簡介

詳情請到GitHub查看：https://github.com/PowerDos/k8s-cret-manager-aliyun-webhook-demo

這里介紹如何在K8s中通過cret-manager自動創(chuàng)建HTTPS證書，提供兩種方式赏寇，一種是單域名證書，一種是通過阿里云DNS驗證實現(xiàn)通配符域名證書申請

我們這里通過Helm安裝cret-manager,請注意查看k8s版本正確安裝對應(yīng)版本的應(yīng)用

1.安裝Helm 3

官方安裝教程: https://helm.sh/docs/intro/install/

$ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
$ chmod 700 get_helm.sh
$ ./get_helm.sh

2.安裝cert-manager

前期準(zhǔn)備

添加命名空間

kubectl create namespace cert-manager

添加cret-manager源

helm repo add jetstack https://charts.jetstack.io

更新源

helm repo update

安裝CRDs

注意安裝對應(yīng)的版本

# Kubernetes 1.15+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager.crds.yaml

# Kubernetes <1.15
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager-legacy.crds.yaml

安裝cert-manager

$ helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v0.15.1

驗證是否安裝成功

以下結(jié)果為成功，你也可以看看鏡像日志脐彩，是否正常啟動碎乃，是否正常

$ kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-5c6344597-zw8kh               1/1     Running   0          2m
cert-manager-cainjector-348f6d9fd7-tr77l   1/1     Running   0          2m
cert-manager-webhook-893u48fcdb-nlzsq      1/1     Running   0          2m

3.安裝證書

官方介紹這中 Issuer 與 ClusterIssuer 的概念：

Issuers, and ClusterIssuers, are Kubernetes resources that represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request.

Issuer 與 ClusterIssuer 的區(qū)別是 ClusterIssuer 可跨命名空間使用荠锭，而 Issuer 需在每個命名空間下配置后才可使用共虑。這里我們使用 ClusterIssuer蓬蝶，其類型選擇 Let‘s Encrypt

測試證書

# cluster-issuer-letsencrypt-staging.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # 務(wù)必將此處替換為你自己的郵箱, 否則會配置失敗。當(dāng)證書快過期時 Let's Encrypt 會與你聯(lián)系
    email: gavin.tech@qq.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # 將用來存儲 Private Key 的 Secret 資源
      name: letsencrypt-staging
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
    - http01:
        ingress:
          class: nginx

正式證書

# cluster-issuer-letsencrypt-prod.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email:  gavin.tech@qq.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

這里安裝兩個環(huán)境的證書的作用

這里分別配置了測試環(huán)境與生產(chǎn)環(huán)境兩個 ClusterIssuer谍咆，原因是 Let’s Encrypt 的生產(chǎn)環(huán)境有著非常嚴(yán)格的接口調(diào)用限制禾锤，最好是在測試環(huán)境測試通過后，再切換為生產(chǎn)環(huán)境供嚎。生產(chǎn)環(huán)境和測試環(huán)境的區(qū)別：https://letsencrypt.org/zh-cn/docs/staging-environment/

在Ingress中使用證書

在ingress配置后黄娘，會自動生成證書

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kuard
  annotations:
    # 務(wù)必添加以下兩個注解, 指定 ingress 類型及使用哪個 cluster-issuer
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer："letsencrypt-staging" # 這里先用測試環(huán)境的證書測通后，就可以替換成正式服證書

    # 如果你使用 issuer, 使用以下注解 
    # cert-manager.io/issuer: "letsencrypt-staging"
spec:
  tls:
  - hosts:
    - example.example.com                # TLS 域名 - 這里僅支持單域名查坪，下面會講通配符的域名配置
    secretName: quickstart-example-tls   # 用于存儲證書的 Secret 對象名字寸宏，可以是任意名稱，cert-manager會自動生成對應(yīng)名稱的證書名稱
  rules:
  - host: example.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kuard
          servicePort: 80

4.通過DNS配置通配符域名證書

這里樣式的是阿里云DNS操作的流程偿曙，如果需要其他平臺的方法氮凝，可以自行開發(fā)，或者找已開源webhook望忆，這是官方的例子：https://github.com/jetstack/cert-manager-webhook-example

這里用的是這個包：https://github.com/pragkent/alidns-webhook

安裝WebHook

不同cret-manager的安裝辦法不同

cret-manager 版本大于等于v0.11

安裝

# Install alidns-webhook to cert-manager namespace. 
kubectl apply -f https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/bundle.yaml

添加阿里云RAM賬號

子賬號需要開通HTTPS管理權(quán)限(AliyunDNSFullAccess,管理云解析（DNS）的權(quán)限)

apiVersion: v1
kind: Secret
metadata:
  name: alidns-secret
  namespace: cert-manager
data:
  access-key: YOUR_ACCESS_KEY # 需要先base64加密
  secret-key: YOUR_SECRET_KEY # 需要先base64加密

