[patch] Support Let's Encrypt HTTP-01 for path routing mode

python/src/mas/cli/install/app.py

@@ -944,6 +944,19 @@ def configRoutingMode(self):
             else:
                 self.setParam("mas_routing_mode", "subdomain")
 
+            # After routing mode is confirmed as path, offer Let's Encrypt HTTP-01.
+            if self.getParam("mas_routing_mode") == "path":
+                self.printDescription(
+                    [
+                        "",
+                        "Let's Encrypt HTTP-01 can automatically issue trusted certificates for your domain",
+                        "Note: your cluster must be publicly accessible on port 80 from the internet.",
+                    ]
+                )
+                if self.yesOrNo("Do you want to use Let's Encrypt for certificate management"):
+                    self.promptForString("Let's Encrypt e-mail", "mas_le_email")
+                    self.setParam("mas_cluster_issuer", f"{self.getParam('mas_instance_id')}-http01-le-prod")
+
     def _checkIngressControllerForPathRouting(self, controllerName="default"):
         """Check if a specific IngressController exists and is configured for path-based routing.
 
@@ -2909,6 +2922,26 @@ def install(self, argv):
             else:
                 logger.info(f"IngressController '{ingressControllerName}' is already configured for path-based routing")
 
+        # Validate Let's Encrypt HTTP-01 flags
+        if not self.isInteractiveMode:
+            leEmail = self.getParam("mas_le_email")
+
+            if leEmail and self.getParam("mas_routing_mode") != "path":
+                self.fatalError(
+                    "\n".join(
+                        [
+                            "Let's Encrypt HTTP-01 Requires Path-Based Routing",
+                            "========================================================================",
+                            "--le-email is only supported with path-based routing mode.",
+                            "Remove --le-email or switch to path routing:",
+                            "   mas install --routing path --le-email [email] ...",
+                        ]
+                    )
+                )
+
+            if leEmail and not self.getParam("mas_cluster_issuer"):
+                self.setParam("mas_cluster_issuer", f"{self.getParam('mas_instance_id')}-http01-le-prod")
+
         # Based on the parameters set the annotations correctly
         self.configAnnotations()
         self.displayInstallSummary()

python/src/mas/cli/install/argParser.py

@@ -243,6 +243,13 @@ def isValidFile(parser: argparse.ArgumentParser, arg: str) -> str:
     help="Provide the name of the ClusterIssuer to configure MAS to issue certificates",
 )
 
+masAdvancedArgGroup.add_argument(
+    "--le-email",
+    dest="mas_le_email",
+    required=False,
+    help="E-mail address to register with Let's Encrypt. Providing this implicitly enables Let's Encrypt HTTP-01 certificate management (path routing mode only, cluster must be publicly accessible on port 80)",
+)
+
 masAdvancedArgGroup.add_argument(
     "--mas-issuer-kind",
     dest="mas_issuer_kind",

python/src/mas/cli/install/params.py

@@ -75,6 +75,8 @@
     "dns_provider",
     "mas_cluster_issuer",
     "ocp_ingress",
+    # Let's Encrypt HTTP-01
+    "mas_le_email",
     # CIS
     "cis_email",
     "cis_apikey",

python/src/mas/cli/install/summarizer.py

@@ -153,6 +153,12 @@ def masSummary(self) -> None:
         if self.getParam("mas_routing_mode") == "path":
             self.printParamSummary("IngressController Name", "mas_ingress_controller_name")
             self.printParamSummary("Configure IngressController", "mas_configure_ingress")
+            if self.getParam("mas_le_email") != "":
+                self.printSummary("Let's Encrypt HTTP-01", "Enabled")
+                self.printParamSummary("Let's Encrypt e-mail", "mas_le_email")
+                self.printParamSummary("Let's Encrypt Issuer", "mas_cluster_issuer")
+            else:
+                self.printSummary("Let's Encrypt HTTP-01", "Disabled")
 
         if self.getParam("mas_manual_route_mgmt") == "true":
             self.printParamSummary("Manual Routes", "mas_manual_route_mgmt")

python/tests/integration/install/test_arcgis_cluster_mode.py

@@ -35,7 +35,10 @@ def test_install_arcgis_cluster_mode_success(tmpdir):
         ".*Select catalog.*": lambda msg: "v9-master-amd64",
         ".*Select channel.*": lambda msg: "9.2.x-dev",  # Use 9.2.x-dev channel
         # 4. Routing Mode Configuration - Select subdomain routing (simplest for this test)
-        ".*Routing Mode.*": lambda msg: "2",  # Select subdomain routing
+        ".*Routing Mode.*": lambda msg: "2",  # Select subdomain routing, 1 for path-based routing
+        # Note: IngressController selection prompt does NOT appear because there's only one controller
+        # 4.1. Let's Encrypt HTTP-01 - decline, use existing cert setup
+        # ".*Do you want to use Let.*s Encrypt.*": lambda msg: "n",
         # 5. Service Mesh Configuration
         ".*Enable OpenShift Service Mesh support for MAS.*": lambda msg: "y",
         # 5. Storage classes
@@ -197,6 +200,8 @@ def test_install_arcgis_namespace_mode_error(tmpdir, caplog):
         ".*Select channel.*": lambda msg: "9.2.x-dev",
         # 4. Routing Mode Configuration
         ".*Routing Mode.*": lambda msg: "1",
+        # 4.1. Let's Encrypt HTTP-01 - decline, use existing cert setup
+        ".*Do you want to use Let.*s Encrypt.*": lambda msg: "n",
         # 5. Service Mesh Configuration
         ".*Enable OpenShift Service Mesh support for MAS.*": lambda msg: "y",
         # 6. Configure IngressController
@@ -338,6 +343,8 @@ def test_install_arcgis_minimal_mode_error(tmpdir, caplog):
         ".*Select channel.*": lambda msg: "9.2.x-dev",
         # 4. Routing Mode Configuration
         ".*Routing Mode.*": lambda msg: "1",
+        # 4.1. Let's Encrypt HTTP-01 - decline, use existing cert setup
+        ".*Do you want to use Let.*s Encrypt.*": lambda msg: "n",
         # 5. Service Mesh Configuration
         ".*Enable OpenShift Service Mesh support for MAS.*": lambda msg: "y",
         # 6. Configure IngressController

python/tests/integration/install/test_dev_mode.py

@@ -250,7 +250,9 @@ def test_install_master_dev_mode_with_path_routing(tmpdir):
         # 4. Routing Mode Configuration - Select path-based routing
         ".*Routing Mode.*": lambda msg: "1",  # Select path-based routing
         # Note: IngressController selection prompt does NOT appear because there's only one controller
-        # 5. Service Mesh Configuration - to use service mesg
+        # 4.1. Let's Encrypt HTTP-01 - decline, use existing cert setup
+        ".*Do you want to use Let.*s Encrypt.*": lambda msg: "n",
+        # 5. Service Mesh Configuration - to use service mesh
         ".*Enable OpenShift Service Mesh support for MAS.*": lambda msg: "y",  # Select to use service mesh
         # 5. Configure IngressController for path-based routing
         ".*Configure ingress namespace ownership.*": lambda msg: "y",  # Agree to configure