---
id: tls-cert-manager-self-signed
name: "cert-manager self-signed Issuer -> CA Cert -> CA Issuer -> leaf Cert"
description: >-
  Installs cert-manager with CRDs, applies a self-signed Issuer, a CA Certificate bootstrapping a
  CA Secret, a CA Issuer backed by that Secret, and a leaf Certificate for the product Service
  FQDN. Deploys chart with tls.enabled=true and tls.secretName pointing at the issued Secret.
  Verifies HTTPS 200 with --cacert and SAN match.
labels: {customer: any, profile: tls}
cluster:
  provider: kind
  k8s_version: v1.36.1
  preinstall:
    - kind: helm
      chart: jetstack/cert-manager
      version: v1.14.0
      release: cert-manager
      namespace: cert-manager
      repo:
        name: jetstack
        url: "https://charts.jetstack.io"
      values:
        installCRDs: true
      wait: pods-ready
      wait_timeout: 3m
    # Chain: self-signed Issuer -> CA Certificate -> CA Issuer -> leaf Certificate
    - kind: raw_manifest
      path: chart-test/fixtures/certificates/selfsigned-issuer.yaml
      namespace: sample
    - kind: raw_manifest
      path: chart-test/fixtures/certificates/ca-certificate.yaml
      namespace: sample
    - kind: raw_manifest
      path: chart-test/fixtures/certificates/ca-issuer.yaml
      namespace: sample
    - kind: raw_manifest
      path: chart-test/fixtures/certificates/leaf-certificate.yaml
      namespace: sample
  helm_timeout: 10m
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    tls.enabled: "true"
    tls.secretName: sample-tls
    tls.servicePort: "443"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: smoke-script
    path: chart-test/assertions/tls-cert-manager-self-signed.sh
  - type: tls-cert-valid
    namespace: sample
    tls_secret: "sample-tls"
    tls_host: "sample.sample.svc"
    port: 443
    expected_status: 200
tags: [nightly, curated-live]
mechanisms: ['addon:cert-manager']
category: certificates
integration: cert-manager
tier: live