創(chuàng)建ClusterIssuer

測試證書申請

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging-dns
spec:
  acme:
    email: gavin.tech@qq.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com # 注意這里要改動罩阵，在https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/bundle.yaml中也要改動對應(yīng)的groupName
          solverName: alidns
          config:
            region: ""
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

正式證書申請

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod-dns
spec:
  acme:
    email: gavin.tech@qq.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com
          solverName: alidns
          config:
            region: "" # 這里可以不填 或者填對應(yīng)的區(qū)域:cn-shenzhen
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

創(chuàng)建Certificate

測試證書

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ditigram-com-staging-tls
spec:
  secretName: ditigram-com-staging-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-staging-dns
    kind: ClusterIssuer

正式證書

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ditigram-com-prod-tls
spec:
  secretName: ditigram-com-prod-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-prod-dns
    kind: ClusterIssuer

在Ingress中應(yīng)用

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kuard
  annotations:
    # 務(wù)必添加以下兩個注解, 指定 ingress 類型及使用哪個 cluster-issuer
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer："letsencrypt-staging-dns" # 這里先用測試環(huán)境的證書測通后，就可以替換成正式服證書
spec:
  tls:
  - hosts:
    - "*.ditigram.com"                     # 如果填寫單域名就只會生產(chǎn)單域名的證書启摄，如果是通配符請?zhí)顚?*.example.com", 注意：如果填寫example.com只會生成www.example.com一個域名稿壁。
    secretName: ditigram-com-staging-tls   # 測試的證書，填寫剛剛創(chuàng)建Certificate的名稱歉备，注意更換環(huán)境時證書也要一起更換傅是，這里并不會像單域名一樣自動生成
  rules:
  - host: example.ditigram.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kuard
          servicePort: 80

cret-manager 版本小于v0.11

安裝

# Install alidns-webhook to cert-manager namespace. 
kubectl apply -f https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/legacy.yaml

添加阿里云RAM賬號

子賬號需要開通HTTPS管理權(quán)限(AliyunDNSFullAccess,管理云解析（DNS）的權(quán)限)

apiVersion: v1
kind: Secret
metadata:
  name: alidns-secret
  namespace: cert-manager
data:
  access-key: YOUR_ACCESS_KEY # 需要先base64加密
  secret-key: YOUR_SECRET_KEY # 需要先base64加密

創(chuàng)建ClusterIssuer

測試證書申請

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging-dns
spec:
  acme:
    email: gavin.tech@qq.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com # 注意這里要改動，在https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/bundle.yaml中也要改動對應(yīng)的groupName
          solverName: alidns
          config:
            region: ""
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

正式證書申請

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod-dns
spec:
  acme:
    email: gavin.tech@qq.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com
          solverName: alidns
          config:
            region: "" # 這里可以不填 或者填對應(yīng)的區(qū)域:cn-shenzhen
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

創(chuàng)建Certificate

測試證書

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: ditigram-com-staging-tls
spec:
  secretName: ditigram-com-staging-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-staging-dns
    kind: ClusterIssuer

正式證書

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: ditigram-com-prod-tls
spec:
  secretName: ditigram-com-prod-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-prod-dns
    kind: ClusterIssuer

在Ingress中應(yīng)用

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kuard
  annotations:
    # 務(wù)必添加以下兩個注解, 指定 ingress 類型及使用哪個 cluster-issuer
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer："letsencrypt-staging-dns" # 這里先用測試環(huán)境的證書測通后蕾羊，就可以替換成正式服證書
spec:
  tls:
  - hosts:
    - "*.ditigram.com"                     # 如果填寫單域名就只會生產(chǎn)單域名的證書喧笔，如果是通配符請?zhí)顚?*.example.com", 注意：如果填寫example.com只會生成www.example.com一個域名。
    secretName: ditigram-com-staging-tls   # 測試的證書龟再，填寫剛剛創(chuàng)建Certificate的名稱书闸，注意更換環(huán)境時證書也要一起更換，這里并不會像單域名一樣自動生成
  rules:
  - host: example.ditigram.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kuard
          servicePort: 80

Kubernetes 集群自動生成更新HTTPS證書教程癞松，單域名硕勿，通配符域名證書申請

Kubernetes 集群自動生成更新HTTPS證書教程，單域名，通配符域名證書申請

簡介

1.安裝Helm 3

2.安裝cert-manager

前期準(zhǔn)備

添加命名空間

添加cret-manager源

更新源

安裝CRDs

安裝cert-manager

驗證是否安裝成功

3.安裝證書

這里安裝兩個環(huán)境的證書的作用

在Ingress中使用證書

4.通過DNS配置通配符域名證書

安裝WebHook

cret-manager 版本大于等于v0.11

安裝

添加阿里云RAM賬號

創(chuàng)建ClusterIssuer

創(chuàng)建Certificate

在Ingress中應(yīng)用

cret-manager 版本小于v0.11

安裝

添加阿里云RAM賬號

創(chuàng)建ClusterIssuer

創(chuàng)建Certificate

在Ingress中應(yīng)用