Stone 0a0a012ec5 Local certificate appendix

Adding "Locally create certificates" appendix

Signed-off-by: Stone <ronald.stone@windriver.com>
Change-Id: I4f5446a7015884a3d0eee6182dceaef71c64e97f

2021-03-19 20:33:28 +00:00

3.2 KiB

Raw Blame History

Create Certificates Locally using cert-manager on the Controller

You can use cert-manager to locally create certificates suitable for use in a lab environment.

Create a Root Certificate and Key.

Create a self-signing issuer.

$ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: my-selfsigning-issuer
spec:
  selfSigned: {}
" | kubectl apply -f -

Create a Root certificate and key.

$ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-rootca-certificate
spec:
  secretName: my-rootca-certificate
  commonName: "my-rootca"
  isCA: true
  issuerRef:
    name: my-selfsigning-issuer
    kind: Issuer
" | kubectl apply -f -

Create a Root Issuer.

$ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: my-rootca-issuer
spec:
  ca:
    secretName: my-rootca-certificate
" | kubectl apply -f -

Create files for the Root certificate and key.

$ kubectl get secret my-rootca-certificate -o yaml | egrep "^  tls.crt:" | awk '{print $2}' | base64 --decode > my-rootca-cert.pem
$ kubectl get secret my-rootca-certificate -o yaml | egrep "^  tls.key:" | awk '{print $2}' | base64 --decode > my-rootca-key.pem

Create and sign a Server certificate and key

Create the Server certificate and key.

$ echo "
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: my-server-certificate
spec:
  secretName: my-server-certificate
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  organization:
  - WindRiver
  commonName: 1.1.1.1
  dnsNames:
  - myserver.wrs.com
  ipAddresses:
  - 1.1.1.1
  issuerRef:
    name: my-rootca-issuer
    kind: Issuer
" | kubectl apply -f -

Create the files for Server certificate and key.

$ kubectl get secret my-server-certificate -o yaml | egrep "^  tls.crt:" | awk '{print $2}' | base64 --decode > my-server-cert.pem
$ kubectl get secret my-server-certificate -o yaml | egrep "^  tls.key:" | awk '{print $2}' | base64 --decode > my-server-key.pem

Combine the server certificate and key in a single file.

$ cat my-server-cert.pem my-server-key.pem > my-server.pem

3.2 KiB Raw Blame History

Create Certificates Locally using cert-manager on the Controller

3.2 KiB

Raw Blame History