This message was deleted.

I am interested is doing same thing. Hope ther eis process to to use fqdn for mgmt IP and integrate with LE to get certs generated/renewed.

When I have created a Harvester cluster which I expected to use a LetsEncrypt cert on the management web interface URL, I installed Harvester, grabbed

/etc/rancher/rke2/rke2.yaml

from the node, edited the server URL in that file so that the file worked in for

kubectl --kubeconfig harvester-rke2.yaml

, grabbed the already created cert and pushed it into the appropriate CRD. This script is horrible, but shows you the CRD and the format of the expected data.

#!/bin/bash
set -e

publicCertificate=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ${CERTBOT_HOME}/etc/live/${DOMAIN}/fullchain.pem)
privateKey=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ${CERTBOT_HOME}/etc/live/${DOMAIN}/privkey.pem)

cat << EOF | kubectl apply -f - --kubeconfig harvester-rke2.yaml
apiVersion: harvesterhci.io/v1beta1
kind: Setting
metadata:
  name: ssl-certificates
value: >-
  {
    "publicCertificate":"${publicCertificate}",
    "privateKey":"${privateKey}"
  }
EOF

I used that script for a while, but now I use

kubectl kustomize

piped into

envsubst

piped into

kubectl apply

because that seems less hacky.