feat(cert-manager): migrate to operator + add docs
diff --git a/roles/certificates/README.md b/roles/certificates/README.md
new file mode 100644
index 0000000..ab2904d
--- /dev/null
+++ b/roles/certificates/README.md
@@ -0,0 +1,6 @@
+# `certificates`
+
+!!! warning
+
+ This is a legacy role that is meant to be phased out eventually when there
+ is no need for the control-plane systems to have the CA installed on them.
diff --git a/roles/certificates/meta/main.yml b/roles/certificates/meta/main.yml
new file mode 100644
index 0000000..4d6cbdd
--- /dev/null
+++ b/roles/certificates/meta/main.yml
@@ -0,0 +1,27 @@
+# Copyright (c) 2022 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+galaxy_info:
+ author: VEXXHOST, Inc.
+ description: Ansible role for distributing certificates
+ license: Apache-2.0
+ min_ansible_version: 5.5.0
+ standalone: false
+ platforms:
+ - name: Ubuntu
+ versions:
+ - focal
+
+dependencies:
+ - role: atmosphere
diff --git a/roles/certificates/tasks/main.yml b/roles/certificates/tasks/main.yml
new file mode 100644
index 0000000..334d7e7
--- /dev/null
+++ b/roles/certificates/tasks/main.yml
@@ -0,0 +1,53 @@
+# Copyright (c) 2022 VEXXHOST, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Bootstrap PKI
+ block:
+ - name: Wait till the secret is created
+ kubernetes.core.k8s_info:
+ api_version: v1
+ kind: Secret
+ name: cert-manager-selfsigned-ca
+ namespace: openstack
+ wait: true
+ wait_sleep: 1
+ wait_timeout: 300
+ register: _openstack_helm_root_secret
+ when: atomsphere_issuer_config.type == "self-signed"
+
+ - name: Wait till the secret is created
+ kubernetes.core.k8s_info:
+ api_version: v1
+ kind: Secret
+ name: cert-manager-issuer-ca
+ namespace: openstack
+ wait: true
+ wait_sleep: 1
+ wait_timeout: 300
+ register: _openstack_helm_root_secret
+ when: atomsphere_issuer_config.type == "ca"
+
+ - name: Copy CA certificate on host
+ ansible.builtin.copy:
+ content: "{{ _openstack_helm_root_secret.resources[0].data['tls.crt'] | b64decode }}"
+ dest: "/usr/local/share/ca-certificates/self-signed-osh-ca.crt"
+ mode: "0644"
+
+ - name: Update CA certificates on host
+ ansible.builtin.command:
+ cmd: update-ca-certificates
+ changed_when: false
+ when:
+ - atomsphere_issuer_config.type is defined
+ - atomsphere_issuer_config.type in ("self-signed", "ca")