Before certificates can be created with cert-manager, there must be a connection between cert-manager and CM. To set up the connection, a ClusterIssuer must be created. In this example, a ClusterIssuer is set up with a pre-registration key and HTTP solver based on: https://cert-manager.io/docs/configuration/acme/. To setup the ClusterIssuer is a system admin task and we use the cert-manager namespace and use another namespace for the "user" certificates in later steps. To set up connection between cert-manager and Smart ID Certificate Manager: Change to the namespace of that cert-manager is installed in.
| Code Block |
|---|
| title | Change default namespace |
|---|
| kubectl config set-context --current --namespace=cert-manager |
In Kubernetes all sensitive information should be stored in secrets, this example creates a secret with the pre-registration key.
| Code Block |
|---|
| title | Create secret with pre-registration key |
|---|
| kubectl create secret generic demo-cm-id1 --from-literal secret=lMA3WzMn5SPZZo1_I1_sa1DQESG4T2-2kV8WaFX7GCk |
Create a file called clusterissuer.yaml with the following information. Change the keyID "1" in line 11,14, and 16 to the your local keyID and the secret in line 14 to the secret created in the step aboe. The secret in line 16 need to be unique secret per ClusterIssuer. Change url to PGWY Protocol Gateway in lin 17, and ingress class in line 22. The skipTLSVerify: true on line 18 is required if your CM PGWY Protocol Gateway installation is not running with a certificate trusted by the cert-manager.io (ie public certificate) | Code Block |
|---|
| language | xml |
|---|
| title | clusterissuer.yaml |
|---|
| linenumbers | true |
|---|
| apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: demo-cm-id1
namespace: cert-manager
spec:
acme:
email: ca-admin@example.com
externalAccountBinding:
keyAlgorithm: HS256
keyID: "1"
keySecretRef:
key: secret
name: demo-cm-id1
privateKeySecretRef:
name: demo-cm-id1-private-key
server: https://host.example.com/pgwy/acme/directory
skipTLSVerify: true
solvers:
- http01:
ingress:
class: traefik |
Create the ClusterIssuer by running the command: | Code Block |
|---|
| title | Create ClusterIssuer |
|---|
| kubectl create -f clusterissuer.yaml |
To show the details on the ClusterIssuer run this command: | Code Block |
|---|
| title | Example: Show information |
|---|
| kubectl describe clusterissuer demo-cm-id1 |
A sample output below, the important part is the status type in the end, showing that it's Ready, eq working. | Code Block |
|---|
| title | Example output |
|---|
| linenumbers | true |
|---|
| Name: demo-cm-id1
Namespace:
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1
Kind: ClusterIssuer
Metadata:
Creation Timestamp: 2020-09-08T09:02:26Z
Generation: 1
Resource Version: 24444944
Self Link: /apis/cert-manager.io/v1/clusterissuers/demo-cm-id1
UID: 554262b6-7678-4960-9e2b-5acf7923eecc
Spec:
Acme:
Email: ca-admin@example.com
External Account Binding:
Key Algorithm: HS256
Key ID: 1
Key Secret Ref:
Key: secret
Name: demo-cm-id1
Preferred Chain:
Private Key Secret Ref:
Name: demo-cm-private-key
Server: https://host.example.com/pgwy/acme/directory
Skip TLS Verify: true
Solvers:
http01:
Ingress:
Class: traefik
Status:
Acme:
Last Registered Email: ca-admin@example.com
Uri: https://host.example.com/pgwy/acme/directory/account/6RqONO6qnQXsLnyDjVcuTA
Conditions:
Last Transition Time: 2020-09-08T09:02:30Z
Message: The ACME account was registered with the ACME server
Reason: ACMEAccountRegistered
Status: True
Type: Ready
Events: <none>
|
|