We currently issue TLS certificate for the service-proxy (envoy) manually via cergen (https://wikitech.wikimedia.org/wiki/Kubernetes/Enabling_TLS#Create_and_place_certificates).
When cert-manager (T294560) is deployment to all clusters , we should move the service-proxy certificate creation away from cergen and into the helm charts. We should ensure that we issue those certificates for cluster internal as well as the "usual" external names.
When that is done, the validation of SANs in istio-ingressgateway should be limited to the internal FQDN of a service (https://gerrit.wikimedia.org/g/operations/deployment-charts/+/refs/changes/74/732374/15/common_templates/0.4/_ingress_helpers.tpl#180)
**todos**:
[x] add module code to support cert-manager certificates
[x] deploy and at least one chart for >2 days (cert rotation in staging) including ingress
[x] enable cert-manager by default in helmfile globals
[ ] update all charts and switch all services to cert-manager
[x] apertium
[x] blubberoid
[ ] calculator-service https://gerrit.wikimedia.org/r/c/967403
[x] cassandra-http-gateway
[x] changeprop https://gerrit.wikimedia.org/r/c/958484
[x] chromium-render https://gerrit.wikimedia.org/r/c/958473
[x] citoid
[x] cxserver
[ ] developer-portal https://gerrit.wikimedia.org/r/c/958479
[ ] eventgate https://gerrit.wikimedia.org/r/c/959181
[ ] eventstreams https://gerrit.wikimedia.org/r/c/967402
[ ] ~~fastapi-app~~ (replaced by python-webapp)
[x] flink-app
[ ] ~~flink-session-cluster~~ (will go away mid-term, T326409)
[x] function-evaluator
[x] function-orchestrator
[x] ipoid
[x] linkrecommendation
[x] machinetranslation https://gerrit.wikimedia.org/r/c/960625
[x] mathoid https://gerrit.wikimedia.org/r/c/953261
[x] mediawiki
[x] miscweb https://gerrit.wikimedia.org/r/c/958476
[x] mobileapps https://gerrit.wikimedia.org/r/c/967405
[x] push-notifications https://gerrit.wikimedia.org/r/961078
[x] python-webapp
[x] recommendation-api https://gerrit.wikimedia.org/r/c/967406
[x] shellbox https://gerrit.wikimedia.org/r/c/967410
[x] shellbox (score)
[x] shellbox-constraints
[x] shellbox-media
[x] shellbox-syntaxhighlight
[x] shellbox-timeline
[x] similar-users https://gerrit.wikimedia.org/r/c/967473
[x] tegola-vector-tiles https://gerrit.wikimedia.org/r/961077
[ ] termbox https://gerrit.wikimedia.org/r/c/967412
[x] thumbor
[x] toolhub
[ ] wikifeeds https://gerrit.wikimedia.org/r/c/967414
[ ] zotero https://gerrit.wikimedia.org/r/c/967415
[ ] remove cergen code from helm mesh module, scaffolding etc. as well as it's values from all the fixtures
[ ] remove trust for the various subjectAltNames from cergen in ingress module (see: `ingress.istio.destinationrule`)
[ ] drop the certs from private puppet
**To update a chart**:
Check cergen config for additional alt names in:
/srv/private/modules/secret/secrets/certificates/certificate.manifests.d/kube_services.certs.yaml
**Note: ** The following domain names can be omitted as they are included by default:
* discovery.wmnet,
* svc.codfw.wmnet
* svc.eqiad.wmnet
Update the chart and deployment config
CHART=apertium
sextant update charts/${CHART}/ mesh.deployment
git add charts/${CHART}/
# If additional alt names are required, they must be added as a list under mesh.certmanager.extraFQDNs
vim helmfile.d/services/${CHART}/values.yaml
git add helmfile.d/services/${CHART}/values.yaml
git commit -m "Update ${CHART} to use certmanager certs" -m "This updates the chart to use a certmanager instead of cergen certificates" -m "Bug: T300033"