Skip to content

Commit 4837ad8

Browse files
snarayan-redhatsnarayan-redhat
authored
Merge pull request #70018 from snarayan-redhat/OSDOCS-9282_managingcertificates
OSDOCS#9282: Creating certificates using an issuer for cert-manager
2 parents bd5f76e + 3a647ee commit 4837ad8

11 files changed

+233
-170
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1064,8 +1064,10 @@ Topics:
10641064
File: cert-manager-operator-release-notes
10651065
- Name: Installing the cert-manager Operator for Red Hat OpenShift
10661066
File: cert-manager-operator-install
1067-
- Name: Managing certificates with an ACME issuer
1067+
- Name: Configuring an ACME issuer
10681068
File: cert-manager-operator-issuer-acme
1069+
- Name: Configuring certificates with an issuer
1070+
File: cert-manager-creating-certificate
10691071
- Name: Enabling monitoring for the cert-manager Operator for Red Hat OpenShift
10701072
File: cert-manager-monitoring
10711073
- Name: Configuring the egress proxy for the cert-manager Operator for Red Hat OpenShift

‎modules/cert-manager-acme-dns01-ambient-aws.adoc

Lines changed: 0 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -100,40 +100,4 @@ spec:
100100
[source,terminal]
101101
----
102102
$ oc create -f issuer.yaml
103-
----
104-
105-
. Create a certificate:
106-
107-
.. Create a YAML file that defines the `Certificate` object:
108-
+
109-
.Example `certificate.yaml` file
110-
[source,yaml]
111-
----
112-
apiVersion: cert-manager.io/v1
113-
kind: Certificate
114-
metadata:
115-
name: <tls_cert> <1>
116-
namespace: <issuer_namespace> <2>
117-
spec:
118-
isCA: false
119-
commonName: '<common_name>' <3>
120-
secretName: <tls-cert> <4>
121-
dnsNames:
122-
- '<domain_name>' <5>
123-
issuerRef:
124-
name: <letsencrypt_staging> <6>
125-
kind: Issuer
126-
----
127-
<1> Provide a name for the certificate.
128-
<2> Specify the namespace that you created for the issuer.
129-
<3> Replace `<common_name>` with your common name (CN).
130-
<4> Specify the name of the secret to create that will contain the certificate.
131-
<5> Replace `<domain_name>` with your domain name.
132-
<6> Specify the name of the issuer that you created.
133-
134-
.. Create the `Certificate` object by running the following command:
135-
+
136-
[source,terminal]
137-
----
138-
$ oc create -f certificate.yaml
139103
----

‎modules/cert-manager-acme-dns01-ambient-gcp.adoc

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -97,35 +97,4 @@ spec:
9797
[source,terminal]
9898
----
9999
$ oc create -f issuer.yaml
100-
----
101-
102-
. Create a certificate:
103-
104-
.. Create a YAML file that defines the `Certificate` object:
105-
+
106-
.Example `certificate.yaml` file
107-
[source,yaml]
108-
----
109-
apiVersion: cert-manager.io/v1
110-
kind: Certificate
111-
metadata:
112-
name: <tls_cert> <1>
113-
namespace: <issuer_namespace>
114-
spec:
115-
secretName: <tls_cert> <2>
116-
issuerRef:
117-
name: <acme-dns01-clouddns_issuer> <3>
118-
dnsNames:
119-
- '<domain_name>' <4>
120-
----
121-
<1> Provide a name for the certificate.
122-
<2> Specify the name of the secret to create that will contain the certificate.
123-
<3> Specify the name of the issuer that you created.
124-
<4> Replace `<domain_name>` with your domain name.
125-
126-
.. Create the `Certificate` object by running the following command:
127-
+
128-
[source,terminal]
129-
----
130-
$ oc create -f certificate.yaml
131100
----

