k8s安裝自動證書籤發cert-manager letsencrypt
阿新 • • 發佈：2020-10-10
- 建立 namespace
kubectl create namespace cert-manager
- 安裝 crds
kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml
- 標記名稱空間 cert-manager 為 disable-validation
kubectl lab el namespace cert-manager certmanager.k8s.io/disable-validation=true
- 將 jetstack 加入到 helm repos
helm repo add jetstack https://
charts.jetstack.io - 更新 helm 倉庫
helm repo update
- 使用helm chart 安裝 cert-manager
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v0.11.0/cert-manager.yaml
- 建立 clusterissuer
kubectl apply -f issuer.yaml
# issuer.yaml apiVersion: v1 kind: ClusterIssuer metadata: name: letsencrypt-prod #這裡是issuer的名稱，後面要使用 spec: acme: # 郵箱，證書過期前會發郵件到這個郵箱 email: [email protected] server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: issuer-key solvers: - http01: ingress: class: nginx - 測試
apiVersion: extensions/v1beta1 kind: Ingress metadata: annotations: cert-manager.io/cluster-issuer: letsencrypt-prod #需要使用這個標記，letsencrypt-prod是上面issuer的名稱 name: nginx namespace: default spec: rules: - host: dev.arfront.cn http: paths: - backend: serviceName: nginx servicePort: 80 pathType: ImplementationSpecific tls: - hosts: - dev.arfront.cn secretName: dev.arfront.cn #證書的域名