kubernetes 部署 cert-manager 快速实现自动 ssl
简单记录，使用 cloudflare dns 自动完成域名 ssl 证书申请并配置到 ingress 的关键步骤。
安装
使用 helm 安装方法如下：
helm repo add jetstack https://charts.jetstack.io --force-update
helm install \
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.16.1 \
--set crds.enabled=true
配置
使用 cloudflare 密钥自动认证
apiVersion: v1
kind: Secret
metadata:
name: cloudflare-api-token-secret
namespace: cert-manager
type: Opaque
stringData:
api-token: xxxxxxxxxx
定义 issuer
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: issuer01
spec:
acme:
email: XXXXXX
# 配置证书目录，演练环境使用Staging环境，正式环境使用另一个
#server: https://acme-staging-v02.api.letsencrypt.org/directory
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
# Secret resource that will be used to store the account's private key.
name: issuer-account-key
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cloudflare-api-token-secret
key: api-token
示例程序
apiVersion: apps/v1
kind: Deployment
metadata:
name: whoami-deploy
spec:
replicas: 1
selector:
matchLabels:
app: whoami
release: canary
template:
metadata:
labels:
app: whoami
release: canary
spec:
containers:
- name: whoami
image: traefik/whoami:v1.10
ports:
- name: http
containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: whoami
spec:
selector:
app: whoami
release: canary
ports:
- name: http
port: 80
targetPort: 80 # pod port
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-whoami
annotations:
cert-manager.io/cluster-issuer: issuer01
# kubernetes.io/tls-acme: "true"
spec:
ingressClassName: nginx
rules:
- host: whoami.hzc1.skybyte.me
http:
paths:
- backend:
service:
name: whoami
port:
number: 80
path: /
pathType: Prefix
tls:
- hosts:
- whoami.hzc1.skybyte.me
secretName: whoami-hzc1-skybyte-me-tls # Name of secret automatically generated.