‎modules/cert-manager-acme-dns01-explicit-aws.adoc

Lines changed: 1 addition & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -112,40 +112,4 @@ spec:
112112
[source,terminal]
113113
----
114114
$ oc create -f issuer.yaml
115-
----
116-
117-
. Create a certificate:
118-
119-
.. Create a YAML file that defines the `Certificate` object:
120-
+
121-
.Example `certificate.yaml` file
122-
[source,yaml]
123-
----
124-
apiVersion: cert-manager.io/v1
125-
kind: Certificate
126-
metadata:
127-
name: <tls_cert> <1>
128-
namespace: <issuer_namespace> <2>
129-
spec:
130-
isCA: false
131-
commonName: '<common_name>' <3>
132-
secretName: <tls_cert> <4>
133-
dnsNames:
134-
- '<domain_name>' <5>
135-
issuerRef:
136-
name: <letsencrypt_staging> <6>
137-
kind: Issuer
138-
----
139-
<1> Provide a name for the certificate.
140-
<2> Specify the namespace that you created for the issuer.
141-
<3> Replace `<common_name>` with your common name (CN).
142-
<4> Specify the name of the secret to create that will contain the certificate.
143-
<5> Replace `<domain_name>` with your domain name.
144-
<6> Specify the name of the issuer that you created.
145-
146-
.. Create the `Certificate` object by running the following command:
147-
+
148-
[source,terminal]
149-
----
150-
$ oc create -f certificate.yaml
151-
----
115+
----

‎modules/cert-manager-acme-dns01-explicit-azure.adoc

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -118,36 +118,4 @@ spec:
118118
[source,terminal]
119119
----
120120
$ oc create -f issuer.yaml
121-
----
122-
123-
. Create a certificate:
124-
125-
.. Create a YAML file that defines the `Certificate` object:
126-
+
127-
.Example `certificate.yaml` file
128-
[source,yaml]
129-
----
130-
apiVersion: cert-manager.io/v1
131-
kind: Certificate
132-
metadata:
133-
name: <tls_cert> <1>
134-
namespace: <issuer-namespace> <2>
135-
spec:
136-
secretName: <tls_cert> <3>
137-
issuerRef:
138-
name: <acme-dns01-azuredns-issuer> <4>
139-
dnsNames:
140-
- '<domain_name>' <5>
141-
----
142-
<1> Provide a name for the certificate.
143-
<2> Replace `<issuer_namespace>` with your issuer namespace.
144-
<3> Specify the name of the secret to create that will contain the certificate.
145-
<4> Specify the name of the issuer that you created.
146-
<5> Replace `<domain_name>` with your domain name.
147-
148-
.. Create the `Certificate` object by running the following command:
149-
+
150-
[source,terminal]
151-
----
152-
$ oc create -f certificate.yaml
153121
----

‎modules/cert-manager-acme-dns01-explicit-gcp.adoc

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -105,36 +105,4 @@ spec:
105105
[source,terminal]
106106
----
107107
$ oc create -f issuer.yaml
108-
----
109-
110-
. Create a certificate:
111-
112-
.. Create a YAML file that defines the `Certificate` object:
113-
+
114-
.Example `certificate.yaml` file
115-
[source,yaml]
116-
----
117-
apiVersion: cert-manager.io/v1
118-
kind: Certificate
119-
metadata:
120-
name: <tls_cert> <1>
121-
namespace: <issuer-namespace> <2>
122-
spec:
123-
secretName: <tls_cert> <3>
124-
issuerRef:
125-
name: issuer-acme-dns01-clouddns <4>
126-
dnsNames:
127-
- '<domain_name>' <5>
128-
----
129-
<1> Provide a name for the certificate.
130-
<2> Replace `<issuer_namespace>` with your issuer namespace.
131-
<3> Specify the name of the secret to create that will contain the certificate.
132-
<4> Specify the name of the issuer that you created.
133-
<5> Replace `<domain_name>` with your domain name.
134-
135-
.. Create the `Certificate` object by running the following command:
136-
+
137-
[source,terminal]
138-
----
139-
$ oc create -f certificate.yaml
140108
----

