带有云 dns 的 GKE 上的证书管理器配置答案

【问题标题】：cert-mananger configuration on GKE with clouddns带有云 dns 的 GKE 上的证书管理器配置
【发布时间】：2020-06-28 02:56:27
【问题描述】：

所以我希望使用 google clouddns 在 GKE 上设置 cert-manager。似乎很多关于 SO 的旧问题都在使用 http01 而不是 dns01。我想确保一切都是正确的，这样我就不会受到速率限制。

这是我的issuer.yaml

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: engineering@company.com 
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    - dns01:
        clouddns:
          project: MY-GCP_PROJECT
          # This is the secret used to access the service account
          serviceAccountSecretRef:
            name: clouddns-dns01-solver-svc-acct
            key: key.json

这是我的certificate.yaml

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-website
  namespace: default
spec:
  secretName: my-website-tls
  issuerRef:
    # The issuer created previously
    name: letsencrypt-staging
  dnsNames:
  - my.website.com

我运行了这些命令来配置所有内容：

kubectx my-cluster
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager.yaml
kubectl get pods --namespace cert-manager
gcloud iam service-accounts create dns01-solver --display-name "dns01-solver"
gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:dns01-solver@$PROJECT_ID.iam.gserviceaccount.com --role roles/dns.admin
gcloud iam service-accounts keys create key.json --iam-account dns01-solver@$PROJECT_ID.iam.gserviceaccount.com
kubectl create secret generic clouddns-dns01-solver-svc-acct --from-file=key.json
kubectl apply -f issuer.yaml
kubectl apply -f certificate.yaml

这是kubectl describe certificaterequests的输出

Name:         my-certificaterequests
Namespace:    default
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: my-website
              cert-manager.io/private-key-secret-name: my-website-tls
              kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"my-cluster","namespace":"default...
API Version:  cert-manager.io/v1alpha3
Kind:         CertificateRequest
Metadata:
  Creation Timestamp:  2020-06-28T00:05:55Z
  Generation:          1
  Owner References:
    API Version:           cert-manager.io/v1alpha2
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Certificate
    Name:                  my-cluster
    UID:                   81efe2fd-5f58-4c84-ba25-dd9bc63b032a
  Resource Version:        192470614
  Self Link:               /apis/cert-manager.io/v1alpha3/namespaces/default/certificaterequests/my-certificaterequests
  UID:                     8a0c3e2d-c48e-4cda-9c70-b8dcfe94f14c
Spec:
  Csr:  ...
  Issuer Ref:
    Name:  letsencrypt-staging
Status:
  Certificate: ...
  Conditions:
    Last Transition Time:  2020-06-28T00:07:51Z
    Message:               Certificate fetched from issuer successfully
    Reason:                Issued
    Status:                True
    Type:                  Ready
Events:
  Type    Reason             Age   From          Message
  ----    ------             ----  ----          -------
  Normal  OrderCreated       16m   cert-manager  Created Order resource default/my-certificaterequests-484284207
  Normal  CertificateIssued  14m   cert-manager  Certificate fetched from issuer successfully

我看到了秘密kubectl get secret my-website-tls

NAME                    TYPE                DATA   AGE
my-website-tls   kubernetes.io/tls   3      18m

这是否意味着一切正常，我应该在 prod 中尝试一下？让我担心的是，我的云控制台中没有看到任何 DNS 记录发生变化。

另外我想确认一下：

如何将证书更改为通配符 *.company.com？
如果事实上我已经准备好进行生产并且将获得证书，我只需要更新我的入口部署中的密钥名称即可重新部署？

任何见解将不胜感激。谢谢

【问题讨论】：

标签： kubernetes ssl-certificate google-kubernetes-engine lets-encrypt cert-manager

【解决方案1】：

我已经在 Slack 上回答了你。如果使用 ingress-shim，您可以通过更改证书的 dnsNames 部分或 spec.tls.*.hosts 中的值来更改名称，您只需完全按照您显示的方式包含通配符名称。

【讨论】：