cert-manager 自签

1、 安装cert-manager

# 方法一
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml

# 方法二
# 添加 Jetstack Helm 仓库
helm repo add jetstack https://charts.jetstack.io

# 更新本地 Helm chart 仓库缓存
helm repo update

# 安装 cert-manager Helm chart
helm install cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.5.1 \
--set installCRDs=true

2、创建 自签颁发机构

                Issuer：在对应的命名空间有效

                 ClusterIssuer： 所有明明空叫有效

##创建自签颁发机构

---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
   name: test-selfsigned
spec:
   selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
   name: selfsigned-cert
spec:
   dnsNames:
     - example.com
   secretName: selfsigned-cert-tls
   issuerRef:
     name: test-selfsigned

3、创建测试应用并完成自签

kubectl create deploy nginx --image=nginx
kubectl expose deploy nginx --port=80 --target-port=80
kubectl create ing nginx --rule="example.com/*=nginx:80,tls=selfsigned-cert-tls"
kubectl annotate ing nginx cert-manager.io/issuer=test-selfsigned
kubectl annotate ing nginx cert-manager.io/cluster-issuer: test-selfsigned

4、命令行创建的ingress内容如下

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/issuer: test-selfsigned
  name: nginx
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - example.com
    secretName: selfsigned-cert-tls