lonelycz / gsoc-2022-cncf-report

The final report of my GSoC project in CNCF.

GSoC 2022 Final Report

Organization: CNCF

Project: Tooling to deploy and cross-configure cert-manager with external dependencies by Terraform

Proposal: https://docs.google.com/document/d/14oJux-d-91Do3DLi5eRG-wUEE4R3Hh7D4u0Yfje3auw/edit?usp=sharing

Issue: cert-manager/cert-manager#4855

Code: https://github.com/cert-manager/testing-addons

Introduction

This is my first trip to GSoC and I am honored to be selected by CNCF organization and gradually complete this project in three months.

Firstly, I am very grateful to my mentor Irbe Krumina, who gave me great help and patient guidance from the discussion of the scheme to the writing of the proposal, to the development of the project. And thanks to the Cert-Manager Team, I felt the friendliness and professionalism of the team members in the process of participating in the daily stand-up meeting, and it was a wonderful experience to work with you.

I built tooling to help cert-manager maintainers to deploy cert-manager together with some its dependencies and built a framework that will allow maintainers and community to add Terraform modules to deploy other dependencies. We think this will significantly save time for cert-manager developers when testing with external dependencies locally.

Work Done

Discuss the scheme and write a formal proposal

I actively participated in the design phase of the project, actively discussed with the mentor under this issue, compared the advantages and disadvantages of CLI, Script and Terraform modules, and finally chose to use Terraform to design and develop this project, and completed the final proposal.

Initialize the project and add cert-manager and vault workflow

Firstly, the mentor created a new code repository called testing-addons and released the task in the form of an issue, where we discussed some technical details.

I improved this repository as PRs, including adding Readme and adding linter scripts to the CI process, and implemented the deployment and configuration of Cert-manager and Vault workloads using tools such as Terraform, Terragrunt and Helm. It divide the entire workflow into cm-install, vault-install, cm-config and vault-config Terraform modules, the Terragrunt workflow is responsible for organizing them.

List of PRs to finish these works:

• cert-manager/testing-addons#5
• cert-manager/testing-addons#6
• cert-manager/testing-addons#11
• cert-manager/testing-addons#12
• cert-manager/testing-addons#13
• cert-manager/testing-addons#14
• cert-manager/testing-addons#19
• cert-manager/testing-addons#20
• cert-manager/testing-addons#21
• cert-manager/testing-addons#22
• cert-manager/testing-addons#26
• cert-manager/testing-addons#27
• cert-manager/testing-addons#29
• cert-manager/testing-addons#30
• cert-manager/testing-addons#32
• cert-manager/testing-addons#34

Add Gateway and Ingress workflows

Since the structure design of the project has been completed in the previous stage, adding a new workflow only needs to divide Terraform modules according to functions, and the project expansion is more convenient.

Adding the Gateway and Ingress workflows is generally smooth, but testing ACME requires public cloud services, and I am very grateful to my mentor for helping to test this feature.

List of PRs to finish these works:

• cert-manager/testing-addons#31
• cert-manager/testing-addons#36
• cert-manager/testing-addons#37
• cert-manager/testing-addons#40

Future Work

Since a relatively complete workflow template is already available, more external dependency test workflows can be easily added later, such as Prometheus/Grafana workflow.

It would be nice to be able to reuse specific Terraform modules to reduce maintenance of duplicate code, but so far there is no better way to refactor terraform modules to allow sharing cert-manager installation code. This issue is worth continuing to explore.

It may have been good to add to the Readme how a developer should add a new workflow.

Conclusion

With this, the project was finally completed. We designed and developed a tool to deploy and cross-configure cert-manager with external dependencies that can reduce the amount of time maintainers spend figuring out how to setup necessary infrastructure for different scenarios in which cert-manager can be used (i.e. to reproduce user reported bugs).

If you want to use the project, you can clone the testing-addons repository locally and deploy the workflow that you need.

I also presented my work at the bi-weekly cert-manager developer meeting on 27th July 2022.

The video recording of the meeting can be found at https://www.youtube.com/watch?v=dub3x5qRTqc&ab_channel=cert-manager.