Find a way to make TLS required

[dtantsur]

Currently, if tlsRef is not provided, TLS is not enabled. I don't think anybody should be deploying without TLS, even if it's just a self-signed certificate. Options to consider:

1. Just error out (ideally, on the webhook level) if the TLS secret is not provided. This is a bit nuclear but also the simplest path.
2. Use cert-manager to generate a self-signed certificate. If cert-manager is not available, either fail or go to 3.
3. Generate a self-signed certificate locally. This is not a great option since it may be quite hard to refresh the certificate generated this way (cert-manager does it for free).

Same thing needs to be done with MariaDB.

Let's start with researching what other established operators (prometheus, postgresql, etc) are doing in this area.

/kind enhancement
/help

[metal3-io-bot]

@dtantsur:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

Currently, if tlsRef is not provided, TLS is not enabled. I don't think anybody should be deploying without TLS, even if it's just a self-signed certificate. Options to consider:

1. Just error out (ideally, on the webhook level) if the TLS secret is not provided. This is a bit nuclear but also the simplest path.
2. Use cert-manager to generate a self-signed certificate. If cert-manager is not available, either fail or go to 3.
3. Generate a self-signed certificate locally. This is not a great option since it may be quite hard to refresh the certificate generated this way (cert-manager does it for free).

Same thing needs to be done with MariaDB.

Let's start with researching what other established operators (prometheus, postgresql, etc) are doing in this area.

/kind enhancement
/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[metal3-io-bot]

@dtantsur: The label(s) kind/enhancement cannot be applied, because the repository doesn't have them.

In response to this:

Currently, if tlsRef is not provided, TLS is not enabled. I don't think anybody should be deploying without TLS, even if it's just a self-signed certificate. Options to consider:

1. Just error out (ideally, on the webhook level) if the TLS secret is not provided. This is a bit nuclear but also the simplest path.
2. Use cert-manager to generate a self-signed certificate. If cert-manager is not available, either fail or go to 3.
3. Generate a self-signed certificate locally. This is not a great option since it may be quite hard to refresh the certificate generated this way (cert-manager does it for free).

Same thing needs to be done with MariaDB.

Let's start with researching what other established operators (prometheus, postgresql, etc) are doing in this area.

/kind enhancement
/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Rozzii]

/triage accepted