🔐 Kubernetes 中安裝 cert-manager 並產生 Private CA
⚠️ 僅用於測試用途 安裝 透過 Helm 安裝 cert-manager,首先下載簽署 cert-manager chart 的 GPG keyring,且在安裝時用此 GPG keyring 來驗證我們從 OCI Registry 下載的 chart curl -LO https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg helm install \ cert-manager oci://quay.io/jetstack/charts/cert-manager \ --version v1.19.1 \ --namespace cert-manager \ --create-namespace \ --verify \ --keyring ./cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg \ --set crds.enabled=true 產生 Private CA 對應的 Custom Resources 以下為範例的 manifest 檔案,命名為 root_ca.yaml apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: selfsigned-issuer spec: selfSigned: {} --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: my-selfsigned-ca namespace: cert-manager spec: isCA: true commonName: my-selfsigned-ca secretName: root-secret privateKey: algorithm: ECDSA size: 256 issuerRef: name: selfsigned-issuer kind: ClusterIssuer group: cert-manager.io subject: organizations: - WCYa Example Inc. countries: - TW organizationalUnits: - Internal PKI localities: - Taipei --- apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: my-ca-issuer spec: ca: # `ClusterIssuer` resource is not namespaced, so `secretName` is assumed to reference secret in `cert-manager` namespace. secretName: root-secret 這些 Custom Resources 的用途: ...