Installing cert-manager on OVHcloud Managed Kubernetes

Find out how to install cert-manager on OVHcloud Managed Kubernetes

Last updated 27th June 2022.

Objective

Cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources.

Cert Manager

It will ensure certificates are valid and up to date periodically, and attempt to renew certificates at an appropriate time before expiry.

Cert Manager architecture

In this tutorial we are going to guide you with the setup of cert-manager on your OVHcloud Managed Kubernetes Service.

Requirements

This tutorial presupposes that you already have a working OVHcloud Managed Kubernetes cluster, and some basic knowledge of how to operate it. If you want to know more on those topics, please look at the OVHcloud Managed Kubernetes Service Quickstart.

You also need to have Helm installer on your workstation and your cluster, please refer to the How to install Helm on OVHcloud Managed Kubernetes Service tutorial.

Installing cert-manager Helm chart

For this tutorial we are using the cert-manager Helm chart found on its own Helm repository.

The chart is fully configurable, but here we are using the default configuration.

Add the cert-manager Helm repository:

helm repo add jetstack https://charts.jetstack.io
helm repo update

These commands will add the Kyverno Helm repository to your local Helm chart repository and update the installed chart repositories:

$ helm repo add jetstack https://charts.jetstack.io
helm repo update
"jetstack" already exists with the same configuration, skipping
Hang tight while we grab the latest from your chart repositories...
...
...Successfully got an update from the "jetstack" chart repository
...
Update Complete. ⎈Happy Helming!⎈

Install the latest version of cert-manager with helm install command:

helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
 --set installCRDs=true

This command will install the latest version of cert-manager, create a new cert-manager namespace and install the new CRD (CustomResourceDefinitions):

$ helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
 --set installCRDs=true
NAME: cert-manager
LAST DEPLOYED: Fri Mar 25 14:30:50 2022
NAMESPACE: cert-manager
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
cert-manager v1.7.2 has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://cert-manager.io/docs/configuration/

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://cert-manager.io/docs/usage/ingress/

Check cert-manager have been deployed correctly with kubectl get pods --namespace cert-manager command:

$ kubectl get pods --namespace cert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-75cf8df6b6-x2q6l              1/1     Running   0          2m34s
cert-manager-cainjector-857f5bd88c-gggxw   1/1     Running   0          2m34s
cert-manager-webhook-5cd99556d6-jq5vk      1/1     Running   0          2m34s

Now that the cert-manager is deployed, we need to configure a cluster-issuer to perform Let's Encrypt ACME challenges.

To avoid to be banned by Let's Encrypt robots, for testing purposes, the staging environment should be used before going to prod.

Create an Issuer in a file named issuer.yaml with the following content:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [YOUR_EMAIL]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [YOUR_EMAIL]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx

Don't forget to replace [YOUR_EMAIL] by a real value, it will be used for ACME challenges.

Apply the YAML manifest:

kubectl apply -f issuer.yaml

Now, any ingress resources will be able to be annotated with:

"cert-manager.io/cluster-issuer": "letsencrypt-prod"
# Or for tests
"cert-manager.io/cluster-issuer": "letsencrypt-staging"

Please refer to our tutorial on How to secure a Nginx Ingress with cert-manager on OVHcloud Managed Kubernetes for ingresses configuration.

Go further

Join our community of users on https://community.ovh.com/en/.


Cette documentation vous a-t-elle été utile ?

N’hésitez pas à nous proposer des suggestions d’amélioration afin de faire évoluer cette documentation.

Images, contenu, structure… N’hésitez pas à nous dire pourquoi afin de la faire évoluer ensemble !

Vos demandes d’assistance ne seront pas traitées par ce formulaire. Pour cela, utilisez le formulaire "Créer un ticket" .

Merci beaucoup pour votre aide ! Vos retours seront étudiés au plus vite par nos équipes..


Ces guides pourraient également vous intéresser...

OVHcloud Community

Accedez à votre espace communautaire. Posez des questions, recherchez des informations, publiez du contenu et interagissez avec d’autres membres d'OVHcloud Community.

Echanger sur OVHcloud Community

Conformément à la Directive 2006/112/CE modifiée, à partir du 01/01/2015, les prix TTC sont susceptibles de varier selon le pays de résidence du client
(par défaut les prix TTC affichés incluent la TVA française en vigueur).