时间：2023-02-19 22:24:01 | 来源：建站知识
时间：2023-02-19 22:24:01 来源：建站知识
为 KubeSphere 集群启用免费的泛域名 SSL 证书并实现证书自动更新和分发：作者：scwang18，主要负责技术架构，在容器云方向颇有研究。
在线咨询
let's encrytp 泛域名证书实现 Kubernetes 集群外部服务自动证书配置和证书到期自动更新，支持 HTTPS 访问。我们还部署了证书自动分发组件，实现证书文件自动分发到其他 namespace 。Let’s Encrypt, HashiCorp Vault 这些免费证书的签发。在 KubeSphere 集群中，我们可以通过 Kubernetes Ingress 和 Let’s Encrypt 实现外部服务的自动化 HTTPS。$ kubectl create ns cert-manager$ helm uninstall cert-manager -n cert-manager$ helm install cert-manager jetstack/cert-manager / -n cert-manager / --version v1.8.0 / --set installCRDs=true / --set prometheus.enabled=false / --set 'extraArgs={--dns01-recursive-nameservers-only,--dns01-recursive-nameservers=119.29.29.29:53/,8.8.8.8:53}' # ClusterIssuer.yamlapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata: name: letsencryptspec: acme: email: scwang18@xxx.xxx server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: issuer-account-key solvers: - http01: ingress: class: nginx说明：$ kubectl apply -f ClusterIssuer.yaml -n cert-manager执行成功后，会将申请的证书文件放置在 issuer-account-key 这个 Secret 中。$ kubectl -n infra get certificate# ingreess-wikijs.yamlapiVersion: networking.k8s.io/v1kind: Ingressmetadata: annotations: cert-manager.io/cluster-issuer: letsencrypt nginx.ingress.kubernetes.io/proxy-body-size: "0" name: ingress-wikijsspec: ingressClassName: nginx rules: - host: wiki.xxx.xxx http: paths: - backend: service: name: wikijs port: number: 3000 path: / pathType: Prefix tls: - hosts: - wikijs.xxx.xxx secretName: ingress-wikijs-tls注意：在 annotations 里 设置使用 yaml 文件创建 ingress 后，就可以使用该 Ingress 对外提供 HTTPS 服务了。cert-manager.io/cluster-issuer为签名创建的集群证书颁发者letsencrypt。
# 执行创建 ingresskubectl apply -f ingress-wikijs.yaml -n infraAKIDVt3z4uVss11xjIdmddgMmHXXssssHp9D2buxrWR8SekbG2gqdflQs5xxxviGagX8TYO$ helm repo add roc https://charts.imroc.cc$ helm uninstall cert-manager-webhook-dnspod -n cert-manager$ helm install cert-manager-webhook-dnspod roc/cert-manager-webhook-dnspod / -n cert-manager / --set clusterIssuer.secretId=AKIDVt3z4uVss11xjIdmddgMmHXXssssHp9D2buxrWR8 / --set clusterIssuer.secretKey=SekbG2gqdflQs5xxxviGagX8TYO / --set clusterIssuer.email=xxx@xxx.xxx# ipincloud-crt.yamlapiVersion: cert-manager.io/v1kind: Certificatemetadata: name: ipincloud-crtspec: secretName: ipincloud-crt issuerRef: name: dnspod kind: ClusterIssuer group: cert-manager.io dnsNames: - "*.xxx.xxx"创建集群证书颁发者：$ kubectl apply -f ipincloud-crt.yaml -n infra$ kubectl get Certificate -n cert-managerNAME READY SECRET AGEcert-manager-webhook-dnspod-ca True cert-manager-webhook-dnspod-ca 18mcert-manager-webhook-dnspod-webhook-tls True cert-manager-webhook-dnspod-webhook-tls 18mipincloud-crt True ipincloud-crt 3m12s以上可以看出 ipincloud-crt 已经创建成功， READY 状态也是 True。$ kubectl describe Certificate ipincloud-crt -n cert-managerName: ipincloud-crtNamespace: cert-managerLabels: <none>Annotations: <none>API Version: cert-manager.io/v1Kind: CertificateMetadata: Creation Timestamp: 2022-05-07T14:19:07Z ...Spec: Dns Names: *.xxx.xxx Issuer Ref: Group: cert-manager.io Kind: ClusterIssuer Name: dnspod Secret Name: ipincloud-crtStatus: Conditions: Last Transition Time: 2022-05-07T14:19:14Z Message: Certificate is up to date and has not expired Observed Generation: 1 Reason: Ready Status: True Type: Ready Not After: 2022-08-05T13:19:11Z Not Before: 2022-05-07T13:19:12Z Renewal Time: 2022-07-06T13:19:11Z Revision: 1Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Issuing 4m35s cert-manager-certificates-trigger Issuing certificate as Secret does not exist Normal Generated 4m35s cert-manager-certificates-key-manager Stored new private key in temporary Secret resource "ipincloud-crt-4ml59" Normal Requested 4m35s cert-manager-certificates-request-manager Created new CertificateRequest resource "ipincloud-crt-r76wp" Normal Issuing 4m28s cert-manager-certificates-issuing The certificate has been successfully issued 从 Certificate 的描述信息可以看到，这个证书是对应所有 *.xxx.xxx 的泛域名。$ kubectl describe secret ipincloud-crt -n cert-managerName: ipincloud-crtNamespace: cert-managerLabels: <none>Annotations: cert-manager.io/alt-names: *.xxx.xxx cert-manager.io/certificate-name: ipincloud-crt cert-manager.io/common-name: *.xxx.xxx cert-manager.io/ip-sans: cert-manager.io/issuer-group: cert-manager.io cert-manager.io/issuer-kind: ClusterIssuer cert-manager.io/issuer-name: dnspod cert-manager.io/uri-sans: Type: kubernetes.io/tlsData====tls.crt: 5587 bytestls.key: 1675 bytesTLS 证书保存在 cert-manager 命名空间里的 ipincloud-crt secret。