77External issuers extend [ cert-manager] ( https://cert-manager.io/ ) to issue certificates using APIs and services
88which aren't built into the cert-manager core.
99
10- This repository provides an example of an [ External Issuer] built using the [ issuer-lib] library.
10+ This repository provides an example of an [ External Issuer] [ ] built using the [ issuer-lib] [ ] library.
1111
1212## Install
1313
@@ -40,7 +40,7 @@ You will need the following command line tools installed on your PATH:
4040* [ Kubebuilder v3.9.1+] ( https://book.kubebuilder.io/quick-start.html#installation )
4141* [ Kustomize v3.8.1+] ( https://kustomize.io/ )
4242
43- You may also want to read: the [ Kubebuilder Book] and the [ cert-manager Concepts Documentation] for further background
43+ You may also want to read: the [ Kubebuilder Book] [ ] and the [ cert-manager Concepts Documentation] [ ] for further background
4444information.
4545
4646### Create a test cluster
@@ -86,7 +86,7 @@ We will add more to it in the next steps.
8686
8787### Creating MyIssuer and MyClusterIssuer custom resources
8888
89- An [ External Issuer] must implement two custom resources for compatibility with cert-manager: ` MyIssuer ` and ` MyClusterIssuer `
89+ An [ External Issuer] [ ] must implement two custom resources for compatibility with cert-manager: ` MyIssuer ` and ` MyClusterIssuer `
9090
9191NOTE: It is important to understand the [ Concept of Issuers] before proceeding.
9292
@@ -282,8 +282,6 @@ We use a [Distroless Docker Image][] as our Docker base image,
282282and we configure our ` manager ` process to run as ` USER: nonroot:nonroot ` .
283283This limits the privileges of the ` manager ` process in the cluster.
284284
285- The [ kube-rbac-proxy] [ ] sidecar Docker image also uses a non-root user by default (since v0.7.0).
286-
287285Additionally we [ Configure a Security Context] [ ] for the manager Pod.
288286We set ` runAsNonRoot ` , which ensure that the Kubelet will validate the image at runtime
289287to ensure that it does not run as UID 0 (root) and fail to start the container if it does.
@@ -307,12 +305,20 @@ Click the `Publish release` button to trigger the automated release process:
307305
308306## Links
309307
308+ * [ External Issuer]
309+ * [ issuer-lib]
310+ * [ cert-manager Concepts Documentation]
311+ * [ Kubebuilder Book]
312+ * [ Kubebuilder Markers]
313+ * [ Distroless Docker Image]
314+ * [ Configure a Security Context]
315+ * [ GitHub New Release Page]
316+
310317[ External Issuer ] : https://cert-manager.io/docs/contributing/external-issuers
311318[ issuer-lib ] : https://github.com/cert-manager/issuer-lib
312319[ cert-manager Concepts Documentation ] : https://cert-manager.io/docs/concepts
313320[ Kubebuilder Book ] : https://book.kubebuilder.io
314321[ Kubebuilder Markers ] : https://book.kubebuilder.io/reference/markers.html
315322[ Distroless Docker Image ] : https://github.com/GoogleContainerTools/distroless
316323[ Configure a Security Context ] : https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
317- [ kube-rbac-proxy ] : https://github.com/brancz/kube-rbac-proxy
318324[ GitHub New Release Page ] : https://github.com/cert-manager/sample-external-issuer/releases/new
0 commit comments