Kubernetes证书管理 - 云原生基站

参考文档

后面 traefik 自己集成了证书管理,参考文档后面补充

1 准备工作#

先安装对应 webhook,这里我使用腾讯的 DNSPod,其它的从这里找

git clone https://github.com/qqshfox/cert-manager-webhook-dnspod.git

1.1 获取 apiID 与 apiToken#

文档参考

访问这里创建并记录

2 部署 cert-manager#

1
 helm repo add jetstack https://charts.jetstack.io
2
 helm repo update
3
 helm install cert-manager jetstack/cert-manager \
4
  --namespace cert-manager \ # 命名空间名称
5
  --create-namespace \ # 自动创建命名空间
6
  --version v1.7.2 \ # 版本
7
  --set ingressShim.defaultIssuerName=letsencrypt-prod \ # 下面三个参数是自动生成ClusterIssuer
8
  --set ingressShim.defaultIssuerKind=ClusterIssuer \
9
  --set ingressShim.defaultIssuerGroup=cert-manager.io \
10
  --set installCRDs=true # 创建cert-manager所需要的crd

2.1 查看#

1
kubectl get pod -n cert-manager
2
NAME                                       READY   STATUS    RESTARTS   AGE
3
cert-manager-88c9c88d7-5vmdm               1/1     Running   0          3m2s
4
cert-manager-cainjector-857f5bd88c-bwkfg   1/1     Running   0          3m2s
5
cert-manager-webhook-5cd99556d6-jnl4w      1/1     Running   0          3m2s

3 部署 DNSPod webhook#

1
helm install cert-manager-webhook-dnspod ./cert-manager-webhook-dnspod/deploy/cert-manager-webhook-dnspod \
2
    --namespace 部署的命名空间 \
3
    --set groupName=组名 \
4
    --set secrets.apiID=apiID,secrets.apiToken=apiToken \
5
    --set clusterIssuer.enabled=true,clusterIssuer.email=邮箱

3.1 查看#

1
kubectl get pod -n cert-manager
2
NAME                                           READY   STATUS    RESTARTS   AGE
3
cert-manager-88c9c88d7-5vmdm                   1/1     Running   0          3m44s
4
cert-manager-cainjector-857f5bd88c-bwkfg       1/1     Running   0          3m44s
5
cert-manager-webhook-5cd99556d6-jnl4w          1/1     Running   0          3m44s
6
cert-manager-webhook-dnspod-7cbb554d57-bkdrx   1/1     Running   0          13s
7
kubectl get ClusterIssuer
8
NAME                                         READY   AGE
9
cert-manager-webhook-dnspod-cluster-issuer   True    16s

4 使用#

1
cat ingress.yaml
2
apiVersion: networking.k8s.io/v1
3
kind: Ingress
4
metadata:
5
  annotations:
6
    cert-manager.io/cluster-issuer: cert-manager-webhook-dnspod-cluster-issuer # kubectl get ClusterIssuer查到的名字
7
  name: hello-ingress
8
spec:
9
  rules:
10
  - host: hello.ccops.cc
11
    http:
12
      paths:
13
      - pathType: Prefix
14
        path: /
15
        backend:
16
          service:
17
            name: myservice
18
            port:
19
              number: 443
20
  tls:
21
  - hosts:
22
    - hello.ccops.cc
23
    secretName: hello-cert

4.1 查看 dns 有没有自动添加#

4.2 访问查看证书#

5 遇到的问题#

第一条 dns 解析能自动添加,第二条就没有了,日志也没任何报错

证书没自动创建,申请证书太多

1
kubectl describe certificaterequest -n tekton-pipelines tekton-cert-sqrgx
2
Warning  OrderFailed      48m   cert-manager  Failed to wait for order resource "xxx-cert-sqrgx-3392950336" to become ready: order is in "errored" state: Failed to create Order: 429 urn:ietf:params:acme:error:rateLimited: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: xxx.ccops.cc: see https://letsencrypt.org/docs/rate-limits/

1 准备工作#

1.1 获取 apiID 与 apiToken#

2 部署 cert-manager#

2.1 查看#

3 部署 DNSPod webhook#

3.1 查看#

4 使用#

4.1 查看 dns 有没有自动添加#

4.2 访问查看证书#

5 遇到的问题#

文章分享

评论区

音乐

文章目录