可以供所有 ``*.http://xxx.xxx` 的服务使用。$ kubectl get challenge -ANAMESPACE NAME STATE DOMAIN AGEcert-manager ipincloud-crt-f9kp6-381578565-136350475 pending xxx.xxx 24s查看原因是：Waiting for DNS-01 challenge propagation: DNS record for "xxx.xxx" not yet $ kubectl -n cert-manager describe challenge ipincloud-crt-f9kp6-381578565-136350475Name: ipincloud-crt-f9kp6-381578565-136350475Namespace: cert-managerLabels: <none>Annotations: <none>API Version: acme.cert-manager.io/v1Kind: Challenge---中间略---Status: Presented: true Processing: true Reason: Waiting for DNS-01 challenge propagation: DNS record for "xxx.xxx" not yet propagated State: pendingEvents: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Started 41s cert-manager-challenges Challenge scheduled for processing Normal Presented 39s cert-manager-challenges Presented challenge using DNS-01 challenge mechanism查了很多资料，在官网上找到解决方案。办法是让 cert-manager 强制使用指定的 DNS 服务器进行握手验证。--set 'extraArgs={--dns01-recursive-nameservers-only,--dns01-recursive-nameservers=119.29.29.29:53/,8.8.8.8:53}' 参考文档：https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check$ helm repo add appscode https://charts.appscode.com/stable/$ helm repo update$ helm install kubed appscode/kubed / --version v0.13.2 / --namespace cert-manager# ipincloud-crt.yamlapiVersion: cert-manager.io/v1kind: Certificatemetadata: name: ipincloud-crtspec: secretName: ipincloud-crt issuerRef: name: dnspod kind: ClusterIssuer group: cert-manager.io dnsNames: - "*.xxx.xxx" secretTemplate: annotations: kubed.appscode.com/sync: "cert-manager-tls=ipincloud-crt" cert-manager-tls=ipincloud-crt ， 因此，我们需要对接收同步 secret 的 namespace 打上相应的 label。$ kubectl label ns default cert-manager-tls=ipincloud-crt$ kubectl label ns app cert-manager-tls=ipincloud-crt$ kubectl label ns dev-app cert-manager-tls=ipincloud-crt$ kubectl label ns dev-infra cert-manager-tls=ipincloud-crt$ kubectl label ns dev-wly cert-manager-tls=ipincloud-crt$ kubectl label ns infra cert-manager-tls=ipincloud-crt$ kubectl label ns istio-system cert-manager-tls=ipincloud-crt$ kubectl label ns uat-app cert-manager-tls=ipincloud-crt$ kubectl label ns uat-wly cert-manager-tls=ipincloud-crt$ kubectl label ns wly cert-manager-tls=ipincloud-crt$ kubectl label ns kubesphere-controls-system cert-manager-tls=ipincloud-crt$ kubectl get secret ipincloud-crtNAME TYPE DATA AGEipincloud-crt kubernetes.io/tls 2 18m查看复制的 secret ，可以看到 label 信息中记录了证书来源信息。$ kubectl describe secret ipincloud-crtName: ipincloud-crtNamespace: defaultLabels: kubed.appscode.com/origin.cluster=unicorn kubed.appscode.com/origin.name=ipincloud-crt kubed.appscode.com/origin.namespace=cert-managerAnnotations: cert-manager.io/alt-names: *.xxx.xxx cert-manager.io/certificate-name: ipincloud-crt cert-manager.io/common-name: *.xxx.xxx cert-manager.io/ip-sans: cert-manager.io/issuer-group: cert-manager.io cert-manager.io/issuer-kind: ClusterIssuer cert-manager.io/issuer-name: dnspod cert-manager.io/uri-sans: kubed.appscode.com/origin: {"namespace":"cert-manager","name":"ipincloud-crt","uid":"b4713633-731e-4151-844f-0f6d9cf6352c","resourceVersion":"12531075"}Type: kubernetes.io/tlsData====tls.crt: 5587 bytestls.key: 1675 byteskind: IngressapiVersion: networking.k8s.io/v1metadata: name: wikijs namespace: infra annotations: nginx.ingress.kubernetes.io/proxy-body-size: '0'spec: ingressClassName: nginx tls: - hosts: - wiki.xxx.xxx secretName: ipincloud-crt rules: - host: wiki.xxx.xxx http: paths: - path: / pathType: ImplementationSpecific backend: service: name: wikijs port: number: 3000$ curl -I https://wiki.xxx.xxxHTTP/1.1 302 FoundDate: Sat, 07 May 2022 14:52:39 GMTContent-Type: text/plain; charset=utf-8Content-Length: 28Connection: keep-aliveX-Frame-Options: denyX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffX-UA-Compatible: IE=edgeReferrer-Policy: same-originContent-Language: zhSet-Cookie: loginRedirect=%2F; Max-Age=900; Path=/; Expires=Sat, 07 May 2022 15:07:39 GMTLocation: /loginVary: Accept, Accept-EncodingStrict-Transport-Security: max-age=15724800; includeSubDomains如上所示，就是成功启动了 HTTPS 。本文由博客一文多发平台 OpenWrite 发布！
关键词：证书,实现,分发,更新,启用,免费
