隨著 web 的發展，https 對於現代網站來說是必不可少的。如果你想得到一個免費的證書，那麼 Let's Encrypt 是一個不錯的選擇，它的主要目的是推進網站 https 的程式。
感謝 Let's Encrypt 的免費證書
藉助 helm，在 k8s cluster 中為域名配置 https 將會變得非常簡單，部署資源成功後在 k8s 中為 Ingress 配置證書將會變得非常容易: 只需要在 Ingress 中多新增兩行程式碼
本篇文章將介紹如何只需要三步為你的域名配置上 https
在本篇文章之前，假設此時你已經能夠配置 Ingress 併成功訪問到你的域名，如果沒有，你可以參考本系列文章的以上幾篇
如果對你能夠有所幫助，可以幫我在 shfshanyue/op-note 上點個 star。
01 使用 helm 部署 cert-manager
我們選擇這個 helm chart jetstack/cert-manager 部署 https。目前，在 github 上，該倉庫 jetstack/cert-manager 已擁有 4.4K Star。
如果想使用 let's encrypt 自動為 Ingress 配置 https。在部署時需要為 helm chart 指定以下引數。
ingressShim.defaultIssuerName=letsencrypt-prod
ingressShim.defaultIssuerKind=Issuer
複製程式碼這裡有關於 Issuers的文件
部署過程如下，這裡使用了 helm v3 進行部署
# 部署前需要一些 crd
$ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml
# 為 helm 新增 repo
$ helm repo add jetstack https://charts.jetstack.io
# 使用 helm v3 部署，指定引數
$ helm install cert-manager jetstack/cert-manager --set "ingressShim.defaultIssuerName=letsencrypt-prod,ingressShim.defaultIssuerKind=Issuer"
NAME: cert-manager
LAST DEPLOYED: 2019-10-26 21:27:56.488948248 +0800 CST m=+2.081581159
NAMESPACE: default
STATUS: deployed
NOTES:
cert-manager has been deployed successfully!
In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
More information on the different types of issuers and how to configure them
can be found in our documentation:
https://docs.cert-manager.io/en/latest/reference/issuers.html
For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:
https://docs.cert-manager.io/en/latest/reference/ingress-shim.html
複製程式碼校驗狀態，檢視剛才部署 crd 與 pod 的狀態，校驗是否成功
$ kubectl get crd
NAME CREATED AT
certificaterequests.cert-manager.io 2019-10-26T01:16:21Z
certificates.cert-manager.io 2019-10-26T01:16:21Z
challenges.acme.cert-manager.io 2019-10-26T01:16:21Z
clusterissuers.cert-manager.io 2019-10-26T01:16:24Z
issuers.cert-manager.io 2019-10-26T01:16:24Z
orders.acme.cert-manager.io 2019-10-26T01:16:21Z
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
cert-manager-5d8fd69d88-s7dtg 1/1 Running 0 57s
cert-manager-cainjector-755bbf9c6b-ctkdb 1/1 Running 0 57s
cert-manager-webhook-76954fcbcd-h4hrx 1/1 Running 0 57s
複製程式碼02 配置 ACME Issuers
指定 kind 為 Issuer，並修改以下郵箱為自己的郵箱，Issuer 資源配置如下
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: letsencrypt-prod
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: example@shanyue.tech
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: nginx
複製程式碼使用 kubectl apply -f 部署生效
$ kubectl apply -f letsencrypt-issue.yaml
複製程式碼03 為 Ingress 新增 annotation
在部署 Ingress 時指定 annotations 就可以很方便地配置證書
annotations:
kubernetes.io/ingress.class: "nginx"
cert-manager.io/issuer: "letsencrypt-prod"
複製程式碼關於 Ingress 的完整配置如下，你也可以在我的github上檢視 Deployment，Service 到 Ingress 完整的配置: shfshanyue/learn-k8s:/conf/nginx.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: nginx-service-ingress
annotations:
kubernetes.io/ingress.class: "nginx"
cert-manager.io/issuer: "letsencrypt-prod"
spec:
tls:
- hosts:
- nginx.xiange.tech
secretName: nginx-tls
rules:
- host: nginx.xiange.tech
http:
paths:
- backend:
serviceName: nginx-service
servicePort: 80
path: /
複製程式碼校驗 certificate 狀態，Ready 為 True
由於映象在 quay.io 中，pull image 的時間過慢，有可能需要十分鐘
$ kubectl get certificate
NAME READY SECRET AGE
nginx-tls True nginx-tls 44h
$ kubectl describe certificate nginx-tls
Name: nginx-tls
Namespace: default
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1alpha2
Kind: Certificate
Metadata:
Creation Timestamp: 2019-10-26T13:30:06Z
Generation: 1
Owner References:
API Version: extensions/v1beta1
Block Owner Deletion: true
Controller: true
Kind: Ingress
Name: nginx-service-ingress
UID: c9abc7b7-45da-431b-b732-e535a809dfdd
Resource Version: 2822740
Self Link: /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/nginx-tls
UID: ccb3aa54-e967-4813-acbe-41d9801f29a6
Spec:
Dns Names:
nginx.xiange.tech
Issuer Ref:
Group: cert-manager.io
Kind: Issuer
Name: letsencrypt-prod
Secret Name: nginx-tls
Status:
Conditions:
Last Transition Time: 2019-10-26T13:43:02Z
Message: Certificate is up to date and has not expired
Reason: Ready
Status: True
Type: Ready
Not After: 2020-01-24T12:43:01Z
Events: <none>
複製程式碼訪問 Ingress 中配置的域名，Chrome 瀏覽器中左上角的小鎖提示 https 配置成功
