個(gè)人建議使用安裝更快，比helm快，還要等待安裝crd
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
#官網(wǎng)
https://cert-manager.io/docs/installation/kubectl/
#創(chuàng)建自簽的ClusterIssuer
cat > signing-custom.yaml <<-EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned-clusterissuer
spec:
selfSigned: {}
---
#生成證書(shū)
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: java-selfsigned-ca
namespace: cert-manager
spec:
isCA: true
commonName: java-selfsigned-ca
secretName: java-selfsigned-secret # 生成的證書(shū)名
duration: 360h
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned-clusterissuer # 對(duì)應(yīng)上面清單中創(chuàng)建的clusterissuer名稱(chēng)
kind: ClusterIssuer
group: cert-manager.io
---
#生成以這個(gè)證書(shū)作為CA的ClusterIssuer，其他證書(shū)由這個(gè)CA簽發(fā)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: my-ca-issuer
spec:
ca:
secretName: java-selfsigned-secret # 對(duì)應(yīng)以上Certificate資源證書(shū)名
EOF
查看你的證書(shū)
kubectl get clusterissuers,certificate
kubectl -n cert-manager get secret
手動(dòng)簽發(fā)ssl自簽證書(shū)
cat > server-tls.yaml <<-EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: java-com
spec:
secretName: java-tls
duration: 12160h # 你想要的時(shí)間
renewBefore: 3600h #
subject:
organizations:
- jetstack
commonName: abc.exchangs.top
isCA: false
privateKey:
algorithm: RSA
encoding: PKCS1
size: 2048
usages:
- server auth
- client auth
dnsNames:
- exchangs.top
- abc.exchangs.top
ipAddresses:
- 192.168.0.53
issuerRef:
name: my-ca-issuer # 指定上面創(chuàng)建好的用于簽名的CA
kind: ClusterIssuer
group: cert-manager.io
EOF
最后ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: springboot-server
#annotations:
#cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
ingressClassName: nginx
tls:
- hosts:
- abc.exchangs.top
- bbc.exchangs.top
secretName: java-tls
rules:
- host: abc.exchangs.top
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: springboot-server
port:
number: 8080
- host: bbc.exchangs.top
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: springboot-server
port:
number: 8080
最后訪問(wèn)
curl -kivL -H 'Host: bbc.exchangs.top' 'https://192.168.0.53'
文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-813693.html
文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-813693.html
到了這里，關(guān)于k8s 使用cert-manager證書(shū)管理自簽的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
