSSL: params.ENABLE_SSL,
                sslMethod: params.SSL_METHOD,
                sslEmail: params.SSL_EMAIL,
                // ... other SSL params
            ]
            
            if (params.SSL_METHOD == 'letsencrypt') {
                openshiftSSL.setupLetsEncrypt(sslConfig)
            }
            
            // PMM automatically gets LoadBalancer + ACM when SSL enabled
            if (params.DEPLOY_PMM) {
                // ACM configured automatically in deployPMM()
            }
        }
    }
}

Notes

• ACM certificates require DNS validation (now automated)
• Let's Encrypt certificates auto-renew every 60 days via cert-manager
• DNS propagation may take up to 5 minutes

Validation

• Create cluster with SSL enabled (no existing certificates)
• Verify Let's Encrypt certificates on OpenShift console
• Verify ACM certificates on PMM LoadBalancer
• Check Route53 DNS records created correctly
• Test with staging certificates first
• Verify HTTPS endpoints are accessible