62 lines
1.6 KiB
Bash
Executable File
62 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# cert-manager plus a self-signed cluster issuer (offline local CA).
|
|
# Notes: docs/notes/addons.md
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
source ./lib/config.sh
|
|
load_config
|
|
|
|
K="kubectl --context ${KUBECONTEXT}"
|
|
|
|
if $K get deployment -n cert-manager cert-manager >/dev/null 2>&1; then
|
|
echo " already installed"
|
|
else
|
|
$K apply -f "https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
|
|
fi
|
|
|
|
echo " waiting for cert-manager..."
|
|
$K wait --namespace cert-manager \
|
|
--for=condition=ready pod --selector=app.kubernetes.io/instance=cert-manager \
|
|
--timeout=240s
|
|
|
|
# A self-signed root, then a CA issuer chained off it. Workloads reference
|
|
# ClusterIssuer/local-ca and get a cert from a CA you can actually distribute.
|
|
echo " creating local CA issuer"
|
|
$K apply -f - <<'YAML' >/dev/null
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: selfsigned-root
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: local-ca
|
|
namespace: cert-manager
|
|
spec:
|
|
isCA: true
|
|
commonName: rig-local-ca
|
|
secretName: local-ca-key-pair
|
|
duration: 87600h
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
issuerRef:
|
|
name: selfsigned-root
|
|
kind: ClusterIssuer
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: local-ca
|
|
spec:
|
|
ca:
|
|
secretName: local-ca-key-pair
|
|
YAML
|
|
|
|
echo " export the CA for your browser/client with:"
|
|
echo " kubectl --context ${KUBECONTEXT} -n cert-manager get secret local-ca-key-pair -o jsonpath='{.data.tls\\.crt}' | base64 -d"
|