add repo for cert-manager
helm repo add jetstack https://charts.jetstack.io
helm repo update
install cert-manager
helm install cert-manager jetstack/cert-manager \
--create-namespace \
--namespace cert-manager \
--set crds.enabled=true
Setup ClusterIssuer:
kubectl apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: letsencrypt-issuer
solvers:
- http01:
ingress:
ingressClassName: nginx
EOF
Staging:
kubectl apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: letsencrypt-staging-issuer
solvers:
- http01:
ingress:
ingressClassName: nginx
EOF
Sample Ingress:
kubectl apply -f - << EOF
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt
spec:
tls:
- hosts:
- nginx.k8s.shubhamtatvamasi.com
secretName: letsencrypt-nginx
rules:
- host: nginx.k8s.shubhamtatvamasi.com
http:
paths:
- backend:
serviceName: nginx
servicePort: 80
EOF
test resources
kubectl apply -f - << EOF
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager-test
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: test-selfsigned
namespace: cert-manager-test
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: selfsigned-cert
namespace: cert-manager-test
spec:
dnsNames:
- example.com
secretName: selfsigned-cert-tls
issuerRef:
name: test-selfsigned
EOF