[最全]Kubernetes 集羣自動生成更新HTTPS證書教程，含單域名，通配符域名證書申請，阿里雲DNS

簡介

詳情請到GitHub查看：https://github.com/PowerDos/k8s-cret-manager-aliyun-webhook-demo

這裏介紹如何在K8s中通過cret-manager自動創建HTTPS證書，提供兩種方式，一種是單域名證書，一種是通過阿里雲DNS驗證實現通配符域名證書申請

我們這裏通過Helm安裝cret-manager,請注意查看k8s版本正確安裝對應版本的應用

1.安裝Helm 3

官方安裝教程: https://helm.sh/docs/intro/install/

$ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
$ chmod 700 get_helm.sh
$ ./get_helm.sh

2.安裝cert-manager

前期準備

添加命名空間

kubectl create namespace cert-manager

添加cret-manager源

helm repo add jetstack https://charts.jetstack.io

更新源

helm repo update

安裝CRDs

注意安裝對應的版本

# Kubernetes 1.15+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager.crds.yaml

# Kubernetes <1.15
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager-legacy.crds.yaml

安裝cert-manager

$ helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v0.15.1

驗證是否安裝成功

以下結果爲成功，你也可以看看鏡像日誌，是否正常啓動，是否正常

$ kubectl get pods --namespace cert-manager

NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-5c6344597-zw8kh               1/1     Running   0          2m
cert-manager-cainjector-348f6d9fd7-tr77l   1/1     Running   0          2m
cert-manager-webhook-893u48fcdb-nlzsq      1/1     Running   0          2m

3.安裝證書

官方介紹這中 Issuer 與 ClusterIssuer 的概念：

Issuers, and ClusterIssuers, are Kubernetes resources that represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request.

Issuer 與 ClusterIssuer 的區別是 ClusterIssuer 可跨命名空間使用，而 Issuer 需在每個命名空間下配置後纔可使用。這裏我們使用 ClusterIssuer，其類型選擇 Let‘s Encrypt

測試證書

# cluster-issuer-letsencrypt-staging.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # 務必將此處替換爲你自己的郵箱, 否則會配置失敗。當證書快過期時 Let's Encrypt 會與你聯繫
    email: [email protected]
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # 將用來存儲 Private Key 的 Secret 資源
      name: letsencrypt-staging
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
    - http01:
        ingress:
          class: nginx

正式證書

# cluster-issuer-letsencrypt-prod.yaml

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email:  [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

這裏安裝兩個環境的證書的作用

這裏分別配置了測試環境與生產環境兩個 ClusterIssuer， 原因是 Let’s Encrypt 的生產環境有着非常嚴格的接口調用限制，最好是在測試環境測試通過後，再切換爲生產環境。生產環境和測試環境的區別：https://letsencrypt.org/zh-cn/docs/staging-environment/

在Ingress中使用證書

在ingress配置後，會自動生成證書

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kuard
  annotations:
    # 務必添加以下兩個註解, 指定 ingress 類型及使用哪個 cluster-issuer
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer："letsencrypt-staging" # 這裏先用測試環境的證書測通後，就可以替換成正式服證書

    # 如果你使用 issuer, 使用以下註解 
    # cert-manager.io/issuer: "letsencrypt-staging"
spec:
  tls:
  - hosts:
    - example.example.com                # TLS 域名 - 這裏僅支持單域名，下面會講通配符的域名配置
    secretName: quickstart-example-tls   # 用於存儲證書的 Secret 對象名字，可以是任意名稱，cert-manager會自動生成對應名稱的證書名稱
  rules:
  - host: example.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kuard
          servicePort: 80

4.通過DNS配置通配符域名證書

這裏樣式的是阿里雲DNS操作的流程，如果需要其他平臺的方法，可以自行開發，或者找已開源webhook，這是官方的例子：https://github.com/jetstack/cert-manager-webhook-example

這裏用的是這個包：https://github.com/pragkent/alidns-webhook

安裝WebHook

不同cret-manager的安裝辦法不同

cret-manager 版本大於等於v0.11

安裝

# Install alidns-webhook to cert-manager namespace. 
kubectl apply -f https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/bundle.yaml

