添加chart库，进行安装cert-manager
helm repo add jetstack https://charts.jetstack.io
helm repo update
kubectl create ns cert-manager
helm install cert-manager jetstack/cert-manager --namespace cert-manager --set installCRDs=true
安装阿里云dns的webhook
cert-manager官方没做支持，得通过webhook方式
git clone https://github.com/pragkent/alidns-webhook.git
cd alidns-webhook/deploy
# groupName更改了，下面创建ClusterIssuer也要保持一致
sed -i s/'acme.yourcompany.com'/'acme.kinghu.io'/g bundle.yaml
# 注意名命空间得是cert-manager
kubectl apply -f bundle.yaml
准备好阿里云dns得access和secret
cat alidns-secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
name: alidns-secret
namespace: cert-manager
stringData:
access-key: "xxxxx"
secret-key: "xxxxx"
创建ClusterIssuer
cat clusterissuer.yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
# 改为自己得邮箱
email: admin@qq.com
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: letsencrypt-staging-account-key
solvers:
- dns01:
webhook:
#和alidns-webhook得值保持一致
groupName: acme.kinghu.io
solverName: alidns
config:
# 这个参数标识服务器所在地，经过测试不填写，或者随便填写没有影响
region: ""
accessKeySecretRef:
# 引用刚才创建得配置文件，注意文件名称和key名称是否对应
name: alidns-secret
key: access-key
secretKeySecretRef:
name: alidns-secret
key: secret-key
查看ClusterIssuer状态，ready为true
root@kk-node1:~# kubectl get ClusterIssuer
NAME READY AGE
letsencrypt-staging True 60m
申请一个证书
cat certificate.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: kinghu-io-tls
# 指定证书生成到哪个工作空间，不指定也可以
namespace: default
spec:
#生成后证书的配置文件名称
secretName: kinghu-io-tls
dnsNames:
- kinghu.io
- "*.kinghu.io"
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer
kubectl apply -f certificate.yaml
查看证书状态
状态重false 变成 true 需要等待一段时间，这个过程就是在签发证书
kubectl get certificate -A
NAMESPACE NAME READY SECRET AGE
default kinghu-io-tls True kinghu-io-tls 55m
