Install "Cert Utils Operator" using Deployer

[Alan111S]

Is your feature request related to a problem? Please describe.
No

Describe the solution you'd like
We would like to use the RedHat Certificate Manager to setup SSL Certificates on our Ingress Operators (on AWS). As a result we need a Community built operator "Cert Utils Operator" added to our clusters. Would this be possible to install via Cloud Pak Deployer ?

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
For more information, please see this blog post here:-
https://blog.stderr.at/openshift/2023/02/ssl-certificate-management-for-openshift-on-aws/

[fketelaars]

Instead, a script can potentially be used:

#!/bin/sh

# Cluster Certificate Install/Renewal Script based on information in this article
# https://www.redhat.com/en/blog/requesting-and-installing-lets-encrypt-certificates-for-openshift-4

if [ $1 != "install" ] && [ $1 != "renew" ]; then
	echo
	echo "Syntax is '$0 install' or '$0 renew'"
	exit 1
fi

cd $HOME

export CLUSTER_ID=$(echo $HOSTNAME | cut -d- -f1)

echo "Checking KUBECONFIG is set and file exists"
if [ ! -f ${KUBECONFIG} ]; then
	echo "KUBECONFIG file does not exist so can't login"
	read -p "Press Enter to continue ..."
	exit 1
fi

# Add oc path to environment
if ! [[ "$PATH" =~ "/usr/local/bin" ]]
then
	export PATH="/usr/local/bin:$PATH"
fi

${OC_LOGIN}
if [ $? -gt 0 ]; then 
	echo "Login to Cluster ${CLUSTER_ID} failed. Cluster may be shut down."
	exit 1
fi

export LE_API=$(oc whoami --show-server | cut -f 2 -d ':' | cut -f 3 -d '/' | sed 's/-api././')
export LE_WILDCARD=$(oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.status.domain}')
export CERTDIR=$HOME/certificates
mkdir -p ${CERTDIR}

if [ ! -d ${HOME}/acme.sh ]; then
	echo "Cloning acme.sh ..."
	git clone https://github.com/neilpang/acme.sh
fi

echo "Pulling acme.sh ..."
cd ${HOME}/acme.sh
git pull https://github.com/neilpang/acme.sh
cd ${HOME}

if [[ "$1" == "install" ]]; then
	echo
	echo "Removing any existing acme.sh Account Details..."
	rm -rf ${HOME}/.acme.sh

	echo
	echo "Issuing Certificates ..."
	${HOME}/acme.sh/acme.sh --issue -d ${LE_API} -d *.${LE_WILDCARD} --dns dns_aws --server letsencrypt

	echo
	echo "Installing Certificates to ${CERTDIR} ..."
	${HOME}/acme.sh/acme.sh --install-cert -d ${LE_API} -d *.${LE_WILDCARD} --cert-file ${CERTDIR}/cert.pem --key-file ${CERTDIR}/key.pem --fullchain-file ${CERTDIR}/fullchain.pem --ca-file ${CERTDIR}/ca.cer

	echo
	echo "Installing Certificates for the Default Ingress Controllers"
	oc create secret tls router-certs --cert=${CERTDIR}/fullchain.pem --key=${CERTDIR}/key.pem -n openshift-ingress --dry-run=client -o yaml | oc apply -f -
	oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" }}}'
fi

if [[ "$1" == "renew" ]]; then
	echo
	echo "Renewing Certificates ..."
	${HOME}/acme.sh/acme.sh --renew -d ${LE_API} -d *.${LE_WILDCARD} --dns dns_aws --server letsencrypt $2 # NOTE: $2 is to allow passthrough of --force parameter

	echo
	echo "Updating Certificates for the Default Ingress Controllers"
	oc create secret tls router-certs --cert=${CERTDIR}/fullchain.pem --key=${CERTDIR}/key.pem -n openshift-ingress --dry-run=client -o yaml | oc apply -f -
fi