Создать ClusterIssuer (Let's Encrypt) cert-manager

Создать ClusterIssuer Let's Encrypt prod с HTTP-01 solver

kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
EOF

#cert-manager #tls #letsencrypt #acme

more cert-manager all 16 commands →

Принудительное обновление сертификата cmctl renew <name> -n <ns> Диагностика статуса сертификата cmctl status certificate <name> -n <ns> Просмотр содержимого выпущенного секрета cmctl inspect secret <name> -n <ns> ClusterIssuer с DNS01 на Route53 kubectl apply -f - <<EOF apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-dns spec: acme: server: https://acme-v02.api.letsencrypt.org/directory privateKeySecretRef: name: letsencrypt-dns solvers: - dns01: route53: region: us-east-1 hostedZoneID: <id> EOF Зависшие ACME-челленджи kubectl get challenges -A -o wide && kubectl describe challenge -n <ns> <name>