This test case describes an end-to-end flow for provisioning TLS certificates for OpenShift Routes using the OpenBao PKI engine and cert-manager. Some steps may be duplicates of TC-OPENBAO-PKI-001.
Prerequisites checklist
Confirm these before running steps:
- OpenBao deployed, initialised, and unsealed with admin access
- cert-manager operator installed on OpenShift
- OpenBao Kubernetes auth method configured for cert-manager SA
- Application deployed with a Service in target namespace
1Enable and configure the PKI engine with root CA
bao secrets enable -path=pki pkibao secrets tune -max-lease-ttl=87600h pkibao write -field=certificate pki/root/generate/internal common_name="OpenBao Root CA" ttl=87600h2Enable the intermediate PKI engine and generate CSR
bao secrets enable -path=pki_int pki && bao secrets tune -max-lease-ttl=43800h pki_intbao write -format=json pki_int/intermediate/generate/internal common_name="OpenBao Intermediate CA" | jq -r '.data.csr' > int.csr3Sign the intermediate CSR with the root CA
bao write -format=json pki/root/sign-intermediate csr=@int.csr format=pem_bundle ttl=43800h | jq -r '.data.certificate' > int.crtbao write pki_int/intermediate/set-signed certificate=@int.crt4Create a PKI role for the application domain
bao write pki_int/roles/apps-example allowed_domains=<cluster domain> allow_subdomains=true max_ttl=720h5Create a policy and K8s auth role for cert-manager
bao policy write cert-manager - <<'EOF'
path "pki_int/sign/apps-example" {
capabilities = ["create", "update"]
}
path "pki_int/issue/apps-example" {
capabilities = ["create"]
}
EOFbao write auth/kubernetes/role/cert-manager bound_service_account_names=cert-manager bound_service_account_namespaces=cert-manager policies=cert-manager ttl=1h6Create a ClusterIssuer pointing to OpenBao PKI
Manifest in Commands / YAML tab
Export the base64 string of the CA certificate
oc get secret openbao-ca-secret -n openbao -o jsonpath='{.data.ca\.crt}{"\n"}'Use that string for the ClusterIssuer
7Create a Certificate CR for the Route
Manifest in Commands / YAML tab
Adjust the
<cluster domain> to your cluster domain.8Wait for the certificate to be issued
oc wait --for=condition=Ready certificate/myapp-tls -n myapp --timeout=120s9Verify the TLS secret was created
oc get secret myapp-tls -n myapp10Verify the content of the certificate
oc get secret myapp-tls -n myapp -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -text -noout