cert-manager: add trusted internal ca when configured (#8135)

* cert-manager: add trusted internal ca when configured

* wrong check for inventory variable

* Update documentation
This commit is contained in:
Antoine Gatineau 2021-11-05 17:43:52 +01:00 committed by GitHub
parent 6e5b9e0ebf
commit b7eb1cf936
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 40 additions and 0 deletions

View file

@ -88,6 +88,20 @@ Certificates issued by public ACME servers are typically trusted by clients c
- [DNS01 Challenges](https://cert-manager.io/v1.5-docs/configuration/acme/dns01/)
- [ACME FAQ](https://cert-manager.io/v1.5-docs/faq/acme/)
#### ACME With An Internal Certificate Authority
The ACME Issuer with an internal certificate authority requires cert-manager to trust the certificate authority. This trust must be done at the cert-manager deployment level.
To add a trusted certificate authority to cert-manager, add it's certificate to `group_vars/k8s-cluster/addons.yml`:
```yaml
cert_manager_trusted_internal_ca: |
-----BEGIN CERTIFICATE-----
[REPLACE with your CA certificate]
-----END CERTIFICATE-----
```
Once the CA is trusted, you can define your issuer normally.
### Create New TLS Root CA Certificate and Key
#### Install Cloudflare PKI/TLS `cfssl` Toolkit

View file

@ -129,6 +129,10 @@ ingress_alb_enabled: false
# Cert manager deployment
cert_manager_enabled: false
# cert_manager_namespace: "cert-manager"
# cert_manager_trusted_internal_ca: |
# -----BEGIN CERTIFICATE-----
# [REPLACE with your CA certificate]
# -----END CERTIFICATE-----
# MetalLB deployment
metallb_enabled: false

View file

@ -875,6 +875,17 @@ spec:
resources:
{}
---
{% if cert_manager_trusted_internal_ca is defined %}
apiVersion: v1
data:
internal-ca.pem: |
{{ cert_manager_trusted_internal_ca | indent(width=4, indentfirst=False) }}
kind: ConfigMap
metadata:
name: ca-internal-truststore
namespace: {{ cert_manager_namespace }}
---
{% endif %}
# Source: cert-manager/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
@ -928,6 +939,17 @@ spec:
fieldPath: metadata.namespace
resources:
{}
{% if cert_manager_trusted_internal_ca is defined %}
volumeMounts:
- mountPath: /etc/ssl/certs/internal-ca.pem
name: ca-internal-truststore
subPath: internal-ca.pem
volumes:
- configMap:
defaultMode: 420
name: ca-internal-truststore
name: ca-internal-truststore
{% endif %}
---
# Source: cert-manager/templates/webhook-deployment.yaml
apiVersion: apps/v1