添加阿里雲RAM賬號

子賬號需要開通HTTPS管理權限(AliyunDNSFullAccess,管理雲解析（DNS）的權限)

apiVersion: v1
kind: Secret
metadata:
  name: alidns-secret
  namespace: cert-manager
data:
  access-key: YOUR_ACCESS_KEY # 需要先base64加密
  secret-key: YOUR_SECRET_KEY # 需要先base64加密

創建ClusterIssuer

測試證書申請

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging-dns
spec:
  acme:
    email: [email protected]
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com # 注意這裏要改動，在https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/bundle.yaml中也要改動對應的groupName
          solverName: alidns
          config:
            region: ""
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

正式證書申請

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod-dns
spec:
  acme:
    email: [email protected]
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com
          solverName: alidns
          config:
            region: "" # 這裏可以不填 或者填對應的區域:cn-shenzhen
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

創建Certificate

測試證書

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ditigram-com-staging-tls
spec:
  secretName: ditigram-com-staging-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-staging-dns
    kind: ClusterIssuer

正式證書

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ditigram-com-prod-tls
spec:
  secretName: ditigram-com-prod-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-prod-dns
    kind: ClusterIssuer

在Ingress中應用

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kuard
  annotations:
    # 務必添加以下兩個註解, 指定 ingress 類型及使用哪個 cluster-issuer
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer："letsencrypt-staging-dns" # 這裏先用測試環境的證書測通後，就可以替換成正式服證書
spec:
  tls:
  - hosts:
    - "*.ditigram.com"                     # 如果填寫單域名就只會生產單域名的證書，如果是通配符請填寫"*.example.com", 注意：如果填寫example.com只會生成www.example.com一個域名。
    secretName: ditigram-com-staging-tls   # 測試的證書，填寫剛剛創建Certificate的名稱，注意更換環境時證書也要一起更換，這裏並不會像單域名一樣自動生成
  rules:
  - host: example.ditigram.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kuard
          servicePort: 80

cret-manager 版本小於v0.11

安裝

# Install alidns-webhook to cert-manager namespace. 
kubectl apply -f https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/legacy.yaml

添加阿里雲RAM賬號

子賬號需要開通HTTPS管理權限(AliyunDNSFullAccess,管理雲解析（DNS）的權限)

apiVersion: v1
kind: Secret
metadata:
  name: alidns-secret
  namespace: cert-manager
data:
  access-key: YOUR_ACCESS_KEY # 需要先base64加密
  secret-key: YOUR_SECRET_KEY # 需要先base64加密

創建ClusterIssuer

測試證書申請

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging-dns
spec:
  acme:
    email: [email protected]
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com # 注意這裏要改動，在https://raw.githubusercontent.com/pragkent/alidns-webhook/master/deploy/bundle.yaml中也要改動對應的groupName
          solverName: alidns
          config:
            region: ""
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

正式證書申請

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod-dns
spec:
  acme:
    email: [email protected]
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-dns
    solvers:
    - dns01:
        webhook:
          groupName: acme.yourcompany.com
          solverName: alidns
          config:
            region: "" # 這裏可以不填 或者填對應的區域:cn-shenzhen
            accessKeySecretRef:
              name: alidns-secret
              key: access-key
            secretKeySecretRef:
              name: alidns-secret
              key: secret-key

創建Certificate

測試證書

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: ditigram-com-staging-tls
spec:
  secretName: ditigram-com-staging-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-staging-dns
    kind: ClusterIssuer

正式證書

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: ditigram-com-prod-tls
spec:
  secretName: ditigram-com-prod-tls
  commonName: ditigram.com
  dnsNames:
  - ditigram.com
  - "*.ditigram.com"
  issuerRef:
    name: letsencrypt-prod-dns
    kind: ClusterIssuer

在Ingress中應用

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kuard
  annotations:
    # 務必添加以下兩個註解, 指定 ingress 類型及使用哪個 cluster-issuer
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer："letsencrypt-staging-dns" # 這裏先用測試環境的證書測通後，就可以替換成正式服證書
spec:
  tls:
  - hosts:
    - "*.ditigram.com"                     # 如果填寫單域名就只會生產單域名的證書，如果是通配符請填寫"*.example.com", 注意：如果填寫example.com只會生成www.example.com一個域名。
    secretName: ditigram-com-staging-tls   # 測試的證書，填寫剛剛創建Certificate的名稱，注意更換環境時證書也要一起更換，這裏並不會像單域名一樣自動生成
  rules:
  - host: example.ditigram.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kuard
          servicePort: 80