01 使用 helm 部署 cert-manager

我们选择这个helm chartjetstack/cert-manager 部署https。目前，在 github 上，该仓库 jetstack/cert-manager 已拥有 4.4K Star。

如果想使用let's encrypt自动为Ingress配置https。在部署时需要为 helm chart 指定以下参数。

ingressShim.defaultIssuerName=letsencrypt-prod
ingressShim.defaultIssuerKind=Issuer 复制代码

这里有关于 Issuers的文档

部署过程如下，这里使用了helm v3进行部署

# 部署前需要一些 crd $ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml # 为 helm 添加 repo $ helm repo add jetstack https://charts.jetstack.io # 使用 helm v3 部署，指定参数 $ helm install cert-manager jetstack/cert-manager --set "ingressShim.defaultIssuerName=letsencrypt-prod,ingressShim.defaultIssuerKind=Issuer" NAME: cert-manager
LAST DEPLOYED: 2019-10-26 21:27:56.488948248 +0800 CST m=+2.081581159
NAMESPACE: default
STATUS: deployed
NOTES:
cert-manager has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://docs.cert-manager.io/en/latest/reference/issuers.html

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://docs.cert-manager.io/en/latest/reference/ingress-shim.html 复制代码

校验状态，查看刚才部署crd与pod的状态，校验是否成功

$ kubectl get crd
NAME                                  CREATED AT
certificaterequests.cert-manager.io   2019-10-26T01:16:21Z
certificates.cert-manager.io          2019-10-26T01:16:21Z
challenges.acme.cert-manager.io       2019-10-26T01:16:21Z
clusterissuers.cert-manager.io        2019-10-26T01:16:24Z
issuers.cert-manager.io               2019-10-26T01:16:24Z
orders.acme.cert-manager.io           2019-10-26T01:16:21Z

$ kubectl get pods
NAME                                             READY   STATUS    RESTARTS   AGE
cert-manager-5d8fd69d88-s7dtg                    1/1     Running   0          57s
cert-manager-cainjector-755bbf9c6b-ctkdb         1/1     Running   0          57s
cert-manager-webhook-76954fcbcd-h4hrx            1/1     Running   0          57s 复制代码

02 配置 ACME Issuers

指定 kind 为Issuer，并修改以下邮箱为自己的邮箱，Issuer 资源配置如下

apiVersion: cert-manager.io/v1alpha2 kind: Issuer metadata:  name: letsencrypt-prod spec:  acme: # The ACME server URL  server: https://acme-v02.api.letsencrypt.org/directory # Email address used for ACME registration  email: example@shanyue.tech # Name of a secret used to store the ACME account private key  privateKeySecretRef:  name: letsencrypt-prod # Enable the HTTP-01 challenge provider  solvers:  - http01:  ingress:  class: nginx 复制代码

使用kubectl apply -f部署生效

$ kubectl apply -f letsencrypt-issue.yaml 复制代码

03 为 Ingress 添加 annotation

在部署 Ingress 时指定annotations就可以很方便地配置证书

annotations: kubernetes.io/ingress.class: "nginx" cert-manager.io/issuer: "letsencrypt-prod" 复制代码

关于Ingress的完整配置如下，你也可以在我的github上查看Deployment，Service到Ingress完整的配置: shfshanyue/learn-k8s:/conf/nginx.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: nginx-service-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - nginx.xiange.tech
    secretName: nginx-tls
  rules:
  - host: nginx.xiange.tech
    http:
      paths:
      - backend:
          serviceName: nginx-service
          servicePort: 80
        path: / 复制代码

校验certificate状态，Ready为 True

由于镜像在 quay.io 中，pull image 的时间过慢，有可能需要十分钟

$ kubectl get certificate
NAME        READY   SECRET      AGE
nginx-tls   True    nginx-tls   44h

$ kubectl describe certificate nginx-tls
Name:         nginx-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha2
Kind:         Certificate
Metadata:
  Creation Timestamp:  2019-10-26T13:30:06Z
  Generation:          1
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion: true Controller: true Kind:                  Ingress
    Name:                  nginx-service-ingress
    UID:                   c9abc7b7-45da-431b-b732-e535a809dfdd
  Resource Version:        2822740
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/nginx-tls
  UID:                     ccb3aa54-e967-4813-acbe-41d9801f29a6
Spec:
  Dns Names:
    nginx.xiange.tech
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       Issuer
    Name:       letsencrypt-prod
  Secret Name:  nginx-tls
Status:
  Conditions:
    Last Transition Time:  2019-10-26T13:43:02Z
    Message:               Certificate is up to date and has not expired
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2020-01-24T12:43:01Z
Events:                    <none> 复制代码

访问Ingress中配置的域名，Chrome 浏览器中左上角的小锁提示https配置成功