[TOC] # 版本兼容 請參考 https://cert-manager.io/docs/installation/supported-releases/ # 安裝cert-manager ## manifests >[info] 前置條件：kubernetes版本，請參考 [版本兼容](#版本兼容) >[info] manifests安裝的話，是指定創建到cert-manager命名空間下的 1. 下載manifests文件 ```shell curl -L -o /etc/kubernetes/addons/cert-manager.crds.yaml https://github.com/cert-manager/cert-manager/releases/download/v1.12.4/cert-manager.crds.yaml curl -L -o /etc/kubernetes/addons/cert-manager.yaml https://github.com/cert-manager/cert-manager/releases/download/v1.12.4/cert-manager.yaml ``` 2. 安裝cert-manager ```shell $ kubectl apply -f /etc/kubernetes/addons/cert-manager.crds.yaml -f /etc/kubernetes/addons/cert-manager.yaml customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created namespace/cert-manager created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io unchanged customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io unchanged customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io unchanged customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io unchanged customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io unchanged customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io unchanged serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager created serviceaccount/cert-manager-webhook created configmap/cert-manager-webhook created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created service/cert-manager created service/cert-manager-webhook created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager created deployment.apps/cert-manager-webhook created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created ``` ## Helm(推薦) >[info] 前置條件： > 1. kubernetes版本，請參考 [版本兼容](#版本兼容) > 2. helm版本要求 `3.x` 1. 添加 Helm 存儲庫 ```shell $ helm repo add jetstack https://charts.jetstack.io "jetstack" has been added to your repositories ``` 2. 更新本地 Helm 圖表存儲庫緩存 ```shell $ helm repo update Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the "jetstack" chart repository Update Complete. ?Happy Helming!? ``` 3. 將 helm 模板輸出為 yaml 文件 ```shell $ helm template \ cert-manager jetstack/cert-manager \ --namespace kube-system \ --set installCRDs=true \ > /etc/kubernetes/addons/cert-manager.custom.yaml ``` 4. 安裝 cert-manager ```shell $ kubectl apply -f /etc/kubernetes/addons/cert-manager.custom.yaml serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager created serviceaccount/cert-manager-webhook created configmap/cert-manager-webhook created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created service/cert-manager created service/cert-manager-webhook created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager created deployment.apps/cert-manager-webhook created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created serviceaccount/cert-manager-startupapicheck created role.rbac.authorization.k8s.io/cert-manager-startupapicheck:create-cert created rolebinding.rbac.authorization.k8s.io/cert-manager-startupapicheck:create-cert created job.batch/cert-manager-startupapicheck created ``` # 驗證服務 ```shell # manifests安裝方式驗證 $ kubectl get pod -l app.kubernetes.io/instance=cert-manager -n cert-manager NAME READY STATUS RESTARTS AGE cert-manager-744b6d8759-vfb4k 1/1 Running 0 4m45s cert-manager-cainjector-85df464f89-57f5d 1/1 Running 0 4m45s cert-manager-webhook-5859488dd9-nb4r7 1/1 Running 0 4m45s # helm安裝方式驗證 $ kubectl get pod -l app.kubernetes.io/instance=cert-manager -n kube-system NAME READY STATUS RESTARTS AGE cert-manager-59b8db44b7-gbpw4 1/1 Running 0 67m cert-manager-cainjector-59645fb86f-bml66 1/1 Running 0 67m cert-manager-startupapicheck-dshvd 0/1 Completed 0 67m cert-manager-webhook-f75b4d5b5-drbph 1/1 Running 0 67m $ kubectl -n kube-system logs -l app.kubernetes.io/name=startupapicheck Not ready: the cert-manager webhook CA bundle is not injected yet Not ready: the cert-manager webhook CA bundle is not injected yet Not ready: the cert-manager webhook CA bundle is not injected yet Not ready: the cert-manager webhook CA bundle is not injected yet The cert-manager API is ready ``` # 卸載服務 0. 請確保已刪除用戶創建的不需要的證書管理器資源。 您可以使用以下命令檢查任何現有資源 ```shell kubectl get Issuers,ClusterIssuers,Certificates,CertificateRequests,Orders,Challenges --all-namespaces ``` ## manifests 1. 卸載相關yaml文件 ```shell kubectl delete -f /etc/kubernetes/addons/cert-manager.yaml -f /etc/kubernetes/addons/cert-manager.crds.yaml ``` ## Helm 1. 卸載相關yaml文件 ```shell kubectl delete -f /etc/kubernetes/addons/cert-manager.custom.yaml ``` # 參考文檔 cert-manager官網文章：https://cert-manager.io/docs/installation/