4 posts tagged with "security"

$ helm install --name cert-manager --version v0.3.1 \
    --namespace kube-system stable/cert-manager

$ helm status cert-manager
LAST DEPLOYED: Fri Jun 15 10:02:45 2018
NAMESPACE: kube-system
STATUS: DEPLOYED

RESOURCES:
==> v1/Pod(related)
NAME                                        READY  STATUS   RESTARTS  AGE
cert-manager-cert-manager-5f76b676b4-5tdh8  1/1    Running  0         2d

==> v1/ServiceAccount
NAME                       SECRETS  AGE
cert-manager-cert-manager  1        28d

==> v1beta1/CustomResourceDefinition
NAME                               AGE
certificates.certmanager.k8s.io    28d
clusterissuers.certmanager.k8s.io  28d
issuers.certmanager.k8s.io         28d

==> v1beta1/ClusterRole
cert-manager-cert-manager  28d

==> v1beta1/ClusterRoleBinding
NAME                       AGE
cert-manager-cert-manager  28d

==> v1beta1/Deployment
NAME                       DESIRED  CURRENT  UP-TO-DATE  AVAILABLE  AGE
cert-manager-cert-manager  1        1        1           1          28d


NOTES:
cert-manager has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://cert-manager.readthedocs.io/en/latest/reference/issuers.html

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html

$ export EMAIL=zaction@sk.com

# Copyright 2018 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: ''
    privateKeySecretRef:
      name: letsencrypt-staging
    http01: {}
---
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ''
    privateKeySecretRef:
      name: letsencrypt-prod
    http01: {}

$ sed -e "s/email: ''/email: $EMAIL/g" letsencrypt-issuer.yaml | \
    kubectl apply -f-
clusterissuer "letsencrypt-staging" created
clusterissuer "letsencrypt-prod" created

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: auth-ingress
spec:
  rules:
  - host: auth.dev.action.cloudz.co.kr
    http:
      paths:
      - backend:
          serviceName: faas-auth-service
          servicePort: 8081
        path: /

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: auth-dev-tls
  namespace: auth #### namespace별 생성
spec:
  secretName: auth-dev-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: auth.dev.action.cloudz.co.kr
  dnsNames:
  - auth.dev.action.cloudz.co.kr
  acme:
    config:
    - http01:
        ingress: auth-ingress ### 기존에 만든 HTTP ingress 명
      domains:
      - auth.dev.action.cloudz.co.kr

$ kubectl apply -f auth-dev-tls.yaml
certificate "auth-dev-tls" created

$ kubectl describe -f auth-dev-tls.yaml
...
Type     Reason                Message
----     ------                -------
Warning  ErrorCheckCertificate Error checking existing TLS certificate: secret "auth-dev-tls" not found
Normal   PrepareCertificate    Preparing certificate with issuer
Normal   PresentChallenge      Presenting http-01 challenge for domain foo.kubernetes.tips
Normal   SelfCheck             Performing self-check for domain auth.dev.action.cloudz.co.kr
Normal   ObtainAuthorization   Obtained authorization for domain auth.dev.action.cloudz.co.kr
Normal   IssueCertificate      Issuing certificate...
Normal   CeritifcateIssued     Certificated issued successfully

$ kubectl get secret | grep tls
auth-dev-tls                 kubernetes.io/tls                     2         3h

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: auth-ingress
  annotations:
      ingress.bluemix.net/hsts: enabled=true maxAge=<31536000> includeSubdomains=true
      ingress.bluemix.net/redirect-to-https: "True"
spec:
  rules:
  - host: auth.dev.action.cloudz.co.kr
    http:
      paths:
      - backend:
          serviceName: faas-auth-service
          servicePort: 8081
        path: /
  tls:
  - hosts:
    - auth.dev.action.cloudz.co.kr
    secretName: auth-dev-tls

$ kubectl apply -f auth-tls-ingress.yaml

$ kubectl get ing
NAME           HOSTS                          ADDRESS         PORTS     AGE
auth-ingress   auth.dev.action.cloudz.co.kr   10.1.1.182   80, 443   14h