k8s1.18.20通过cert-manager、kubed实现三个月免费证书自动续签

一、cert-manager部署

参考：k8s1.18.20:cert-manager 1.8 安装部署

二、申请免费证书-letsencrypt

2.1、创建ClusterIssuer

向letsencrypt申请三个月免费证书

[root@k8s-node ~]# cat clusterissuer-prod.yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    #server: https://acme-staging-v02.api.letsencrypt.org/directory
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

2.2、以HTTP-01方式申请域名证书

[root@k8s-node ~]# cat  ssl.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ssl   #证书名称
  namespace: cert-manager  #名称空间
spec:
  secretName: ssl   #证书名称
  issuerRef:
    name: letsencrypt-prod   #指定ISSUER
    kind: ClusterIssuer
  duration: 2160h
  renewBefore: 360h
  dnsNames:
  - www.demo.cn
  - app.demo.cn

检查，证书是否申请成功

[root@ops-k8s-master01 ssl]# kubectl get secret -n cert-manager
NAME                                  TYPE                                  DATA   AGE
cert-manager-cainjector-token-kdwd6   kubernetes.io/service-account-token   3      30d
cert-manager-token-x6tgq              kubernetes.io/service-account-token   3      30d
cert-manager-webhook-ca               Opaque                                3      30d
cert-manager-webhook-token-4bpwg      kubernetes.io/service-account-token   3      30d
default-token-p97fb                   kubernetes.io/service-account-token   3      30d
letsencrypt-prod                      Opaque                                1      30d
sandbox-2qd8j                         Opaque                                1      28d
ssl                                   kubernetes.io/tls                     2      28d

查看secret信息

[root@ops-k8s-master01 ssl]# kubectl describe secret ssl -n cert-manager
Name:         ssl
Namespace:    cert-manager
Labels:       kubed.appscode.com/origin.cluster=opstest
              kubed.appscode.com/origin.name=ssl
              kubed.appscode.com/origin.namespace=cmc
Annotations:  cert-manager.io/alt-names:
                api.opstest.chinamcloud.cn,cloud.opstest.chinamcloud.cn,console.opstest.chinamcloud.cn,dashaboard.opstest.chinamcloud.cn,image.opstest.chi...
              cert-manager.io/certificate-name: ssl
              cert-manager.io/common-name: login.opstest.chinamcloud.cn
              cert-manager.io/ip-sans: 
              cert-manager.io/issuer-group: cert-manager.io
              cert-manager.io/issuer-kind: ClusterIssuer
              cert-manager.io/issuer-name: letsencrypt-prod
              cert-manager.io/uri-sans: 
              kubed.appscode.com/origin: {"namespace":"cmc","name":"ssl","uid":"4140a0e6-fd8f-4b17-b72e-9a2983c33b58","resourceVersion":"49211748"}

Type:  kubernetes.io/tls

Data
====
tls.crt:  5932 bytes
tls.key:  1679 bytes

目前证书只能在cert-manager名称空间下使用，我们需要再部署一个kubed/config-syncer同步服务，将cert-manager名称空间下的ssl证书同步到其他名称空间。

三、部署kubed服务

参考：Syncing Secrets Across Namespaces
gitlab地址：https://github.com/kubeops/config-syncer
官网部署文档：appscode

3.1、部署kubed服务

$ helm repo add appscode https://charts.appscode.com/stable/
$ helm repo update
$ helm search repo appscode/kubed --version v0.12.0
NAME            CHART VERSION APP VERSION DESCRIPTION
appscode/kubed  v0.12.0    v0.12.0  Kubed by AppsCode - Kubernetes daemon

$ helm install kubed appscode/kubed \
  --version v0.12.0 \
  --namespace kube-system

检查容器是否正常部署

[root@ops-k8s-master01 ssl]# kubectl get pod -o wide -A |grep kubed
kubed           config-sync-kubed-57d7b5548b-l6klq          1/1     Running            0          28d     10.42.2.80      ops-k8s-node02     <none>           <none>

3.2、创建同步证书服务

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ssl
  namespace: cert-manager
spec:
  secretName: ssl
  commonName: ssl
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
    group: cert-manager.io
  secretTemplate:
    annotations:
      #kubed.appscode.com/sync: "cert-manager-tls=appfactory,crms"
      kubed.appscode.com/sync: ""   #同步到所有名称空间

检查证书是否同步到所有名称空间

[root@ops-k8s-master01 ssl]# kubectl get secret -A |grep ssl
aims                          ssl                                              kubernetes.io/tls                     2      28d
appfactory                    ssl                                              kubernetes.io/tls                     2      28d
base                          ssl                                              kubernetes.io/tls                     2      28d
bigdata                       ssl                                              kubernetes.io/tls                     2      28d
cattle-fleet-system           ssl                                              kubernetes.io/tls                     2      28d
cattle-impersonation-system   ssl                                              kubernetes.io/tls                     2      28d
cattle-system                 ssl                                              kubernetes.io/tls                     2      28d
cert-manager                  ssl                                              kubernetes.io/tls                     2      28d
cim                           ssl                                              kubernetes.io/tls                     2      28d
cmc                           ssl                                              kubernetes.io/tls                     2      28d
cmini                         ssl                                              kubernetes.io/tls                     2      28d
cms                           ssl                                              kubernetes.io/tls                     2      28d
content                       ssl                                              kubernetes.io/tls                     2      28d

后续可以通过浏览器验证，访问域名看证书是否正常。