JamesWu文档库

Appearance

搭载blog之配置https证书（二） ​

要求：配置阿里云证书，服务器https可自签,分为4步 一. 在Kubernetes上安装cert-manager 二. 安装alidns的webhook 三. 配置ClusterIssuer 四. 配置Ingress

一、安装cert-manager ​

  • 创建命名空间

    $ kubectl create namespace cert-manager namespace/cert-manager created

    $ kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true 如果是1.12或者以下的k8s集群，需要添加--validate=false

  • 安装1.10.1版本的cert-manager

    $kubectl apply -f https://cdn-blog.jamesyt.com/k8s/cert-manager.yml --validate=false$ kubectl get po -n cert-manager

    以下表示安装成功 root@JamesWuService:~/cert# kubectl get po -n cert-manager NAME READY STATUS RESTARTS AGE cert-manager-74d949c895-nkdw4 1/1 Running 0 118s cert-manager-cainjector-d9bc5979d-nsc9c 1/1 Running 0 118s cert-manager-webhook-84b7ddd796-fmw74 1/1 Running 0 118s

使用证书，来验证是否可行 创建 test-cert-resource.yaml

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: test-selfsigned
  namespace: cert-manager
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-cert
  namespace: cert-manager
spec:
  commonName: example.com
  secretName: selfsigned-cert-tls
  issuerRef:
    name: test-selfsigned

执行

$ kaf test-cert-resource.yaml
$ kubectl describe certificate -n cert-manager

Events:
  Type    Reason     Age   From                                       Message 
  ----    ------     ----  ----                                       ------- 
  Normal  Issuing    60s   cert-manager-certificates-trigger          Issuing certificate as Secret does not exist 
  Normal  Generated  60s   cert-manager-certificates-key-manager      Stored new private key in temporary Secret resource "selfsigned-cert-zgllx"  
  Normal  Requested  60s   cert-manager-certificates-request-manager  Created new CertificateRequest resource "selfsigned-cert-8jfjq" 
  Normal  Issuing    60s   cert-manager-certificates-issuing          The certificate has been successfully issued 

看到最后一行 successfully issued 就表明成功，但是会发现没有secret，我们一会创建，先杀掉测试

$ kubectl delete -f test-cert-resource.yaml
二、安装alidns的webhook ​

在这里已经上传到七牛云，直接执行

$ kaf https://cdn-blog.jamesyt.com/k8s/bundle.yaml

$ 查看结果
$ kubectl get po -n cert-manager

NAME                                      READY   STATUS    RESTARTS   AGE
cert-manager-74d949c895-nkdw4             1/1     Running   0          62m
cert-manager-cainjector-d9bc5979d-nsc9c   1/1     Running   0          62m
cert-manager-webhook-84b7ddd796-fmw74     1/1     Running   0          62m
alidns-webhook-77cbdf86d5-nsxp2           1/1     Running   0          13m
三、配置ClusterIssuer ​

  • 创建alidns-secret 创建alidns-secret.yaml

    apiVersion: v1 kind: Secret metadata: name: alidns-secret namespace: cert-manager stringData: access-key: xxxx #阿里云dns权限ak secret-key: xxxxxx #阿里云dns权限sk

执行

$ kaf alidns-secret.yaml 
$ kubectl get secret -n cert-manager
NAME                         TYPE                DATA   AGE
cert-manager-webhook-ca      Opaque              3      79m
selfsigned-cert-tls          kubernetes.io/tls   3      55m
alidns-webhook-ca            kubernetes.io/tls   3      30m
alidns-webhook-webhook-tls   kubernetes.io/tls   3      30m
letsencrypt-account-key      Opaque              1      8m20s
alidns-secret                Opaque              2      21s

  • 创建ClusterIssuer cert-manager有两种issuer,Issuer和ClusterIssuer,区别就是Role和ClusterRole的区别 创建clusterissuer.yaml

    apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-pro spec: acme: # Change to your letsencrypt email email: xxxx@qq.com #申请者邮箱地址 server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: letsencrypt-account-key solvers: - dns01: webhook: groupName: acme.xxxx.com #须和bundle.yaml文件中定义的groupname 一致 solverName: alidns config: region: "" accessKeySecretRef: name: alidns-secret #这里就是上面对应的secret名字 key: access-key secretKeySecretRef: name: alidns-secret key: secret-key

执行

$ kaf clusterissuer.yaml
$ kubectl get clusterissuer
NAME          READY   AGE
letsencrypt-pro   True    22s
四、配置Ingress ​

修改在上篇文章中的ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-nginx
  namespace: ns-test
  annotations:
    kubernetes.io/ingress.class: traefik
    cert-manager.io/cluster-issuer: letsencrypt-pro #这里为上面创建的name
    ingress.kubernetes.io/ssl-redirect: "true"
    kubernetes.io/tls-acme: "true"
spec:
  tls:
    - hosts:
        - jamesyt.com
      secretName: nginx-com
    - hosts:
        - www.jamesyt.com
      secretName: nginx-www-com
  rules:
  - host: "jamesyt.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: nginx-service #和对应的service 名字必须对应
            port:
              number: 80
  - host: "www.jamesyt.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: nginx-service #和对应的service 名字必须对应
            port:
              number: 80

这里面加入了cluster-issuer的注解，cert-manager会自动根据域名去创建certificate,order,challenge等

$ kaf 
$ kubectl get ing -A
NAMESPACE   NAME       CLASS     HOSTS                         ADDRESS         PORTS     AGE
ns-test     my-nginx   traefik   jamesyt.com,www.jamesyt.com   172.31.251.79   80, 443   34h

$ kubectl get certificate -A
NAMESPACE      NAME                         READY   SECRET                       AGE
cert-manager   alidns-webhook-ca            True    alidns-webhook-ca            43m
cert-manager   alidns-webhook-webhook-tls   True    alidns-webhook-webhook-tls   43m
ns-test        nginx-com                    False   nginx-com                    5m42s
ns-test        nginx-www-com                False   nginx-www-com                5m42s

可以看到 READY 为false,z这个时候，查看challenge状态，dns的验证需要等一会，为了让txt记录生效
$ kubectl get challenge -A
NAME                            STATE     DOMAIN         AGE
**-tle-23556563-0                pending   ***.com   5m

如果，查不到challenge 就说明可以了

如果出现问题，可进一步查看
$ kubectl describe challenge ***-tls-23556563-0 ,成功后会有如下的提示,challenge在成功验证后会被自动删除
Normal   Presented     28s      cert-manager  Presented challenge using dns-01 challenge mechani

访问 https://xxx.com 恭喜你成功了