‎modules/cert-manager-certificate-api-server.adoc

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-creating-certificate.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-certificate-api-server_{context}"]
7+
= Creating certificates for the API server
8+
9+
.Prerequisites
10+
11+
* You have access to the cluster with `cluster-admin` privileges.
12+
* You have installed the {cert-manager-operator} 1.13.0 or later.
13+
14+
.Procedure
15+
16+
. Create an issuer. For more information, see "Configuring an issuer" in the "Additional Resources" section.
17+
18+
. Create a certificate:
19+
20+
.. Create a YAML file, for example, `certificate.yaml`, that defines the `Certificate` object:
21+
+
22+
.Example `certificate.yaml` file
23+
+
24+
[source, yaml]
25+
----
26+
apiVersion: cert-manager.io/v1
27+
kind: Certificate
28+
metadata:
29+
name: <tls_cert> #<1>
30+
namespace: openshift-config
31+
spec:
32+
isCA: false
33+
commonName: "api.<cluster_base_domain>" #<2>
34+
secretName: <secret_name> #<3>
35+
dnsNames:
36+
- "api.<cluster_base_domain>" #<4>
37+
issuerRef:
38+
name: <issuer_name> #<5>
39+
kind: Issuer
40+
----
41+
<1> Provide a name for the certificate.
42+
<2> Specify the common name (CN).
43+
<3> Specify the name of the secret to create that contains the certificate.
44+
<4> Specify the DNS name of the API server.
45+
<5> Specify the name of the issuer.
46+
47+
.. Create the `Certificate` object by running the following command:
48+
+
49+
[source, terminal]
50+
----
51+
$ oc create -f certificate.yaml
52+
----
53+
54+
. Add the API server named certificate. For more information, see "Adding an API server named certificate" section in the "Additional resources" section.
55+
56+
[NOTE]
57+
====
58+
To ensure the certificates are updated, run the `oc login` command again after the certificate is created.
59+
====
60+
61+
.Verification
62+
63+
* Verify that the certificate is created and ready to use by running the following command:
64+
+
65+
[source, terminal]
66+
----
67+
$ oc get certificate -w -n openshift-config
68+
----
69+
+
70+
Once certificate is in `Ready` status, API server on your cluster can start using the generated certificate secret.

‎modules/cert-manager-certificate-ingress.adoc

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-creating-certificate.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-certificate-ingress_{context}"]
7+
= Creating certificates for the Ingress Controller
8+
9+
.Prerequisites
10+
11+
* You have access to the cluster with `cluster-admin` privileges.
12+
* You have installed the {cert-manager-operator} 1.13.0 or later.
13+
14+
.Procedure
15+
16+
. Create an issuer. For more information, see "Configuring an issuer" in the "Additional Resources" section.
17+
18+
. Create a certificate:
19+
20+
.. Create a YAML file, for example, `certificate.yaml`, that defines the `Certificate` object:
21+
+
22+
.Example `certificate.yaml` file
23+
+
24+
[source, yaml]
25+
----
26+
apiVersion: cert-manager.io/v1
27+
kind: Certificate
28+
metadata:
29+
name: <tls_cert> #<1>
30+
namespace: openshift-ingress
31+
spec:
32+
isCA: false
33+
commonName: "apps.<cluster_base_domain>" #<2>
34+
secretName: <secret_name> #<3>
35+
dnsNames:
36+
- "apps.<cluster_base_domain>" #<4>
37+
- "*.apps.<cluster_base_domain>" #<4>
38+
issuerRef:
39+
name: <issuer_name> #<5>
40+
kind: Issuer
41+
----
42+
<1> Provide a name for the certificate.
43+
<2> Specify the common name (CN).
44+
<3> Specify the name of the secret to create that contains the certificate.
45+
<4> Specify the DNS name of the ingress.
46+
<5> Specify the name of the issuer.
47+
48+
.. Create the `Certificate` object by running the following command:
49+
+
50+
[source, terminal]
51+
----
52+
$ oc create -f certificate.yaml
53+
----
54+
55+
. Replace the default ingress certificate. For more information, see "Replacing the default ingress certificate" section in the "Additional resources" section.
56+
57+
.Verification
58+
59+
* Verify that the certificate is created and ready to use by running the following command:
60+
+
61+
[source, terminal]
62+
----
63+
$ oc get certificate -w -n openshift-ingress
64+
----
65+
+
66+
Once certificate is in `Ready` status, Ingress Controller on your cluster can start using the generated certificate secret.

0 commit comments

Comments
 (0)