Store certificate in configmap/secret dynamically;Remove helmchart values

ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/certauthority.yml

@@ -26,24 +26,34 @@
     - argo-cd
     # - kube-system
 
-- name: Store root certificate in namespaced secrets
+- name: Store root certificate in namespaced configmaps/secrets
   kubernetes.core.k8s:
     state: present
-    template: secret.j2
+    template: "{{ item.kind }}.j2"
     kubeconfig: "{{ kubeconfig.path }}"
   vars:
     _template:
-      name: step-certificates-certs
+      name: "{{ item.name }}"
       namespace: "{{ item.namespace }}"
-      key: "{{ item.filename }}"
+      labels: "{{ item.labels | default({}) | indent(width=4, indent=True) }}"
-      value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] | b64encode }}"
+      key: "{{ item.key }}"
+      value: "{{ item.value }}"
   loop:
-    - namespace: argo-cd
+    - name: argocd-tls-certs-cm
-      filename: custom-ca-certificates.crt
+      namespace: argo-cd
-    - namespace: kube-system
+      kind: configmap
-      filename: root_ca.crt
+      labels: |
+        app.kubernetes.io/name: argocd-cm
+        app.kubernetes.io/part-of: argocd
+      key: git.{{ vapp['metacluster.fqdn'] }}
+      value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] }}"
+    - name: step-certificates-certs
+      namespace: kube-system
+      kind: secret
+      key: root_ca.crt
+      value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] | b64encode }}"
   loop_control:
-    label: "{{ item.namespace }}"
+    label: "{{ item.kind + '/' + item.name + ' (' + item.namespace + ')' }}"
 
 - name: Configure step-ca passthrough ingress
   ansible.builtin.template:

ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/init.yml

@@ -5,6 +5,7 @@
     state: present
   loop:
     # TODO: Make this list dynamic
+    - ca
     - git
     - gitops
     - ingress

ansible/roles/firstboot/files/ansible_payload/templates/configmap.j2

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ _template.name }}
+  namespace: {{ _template.namespace }}
+  labels:
+{{ _template.labels }}
+data:
+  "{{ _template.key }}": {{ _template.value }}

ansible/vars/metacluster.yml

@@ -149,26 +149,26 @@ components:
         configs:
           secret:
             argocdServerAdminPassword: "{{ vapp['guestinfo.rootpw'] | password_hash('bcrypt') }}"
-        controller:
+        # controller:
-          volumeMounts:
+        #   volumeMounts:
-            - name: custom-ca-certificates
+        #     - name: custom-ca-certificates
-              mountPath: /etc/ssl/certs/custom-ca-certificates.crt
+        #       mountPath: /etc/ssl/certs/custom-ca-certificates.crt
-              subPath: custom-ca-certificates.crt
+        #       subPath: custom-ca-certificates.crt
-          volumes:
+        #   volumes:
-            - name: custom-ca-certificates
+        #     - name: custom-ca-certificates
-              secret:
+        #       secret:
-                defaultMode: 420
+        #         defaultMode: 420
-                secretName: step-certificates-certs
+        #         secretName: step-certificates-certs
-        repoServer:
+        # repoServer:
-          volumeMounts:
+        #   volumeMounts:
-            - name: custom-ca-certificates
+        #     - name: custom-ca-certificates
-              mountPath: /etc/ssl/certs/custom-ca-certificates.crt
+        #       mountPath: /etc/ssl/certs/custom-ca-certificates.crt
-              subPath: custom-ca-certificates.crt
+        #       subPath: custom-ca-certificates.crt
-          volumes:
+        #   volumes:
-            - name: custom-ca-certificates
+        #     - name: custom-ca-certificates
-              secret:
+        #       secret:
-                defaultMode: 420
+        #         defaultMode: 420
-                secretName: step-certificates-certs
+        #         secretName: step-certificates-certs
         server:
           extraArgs:
             - --insecure
@@ -176,15 +176,15 @@ components:
             enabled: true
             hosts:
               - gitops.{{ vapp['metacluster.fqdn'] }}
-          volumeMounts:
+        #   volumeMounts:
-            - name: custom-ca-certificates
+        #     - name: custom-ca-certificates
-              mountPath: /etc/ssl/certs/custom-ca-certificates.crt
+        #       mountPath: /etc/ssl/certs/custom-ca-certificates.crt
-              subPath: custom-ca-certificates.crt
+        #       subPath: custom-ca-certificates.crt
-          volumes:
+        #   volumes:
-            - name: custom-ca-certificates
+        #     - name: custom-ca-certificates
-              secret:
+        #       secret:
-                defaultMode: 420
+        #         defaultMode: 420
-                secretName: step-certificates-certs
+        #         secretName: step-certificates-certs
 
   sealed-secrets:
     helm: