导语：大致记录一下学习视频中helm安装Cert-Manager的过程

Cert-Manager管理tls证书

作用：管理证书，可以生成自签名证书，可以去证书颁发机构生成证书，在证书快要过期的时候续签

安装Cert-Manager

kubectl create ns cert-manager
# 忽略有效性的检查
kubectl label certmanager.k8s.io/disable-validation=true  -n cert-manager
# 安装crd  https://github.com/jetstack/cert-manager/blob/release-0.9/deploy/manifests/00-crds.yaml
kubectl apply -f 00-crds.yaml

helm install cert-manager -n cert-manager --version v0.9.1 cert-manager

部署阿里dns的webhook 通过它来验证dns

自定义策略

再给用户添加刚刚自己创建的自定义权限

创建secret

kubectl -n cert-manager create secret generic alidns-credentials --from-literal=accessKeySecret='阿里云的accessKeySecret'

创建rbac权限 让webhook可以读取secret

cert-manager-webhook-alidns-secret-reader.yaml

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: cert-manager-webhook-alidns:secret-reader
rules:
  - apiGroups:
      - ''
    resources:
      - 'secrets'
    resourceNames:
      - 'alidns-credentials'
    verbs:
      - 'get'
      - 'watch'
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-alidns:secret-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook-alidns:secret-reader
subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: cert-manager-webhook-alidns
    namespace: cert-manager

kubectl apply -f cert-manager-webhook-alidns-secret-reader.yaml

安装webhook

helm instakk cert-manager-webhook-alidns -n cert-manager cert-manager-webhook-alidns/deploy/webhook-alidns

定义issuer

./config/cert-manager/letsencrypt-clusterissuer-prod.yamlc

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: <shidongliang@me.com>
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - selector:
        dnsNames:
        - '*.hipstershop.cn'
      dns01:
        webhook:
          config:
            accessKeyId: LTAI4FsNjCkUidDwNTZ1xxxxxr
            accessKeySecretRef:
              key: accessKeySecret
              name: alidns-credentials
            regionId: "cn-beijing"
            ttl: 600
          groupName: acme.hipstershop.cn
          solverName: alidns

kubectl apply -f ./config/cert-manager/letsencrypt-clusterissuer-prod.yaml

通过certificate申请一个证书./config/cert-manager/certificate.yaml

---
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: wildcard-hipstershop-cn
spec:
  secretName: wildcard-hipstershop-cn-tls
  renewBefore: 240h
  dnsNames:
  - '*.hipstershop.cn'
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer

kubectl apply -f ./config/cert-manager/certificate.yaml
kubectl  get secret

通过ingress 使用tls证书

略

通过ingress直接申请tls证书

echo-nginx-ingress-letsencrypt.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: echo-nginx-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    certmanager.k8s.io/cluster-issuer: letsencrypt-prod # 调用的issuer
spec:
  tls:
  - hosts:
    - '*.hipstershop.cn'
    secretName: letsencrypt-prod
  rules:
  - hostL echo.hipstershop.cn
    http:
      path:
      - path: /
        backend:
          serviceName:  echo
          servicePort: 80

更新ingress应用

kubectl apply -f echo-nginx-ingress-letsencrypt.yaml
kubectl  get ingress
kubectl describe ingress echo-nginx-ingress

查看证书生成的order

kubectl get order 
kubectl describe order wildcard-hipstershop-cn-xxxxx

查看challenge

# 需要在创建的时候看  创建完成之后会自动删除
kubectl get challenge -w