k8s 使用cert-manager证书管理自签

个人建议使用安装更快,比helm快,还要等待安装crd

js 复制代码
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
js 复制代码
#官网
https://cert-manager.io/docs/installation/kubectl/
js 复制代码
#创建自签的ClusterIssuer
cat >  signing-custom.yaml <<-EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-clusterissuer
spec:
  selfSigned: {}

---
#生成证书
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: java-selfsigned-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: java-selfsigned-ca
  secretName: java-selfsigned-secret # 生成的证书名
  duration: 360h
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-clusterissuer # 对应上面清单中创建的clusterissuer名称
    kind: ClusterIssuer
    group: cert-manager.io
---
#生成以这个证书作为CA的ClusterIssuer,其他证书由这个CA签发
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: my-ca-issuer
spec:
  ca:
    secretName: java-selfsigned-secret # 对应以上Certificate资源证书名
EOF

查看你的证书

js 复制代码
kubectl get clusterissuers,certificate
kubectl -n cert-manager get secret

手动签发ssl自签证书

js 复制代码
cat > server-tls.yaml  <<-EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: java-com
spec:
  secretName: java-tls
  duration: 12160h # 你想要的时间
  renewBefore: 3600h #
  subject:
    organizations:
      - jetstack
  commonName: abc.exchangs.top
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - server auth
    - client auth
  dnsNames:
    - exchangs.top
    - abc.exchangs.top
  ipAddresses:
    - 192.168.0.53
  issuerRef:
    name: my-ca-issuer # 指定上面创建好的用于签名的CA
    kind: ClusterIssuer
    group: cert-manager.io
EOF

最后ingress

js 复制代码
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: springboot-server
  #annotations:
    #cert-manager.io/cluster-issuer: "letsencrypt-prod"

spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - abc.exchangs.top
    - bbc.exchangs.top
    secretName: java-tls
  rules:
  - host: abc.exchangs.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: springboot-server
            port:
              number: 8080
  - host: bbc.exchangs.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: springboot-server
            port:
              number: 8080

最后访问

js 复制代码
curl -kivL -H 'Host: bbc.exchangs.top' 'https://192.168.0.53'


相关推荐
wenyue11211 小时前
Revolutionize Your Kubernetes Experience with Easegress: Kubernetes Gateway API
容器·kubernetes·gateway
梅见十柒3 小时前
wsl2中kali linux下的docker使用教程(教程总结)
linux·经验分享·docker·云原生
Python私教3 小时前
ubuntu搭建k8s环境详细教程
linux·ubuntu·kubernetes
运维&陈同学4 小时前
【zookeeper01】消息队列与微服务之zookeeper工作原理
运维·分布式·微服务·zookeeper·云原生·架构·消息队列
O&REO5 小时前
单机部署kubernetes环境下Overleaf-基于MicroK8s的Overleaf应用部署指南
云原生·容器·kubernetes
politeboy5 小时前
k8s启动springboot容器的时候,显示找不到application.yml文件
java·spring boot·kubernetes
运维小文6 小时前
K8S资源限制之LimitRange
云原生·容器·kubernetes·k8s资源限制
登云时刻6 小时前
Kubernetes集群外连接redis集群和使用redis-shake工具迁移数据(二)
redis·容器·kubernetes
wuxingge15 小时前
k8s1.30.0高可用集群部署
云原生·容器·kubernetes
志凌海纳SmartX16 小时前
趋势洞察|AI 能否带动裸金属 K8s 强势崛起?
云原生·容器·kubernetes