View source for OpenShift cert-manager

= Authentication =

To authenticate as system:admin:

<pre>
$ oc login -u system:admin
</pre>

To authenticate as kubeadmin:

<pre>
$ oc login -u kubeadmin -p <password> https://api.crc.testing:6443
</pre>

= Installing cert-manager =

To install cert-manager:

<pre>
$ oc create namespace cert-manager
$ oc apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.14.0/cert-manager.yaml
</pre>

To verify the installation:

<pre>
$ oc get pods -n cert-manager
NAME                                       READY     STATUS    RESTARTS   AGE
cert-manager-57cdd66b-ws6nc                1/1       Running   0          30s
cert-manager-cainjector-79f4496665-k7cbz   1/1       Running   0          30s
cert-manager-webhook-6d57dbf4f-dvqml       1/1       Running   0          30s
</pre>

= Creating ACME Issuer =

To create an issuer, prepare the following file (e.g. acme.yaml):

<pre>
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: acme-issuer
spec:
  acme:
    email: admin@example.com
    server: https://acme.demo.dogtagpki.org/acme/directory
    privateKeySecretRef:
      name: acme-issuer-account-key
    solvers:
    - http01:
       ingress:
         class: nginx
</pre>

Then execute the following command:

<pre>
$ oc create -f acme-issuer.yaml
</pre>

Verify with the following command:

<pre>
$ oc describe clusterissuers acme-issuer
    ...
    Message:               The ACME account was registered with the ACME server
    Reason:                ACMEAccountRegistered
    ...
</pre>

To delete the issuer:

<pre>
$ oc delete clusterissuers acme-issuer
$ oc delete secret acme-issuer-account-key -n cert-manager
</pre>

= Creating ACME Certificate =

Prepare a Certificate configuration (e.g. acme-cert.yaml):

<pre>
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: acme-cert
spec:
  secretName: acme-cert-tls
  dnsNames:
  - www.example.com
  issuerRef:
    name: acme-issuer
    kind: ClusterIssuer
</pre>

Then execute the following command:

<pre>
$ oc create -f acme-cert.yaml
</pre>

To check the certificate status:

<pre>
$ oc describe certificate acme-cert
    ...
    Message:               Waiting for CertificateRequest "acme-cert-<request>" to complete
    Reason:                InProgress
    ...
</pre>

To check the certificate request status:

<pre>
$ oc describe certificaterequest acme-cert-<request>
</pre>

To check the order status:

<pre>
$ oc describe order acme-cert-<order>
    ...
    Challenges:
      Token:     <token>
      Type:      dns-01
      URL:       http://acme.default.svc.cluster.local:8080/acme/chall/<challenge ID>
      Token:     <token>
      Type:      http-01
      URL:       http://acme.default.svc.cluster.local:8080/acme/chall/<challenge ID>
    ...
</pre>

= Deleting ACME Certificate =

<pre>
$ oc delete cert acme-cert
</pre>

= Deleting ACME Issuer =

<pre>
$ oc delete clusterissuer acme-issuer
</pre>

= Troubleshooting =

<pre>
$ oc logs -n cert-manager deploy/cert-manager -f
</pre>

= See Also =

* [[OpenShift]]
* [[OpenShift 4 CodeReady Containers]]
* [https://github.com/jetstack/cert-manager OpenShift cert-manager]
* [https://docs.cert-manager.io/en/latest/getting-started/install/openshift.html Installing on OpenShift]
* [https://cert-manager.io/docs/configuration/acme/ cert-manager ACME]
* [https://cert-manager.io/docs/tutorials/acme/http-validation/ cert-manager HTTP Validation]
* [https://cert-manager.io/docs/tutorials/acme/dns-validation/ cert-manager DNS Validation]
* [https://cert-manager.io/docs/tutorials/acme/ingress/ Securing NGINX-ingress]
* [[K3s]]
* [https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes How to Set Up an Nginx Ingress with Cert-Manager on DigitalOcean Kubernetes]