この記事はなむゆの個人ブログにも投稿しています。

https://namyusql.hatenablog.com/entry/2024-05-16-cert-manager-simple-doc

はじめに

cert-manager とは

apiVersion: v1
    kind: Secret
    metadata:
      name: my-cert-tls
    type: kubernetes.io/tls
    data:
      ca.crt: <PEM CA certificate>
      tls.key: <PEM private key>
      tls.crt: <PEM signed certificate chain>
      tls-combined.pem: <PEM private key + "\n" + PEM signed certificate chain>
      key.der: <DER binary format of private key>

インストール方法

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.yaml

helm repo add jetstack https://charts.jetstack.io --force-update
    helm repo update
    

helm install \
      cert-manager jetstack/cert-manager \
      --namespace cert-manager \
      --create-namespace \
      --version v1.14.5 \
      --set installCRDs=true

インストールされるカスタムリソース例

apiVersion: cert-manager.io/v1
    kind: Issuer
    metadata:
      name: ca-issuer
      namespace: mesh-system
    spec:
      ca:
        secretName: ca-key-pair

apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: letsencrypt-staging
    spec:
      acme:
        server: https://acme-staging-v02.api.letsencrypt.org/directory
        email: $EMAIL_ADDRESS
        privateKeySecretRef:
          name: letsencrypt-staging
        solvers:
        - dns01:
            azureDNS:
              hostedZoneName: $AZURE_ZONE_NAME
              resourceGroupName: $AZURE_RESOURCE_GROUP
              subscriptionID: $AZURE_SUBSCRIPTION_ID
              environment: AzurePublicCloud
              managedIdentity:
                clientID: $IDENTITY_CLIENT_ID

apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: example-com
      namespace: sandbox
    spec:
      # Secret names are always required.
      secretName: example-com-tls
      # secretTemplate is optional. If set, these annotations and labels will be
      # copied to the Secret named example-com-tls. These labels and annotations will
      # be re-reconciled if the Certificate's secretTemplate changes. secretTemplate
      # is also enforced, so relevant label and annotation changes on the Secret by a
      # third party will be overwriten by cert-manager to match the secretTemplate.
      secretTemplate:
        annotations:
          my-secret-annotation-1: "foo"
          my-secret-annotation-2: "bar"
        labels:
          my-secret-label: foo
      duration: 2160h # 90d
      renewBefore: 360h # 15d
      subject:
        organizations:
          - jetstack
      # The use of the common name field has been deprecated since 2000 and is
      # discouraged from being used.
      commonName: example.com
      isCA: false
      privateKey:
        algorithm: RSA
        encoding: PKCS1
        size: 2048
      usages:
        - server auth
        - client auth
      # At least one of a DNS Name, URI, IP address or otherName is required.
      dnsNames:
        - example.com
        - www.example.com
      uris:
        - spiffe://cluster.local/ns/sandbox/sa/example
      ipAddresses:
        - 192.168.0.5
      # Needs cert-manager 1.14+ and "OtherNames" feature flag
      otherNames:
        # Should only supply oid of ut8 valued types
        - oid: 1.3.6.1.4.1.311.20.2.3 # User Principal Name "OID"
          utf8Value: upn@example.local
      # Issuer references are always required.
      issuerRef:
        name: ca-issuer
        # We can reference ClusterIssuers by changing the kind here.
        # The default value is Issuer (i.e. a locally namespaced Issuer)
        kind: Issuer
        # This is optional since cert-manager will default to this value however
        # if you are using an external issuer, change this to that issuer group.
        group: cert-manager.io
      # keystores allows adding additional output formats. This is an example for reference only.
      keystores:
        pkcs12:
          create: true
          passwordSecretRef:
            name: example-com-tls-keystore
            key: password
          profile: Modern2023

何か問題が起きたときは

おわりに

参考

• cert-manager