「cert-manager」- 申请 Let’s Encrypt 证书 | 与阿里云 DNS 服务集成

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: example-issuer
spec:
  acme:
    email: user@example.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: example-issuer-account-key
    solvers:
    - dns01:
        cloudDNS:
          project: my-project
          serviceAccountSecretRef:
            name: prod-clouddns-svc-acct-secret
            key: service-account.json

kubectl apply -f ./01-bundle.yaml
kubectl apply -f ./02-alidns-secret.yaml
kubectl apply -f ./03-letsencrypt-clusterissuer.yaml
kubectl apply -f ./04-examplexyz-certificate.yaml

# kubectl describe -n default certificates.cert-manager.io example-xyz
...
Status:
  Conditions:
    Last Transition Time:  2021-05-07T01:30:33Z
    Message:               Certificate is up to date and has not expired
    Observed Generation:   1
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2021-08-05T00:30:32Z
  Not Before:              2021-05-07T00:30:32Z
  Renewal Time:            2021-07-06T00:30:32Z
  Revision:                1
Events:                    <none>

# kubectl get certificates.cert-manager.io
NAME                READY   SECRET              AGE
example-xyz         True    example-xyz         2m

// 此时，证书申请成功

helm repo add cert-manager-alidns-webhook https://devmachine-fr.github.io/cert-manager-alidns-webhook
helm repo update cert-manager-alidns-webhook

helm search repo cert-manager-alidns-webhook/
helm pull cert-manager-alidns-webhook/alidns-webhook

helm show values ./alidns-webhook-0.8.3.tgz > alidns-webhook-0.8.3.tgz.helm-values.yaml
vim alidns-webhook-0.8.3.tgz.helm-values.yaml
... groupName: 
... nameOverride: "webhook-alidns"
... fullnameOverride: "webhook-alidns"
... image.repository:

helm upgrade --install --namespace cert-manager --create-namespace             \
    webhook-alidns ./alidns-webhook-0.6.1.tgz -f alidns-webhook-0.6.1.helm-values.yaml

# 完成 DNS 质询需要访问阿里云接口来修改 DNS 记录，所以需要使用 KEY 与 TOKEN 来认证

cat > alidns-secret.yaml <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: alidns-secret
  namespace: cert-manager
stringData:
  access-token: your-token
  secret-key: your-secret-key
EOF

kubectl apply -f alidns-secret.yaml

# 创建 ClusterIssuer 资源

cat > letsencrypt-cluster-issuer.yaml <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    # 修改，邮箱地址
    email: contact@example.com
    # 修改，生产地址：https://acme-v02.api.letsencrypt.org/directory
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - dns01:
        webhook:
            # 修改，应用我们刚才创建的 Secret 资源
            config:
              accessTokenSecretRef:
                key: access-token
                name: alidns-secret
              regionId: cn-beijing
              secretKeySecretRef:
                key: secret-key
                name: alidns-secret
            # 修改，需要填写在安装时指定的 groupName 信息
            groupName: example.com
            solverName: alidns-solver
EOF

kubectl apply -f letsencrypt-cluster-issuer.yaml

# https://cert-manager.io/docs/usage/ingress/
cat > ingress-testing.yaml <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    # 修改，指示要使用的 issuer 资源，由管理员提供（我们前面定义的 ClusterIssuer 使用 letsencrypt 名称）
    cert-manager.io/cluster-issuer: letsencrypt
  name: cert-manager-testing
  namespace: default
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    # 修改，需要签发证书的域名
    - cert-manager-testing.example.com
    # 修改，保存证书的 Secret 资源（cert-manger 负责创建）
    secretName: cert-manager-testing-tls
  rules:
  - http:
      paths:
      - path: /testpath
        pathType: Prefix
        backend:
          service:
            name: test
            port:
              number: 80
EOF

kubectl apply -f ingress-testing.yaml

// ---------------------------------------------------------------------------- // 第一步、下载并升级 CRD 资源

wget https://github.com/cert-manager/cert-manager/releases/download/v1.8.2/cert-manager.crds.yaml
kubectl apply -f cert-manager.crds.yaml

// ---------------------------------------------------------------------------- // 第二步、升级 cert-manager 服务

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm pull jetstack/cert-manager --version v1.8.2                                # cert-manager-v1.8.2.tgz

helm show values ./cert-manager-v1.8.2.tgz > cert-manager-v1.8.2.helm-values.yaml

helm --namespace cert-manager                                                  \
    upgrade cert-manager ./cert-manager-v1.8.2.tgz                             \
    -f cert-manager-v1.8.2.helm-values.yaml

// ---------------------------------------------------------------------------- // 第三步、创建 Ingress TLS 进行测试

...