Skip to content

Commit 93f7f99

Browse files
Jonathan S. Katzjkatz
Jonathan S. Katz
authored and
jkatz
committed
Remove TLS cert generation for API server from installer
The apiserver will reconcile its own TLS certificate -- it has been doing so for awhile. This unifies the method to ensure that only the apiserver will generate its certificate, unless the user explicitly provides one. Issue: [ch11380]
1 parent 7f0ede5 commit 93f7f99

File tree

3 files changed

+33
-81
lines changed

3 files changed

+33
-81
lines changed

‎docs/content/installation/other/ansible/installing-operator.md

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -56,38 +56,53 @@ oc get deployments -n <NAMESPACE_NAME>
5656
oc get pods -n <NAMESPACE_NAME>
5757
```
5858

59-
## Configure Environment Variables
60-
61-
After the Crunchy PostgreSQL Operator has successfully been installed we will need
62-
to configure local environment variables before using the `pgo` client.
59+
## Install the `pgo` Client
6360

6461
{{% notice info %}}
65-
6662
If TLS authentication was disabled during installation, please see the [TLS Configuration Page] ({{< relref "Configuration/tls.md" >}}) for additional configuration information.
67-
6863
{{% / notice %}}
6964

70-
To configure the environment variables used by `pgo` run the following command:
65+
During or after the installation of PGO: the Postgres Operator, download the `pgo` client set up script. This will help set up your local environment for using the Postgres Operator:
7166

72-
Note: `<PGO_NAMESPACE>` should be replaced with the namespace the Crunchy PostgreSQL
73-
Operator was deployed to.
67+
```
68+
curl https://raw.githubusercontent.com/CrunchyData/postgres-operator/v{{< param operatorVersion >}}/installers/kubectl/client-setup.sh > client-setup.sh
69+
chmod +x client-setup.sh
70+
```
7471

75-
```bash
76-
cat <<EOF >> ~/.bashrc
77-
export PGOUSER="${HOME?}/.pgo/<PGO_NAMESPACE>/pgouser"
78-
export PGO_CA_CERT="${HOME?}/.pgo/<PGO_NAMESPACE>/client.crt"
79-
export PGO_CLIENT_CERT="${HOME?}/.pgo/<PGO_NAMESPACE>/client.crt"
80-
export PGO_CLIENT_KEY="${HOME?}/.pgo/<PGO_NAMESPACE>/client.key"
72+
When the Postgres Operator is done installing, run the client setup script:
73+
74+
```
75+
./client-setup.sh
76+
```
77+
78+
This will download the `pgo` client and provide instructions for how to easily use it in your environment. It will prompt you to add some environmental variables for you to set up in your session, which you can do with the following commands:
79+
80+
```
81+
export PGOUSER="${HOME?}/.pgo/pgo/pgouser"
82+
export PGO_CA_CERT="${HOME?}/.pgo/pgo/client.crt"
83+
export PGO_CLIENT_CERT="${HOME?}/.pgo/pgo/client.crt"
84+
export PGO_CLIENT_KEY="${HOME?}/.pgo/pgo/client.key"
8185
export PGO_APISERVER_URL='https://127.0.0.1:8443'
82-
EOF
86+
export PGO_NAMESPACE=pgo
8387
```
8488

85-
Apply those changes to the current session by running:
89+
If you wish to permanently add these variables to your environment, you can run the following:
90+
91+
```
92+
cat <<EOF >> ~/.bashrc
93+
export PGOUSER="${HOME?}/.pgo/pgo/pgouser"
94+
export PGO_CA_CERT="${HOME?}/.pgo/pgo/client.crt"
95+
export PGO_CLIENT_CERT="${HOME?}/.pgo/pgo/client.crt"
96+
export PGO_CLIENT_KEY="${HOME?}/.pgo/pgo/client.key"
97+
export PGO_APISERVER_URL='https://127.0.0.1:8443'
98+
export PGO_NAMESPACE=pgo
99+
EOF
86100
87-
```bash
88101
source ~/.bashrc
89102
```
90103

104+
**NOTE**: For macOS users, you must use `~/.bash_profile` instead of `~/.bashrc`
105+
91106
## Verify `pgo` Connection
92107

93108
In a separate terminal we need to setup a port forward to the Crunchy PostgreSQL

‎installers/ansible/roles/pgo-operator/tasks/certs.yml

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎installers/ansible/roles/pgo-operator/tasks/main.yml

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,6 @@
4444
tags:
4545
- uninstall
4646

47-
- include_tasks: certs.yml
48-
tags:
49-
- install
50-
5147
- name: Use kubectl or oc
5248
set_fact:
5349
kubectl_or_oc: "{{ openshift_oc_bin if openshift_oc_bin is defined else 'kubectl' }}"
@@ -274,24 +270,6 @@
274270
- (backrest_aws_s3_key | default('') != '') or
275271
(backrest_aws_s3_secret | default('') != '')
276272

277-
- name: PGO API Secret
278-
tags:
279-
- install
280-
- update
281-
block:
282-
- name: Check PGO API Secret
283-
shell: "{{ kubectl_or_oc }} get secret pgo.tls -n {{ pgo_operator_namespace }}"
284-
register: pgo_tls_result
285-
failed_when: false
286-
287-
- name: Create PGO API Secret
288-
command: |
289-
{{ kubectl_or_oc }} create secret tls pgo.tls \
290-
--cert='{{ output_dir }}/server.crt' \
291-
--key='{{ output_dir }}/server.key' \
292-
-n {{ pgo_operator_namespace }}
293-
when: pgo_tls_result.rc == 1
294-
295273
- name: PGO ConfigMap
296274
tags:
297275
- install

0 commit comments

Comments
 (0)