Set up OpenShift with cert-manager certificate

Use this installation path when you deploy on OpenShift and you want cert-manager to issue and renew the front-end and backend certificates automatically.

In this mode:

Cert-manager creates the certificates and the related TLS secrets.
You do not create TLS secrets before you install the chart.
On OpenShift, you must update the Route after the certificates are ready.

Before you begin

Complete the common setup steps from Set up FlashSystem.ai container.
Verify that cert-manager is installed in the cluster.
Identify the Issuer or ClusterIssuer that your cluster uses.
Ensure that your Route hostname resolves to the OpenShift router.

Configure Helm values

Configure the Helm chart values file
Configure the Helm chart values file before you deploy FlashSystem.ai.
Configure values.yaml
Run the script from the extracted Helm chart directory:
scripts/configure-values.sh

Note: If you have not already created a namespace for FlashSystem.ai, enter Y when the script prompts you to create a namespace during the Helm installation. If you already created a namespace, enter N and specify the existing namespace.

The script:

Updates the values.yaml file with deployment-specific settings.

Uses the default resource names that are referenced throughout this deployment guide.

Prompts for alternative values if you changed any resource names from the defaults.

Creates the namespace, if required.

Install the Helm chart

Install the chart in the target project:

helm install flashsystem-app . -f values.yaml -n flashsystem-app

Wait for certificates to become ready

Cert-manager creates the TLS secrets asynchronously. Wait until both certificates are ready:

oc get certificates -n flashsystem-app

oc wait --for=condition=Ready \
  certificate/flashsystem-app-frontend-tls \
  -n flashsystem-app --timeout=300s

oc wait --for=condition=Ready \
  certificate/flashsystem-app-backend-tls \
  -n flashsystem-app --timeout=300s

If the certificates do not become ready, review the cert-manager logs:

oc logs -n cert-manager -l app=cert-manager

Update the Route after certificate issuance
OpenShift Routes store certificate content in the Route specification. The initial helm install can create the Route before cert-manager creates the secrets. After the certificates are ready, run helm upgrade to update the Route with the issued certificate:
```
helm upgrade flashsystem-app . -f values.yaml -n flashsystem-ap
```
Verify that the Route includes TLS configuration:
```
oc describe route flashsystem-app-route -n flashsystem-app | grep -A 5 "TLS"
```

Next step

Configure FlashSystem systems for FlashSystem.ai.