Task
Install cert-manager (cert-managerProject) in OCP for LetsEncrypt (LE), Hashicorp and CyberArk.
Note:
- For LE to work, it requires external access to the OCP cluster for certificates. Configure in your firewall or reverse proxy with an external entry port 80 for your internal OCP/OKD installation for the cert-manger's LE certbot equivilent.
- We create the new project before running the github installation (oc apply).
Steps:
1. Login as admin/kubeadmin:
$ oc login -u kubeadmin api.endpoint.mindwatering.net:6443
<enter password at prompt, confirm Login Successful message>
2. Create project/namespace:
$ oc new-project cert-manager
<confirm now using cert-manager namespace on server>
3. Run installation and verify:
a. Install via Git:
$ oc apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.1/certmanager.yaml
<wait while installed>
b. Verify pods running:
$ oc get pods
- or -
$ oc get pods -n cert-manager
<confirm all three pods are in Running state: the manager, the cainjector, and the webhood>
c. Install the cert-manager control API (cmctl):
$ OS=$(uname -s | tr A-Z a-z); ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/'); curl -fsSL -o cmctl https://github.com/cert-manager/cmctl/releases/latest/download/cmctl_${OS}_${ARCH}
$ chmod +x cmctl
$ sudo mv cmctl /usr/local/bin
<enter password if prompted>
d. Confirm API is healthy:
$ cmctl check api
<verify cert-manager API is healthy message>
4. (Optional maybe) Run a full test issuing a certificate:
Note:
- Cert-manager documentation has a test YAML example to confirm functionality. (see below)
a. Create test YAML file:
$ cat ~/cert-manager-test/test-resources.yaml
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager-test
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: test-selfsigned
namespace: cert-manager-test
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: selfsigned-cert
namespace: cert-manager-test
spec:
dnsNames:
- example.com
secretName: selfsigned-cert-tls
issuerRef:
name: test-selfsigned
b. Create new project/namespace:
$ oc new-project cert-manager-test
<confirm now using cert-manager-test namespace on server>
c. Run the test:
$ oc apply -f ~/cert-manager-test/test-resources.yaml
d. Verify the test results:
$ oc describe certificate -n cert-manager-test
...
Spec:
Common Name: example.com
Issuer Ref:
Name: test-selfsigned
Secret Name: selfsigned-cert-tls
Status:
Conditions:
Last Transition Time: 2019-01-29T17:34:30Z
Message: Certificate is up to date and has not expired
Reason: Ready
Status: True
Type: Ready
Not After: 2019-04-29T17:34:29Z
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal CertIssued 4s cert-manager Certificate issued successfully
e. When ready, delete the test certificate:
$ oc delete -f ~/cert-manager-test/test-resources.yaml
---
Uninstall Warning:
- If uninstalling cert-manager, it is import to ensure:
- - nothing is using the cert-manager
- - uninstall is performed same method as install (e.g. re-run with delete the same github url version used with install - hopefully it will be still available)
a. Verify nothing used:
$ oc get Issuers,ClusterIssuers,Certificates,CertificateRequests,Orders,Challenges --all-namespaces
<verify nothing returned>
b. Run removal/delete:
$ oc delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.1/certmanager.yaml
<wait while installed>
previous page
|