Red Hat OpenShift Container Platform

Configuring cert-manager for the external-secrets certificate requirements

You can optionally configure cert-manager to manage certificates for the External Secrets Operator for Red Hat OpenShift webhook and plugins. If you do not use cert-manager, the Operator automatically generates webhook certificates, but you must manually configure certificates for any plugins.

Prerequisites

You have access to the cluster with cluster-admin privileges.
You have created the ExternalSecretsConfig custom resource.
You have installed the cert-manager Operator for Red Hat OpenShift. For more information, see "Installing the cert-manager Operator for Red Hat OpenShift"

Procedure

Edit the ExternalSecretsConfig custom resource by running the following command:
```
$  oc edit externalsecretsconfigs.operator.openshift.io cluster
```
Configure cert-manager by editing the spec.controllerConfig.certProvider.certManager section as follows:
```
apiVersion: operator.openshift.io/v1alpha1
kind: ExternalSecretsConfig
...
spec:
  controllerConfig:
    certProvider:
      certManager:
        injectAnnotations: "true"
        issuerRef:
          name: <issuer_name>
          kind: <issuer_kind>
          group: <issuer_group>
        mode: Enabled
```
where:

injectAnnotation

Must be set to true when enabled.

name

Specifies the name of the issuer object referenced in ExternalSecretsConfig.

kind

Specifies the API issuer. Can be set to either Issuer or ClusterIssuer.

group

Specifies the API issuer group. The group name must be cert-manager.io.

mode

Must be set to Enabled. This is an immutable field and cannot be modified once it is configured.
Save your changes.
After you update the cert-manager configurations in the externalsecretsconfig.operator.openshift.io object, you must manually delete external-secrets-cert-controller deployment by running the following command. This prevents performance degradation of the external-secrets application.
```
$ oc delete deployments.apps external-secrets-cert-controller -n external-secrets
```

Optionally, you can delete other resources created for the cert-controller by running the following commands:

$ oc delete clusterrolebindings.rbac.authorization.k8s.io external-secrets-cert-controller

$ oc delete clusterroles.rbac.authorization.k8s.io external-secrets-cert-controller

$ oc delete serviceaccounts external-secrets-cert-controller -n external-secrets

$ oc delete secrets external-secrets-webhook -n external-secrets