fix: certificate issues

[alejandroEsc]

Here I am fixing a few issues I have found so far that may be causing @JakeSCahill from being able to properly create a certificate with ACME.

Part of #203

[joejulian]

Also remove commonName https://github.com/redpanda-data/helm-charts/pull/289/files#diff-ec07f07a47aa911db2b476d9fcdd33907646aadab5e83db1e9aa13d36ab671e5R37

[JakeSCahill]

Thanks @alejandroEsc!

It looks like caEnabled is also ignored.

I'm seeing a root certificate being generated even if I specify tls.cert.redpanda.caEnabled=false.

This is causing a failed Certificate to be generated that is looking for an Issuer called redpanda-redpanda-self-signed-issuer:

Normal  IssuerNotFound      12m   cert-manager-certificaterequests-issuer-selfsigned  Referenced "Issuer" not found: issuer.cert-manager.io "redpanda-redpanda-selfsigned-issuer" not found

redpanda       redpanda-default-cert                     True    redpanda-default-cert                     15m
redpanda       redpanda-default-root-certificate         True    redpanda-default-root-certificate         15m
redpanda       redpanda-redpanda-cert                    True    redpanda-redpanda-cert                    15m
redpanda       redpanda-redpanda-root-certificate        False   redpanda-redpanda-root-certificate        15m

[JakeSCahill]

I'm now able to get TLS working with Let's Encrypt and a custom domain 🎉 thanks @alejandroEsc !

This isn't a blocker, but I still get this disused root Certificate being created: #289 (comment)

[alejandroEsc]

redpanda redpanda-default-root-certificate True redpanda-default-root-certificate 15m

What I am seeing is what I was hoping not to see, so we may have to change a few things about certs but when i compute the values file from what you are doing, and even when i use my own values file, i get the following:

...
tls:
  certs:
    default:
      caEnabled: true
    redpanda:
      caEnabled: false
      issuerRef:
        kind: ClusterIssuer
        name: letsencrypt-prod
  enabled: true
tuning: {}
...

This is why the default cert is created. Ill investigate this a bit further.

[joejulian]

This is a breaking change and I think it's still broken if someone uses a different issuer for the admin cert. We need to find a way to test this with different issuers.

[alejandroEsc]

Closing this PR. This will fix the issues we see when trying to use certs meant for external clients internally.