Installing cert-manager on Kubernetes | Eclipse Che Documentation

Procedure

To install cert-manager:

$ kubectl create namespace cert-manager
namespace/cert-manager created

$ kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true

$ kubectl apply \
  -f https://github.com/jetstack/cert-manager/releases/download/v0.8.1/cert-manager.yaml --validate=false

Create the che namespace if it does not exist already:

$ kubectl create namespace che
namespace/che created

Create the certificate issuer. Replace your email address in the email field:

$ cat <<EOF | kubectl apply -f -
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: che-certificate-issuer
spec:
  acme:
    dns01:
      providers:
      - clouddns:
          project: eclipse-che-1
          serviceAccountSecretRef:
            key: key.json
            name: clouddns-dns01-solver-svc-acct
        name: clouddns
    email: joe@example.com
    privateKeySecretRef:
      name: letsencrypt
    server: https://acme-v02.api.letsencrypt.org/directory
EOF

Create the certificate. Edit the domain name:

$ cat <<EOF | kubectl apply -f -
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
 name: che-tls
 namespace: che
spec:
 secretName: che-tls
 issuerRef:
   name: che-certificate-issuer
   kind: ClusterIssuer
 dnsNames:
   - '*.gcp.my-ide.cloud'
 acme:
   config:
     - dns01:
         provider: clouddns
       domains:
         - '*.gcp.my-ide.cloud'
EOF

Check that the issuerRef name is the same as the ClusterIssuer. A new DNS challenge is added to the DNS zone for Let’s Encrypt.

The cert-manager logs should contain information about the DNS challenge. To get the logs (here, cert-manager-8d478bb45-2924h is the name of the cert-manager pod):

$ kubectl logs -f -n cert-manager cert-manager-8d478bb45-2924h

I0729 13:50:39.414729 1 dns.go:112] Checking DNS propagation for "gcp.my-ide.cloud" using name servers: [10.112.0.10:53]

E0729 13:50:39.422521 1 sync.go:180] cert-manager/controller/challenges "msg"="propagation check failed" "error"="DNS record for \"gcp.my-ide.cloud\" not yet propagated" "dnsName"="gcp.my-ide.cloud" "resource_kind"="Challenge" "resource_name"="che-tls-3529929423-0" "resource_namespace"="che" "type"="dns-01"

I0729 13:50:39.422598 1 controller.go:219] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="che/che-tls-3529929423-0"

I0729 13:50:49.406767 1 controller.go:213] cert-manager/controller/challenges "level"=0 "msg"="syncing resource" "key"="che/che-tls-3529929423-0"

I0729 13:50:49.409802 1 dns.go:112] Checking DNS propagation for "gcp.my-ide.cloud" using name servers: [10.112.0.10:53]

E0729 13:50:49.420131 1 sync.go:180] cert-manager/controller/challenges "msg"="propagation check failed" "error"="DNS record for \"gcp.my-ide.cloud\" not yet propagated" "dnsName"="gcp.my-ide.cloud" "resource_kind"="Challenge" "resource_name"="che-tls-3529929423-0" "resource_namespace"="che" "type"="dns-01"

I0729 13:50:49.420198 1 controller.go:219] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="che/che-tls-3529929423-0"

Ensure that the certificate is ready:

$ kubectl describe certificate/che-tls -n che

Status:
 Conditions:
 Last Transition Time: 2019-07-29T13:50:35Z
 Message: Certificate issuance in progress. Temporary certificate issued.
 Reason: TemporaryCertificate
 Status: False
 Type: Ready
Events:
 Type Reason Age From Message
 ---- ------ ---- ---- -------
 Normal Generated 47s cert-manager Generated new private key
 Normal GenerateSelfSigned 47s cert-manager Generated temporary self signed certificate
 Normal OrderCreated 47s cert-manager Created Order resource "che-tls-3529929423"

Wait for the Status to become OK, and ensure that the log contains the following entry:

I0729 13:56:26.140886 1 conditions.go:143] Found status change for Certificate "che-tls" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2019-07-29 13:56:26.140866531 +0000 UTC m=+4557.134131468

Ensure that the status is up-to-date:

$ kubectl describe certificate/che-tls -n che

Status:
 Conditions:
 Last Transition Time: 2019-07-29T13:56:26Z
 Message: Certificate is up to date and has not expired
 Reason: Ready
 Status: True
 Type: Ready
 Not After: 2019-10-27T12:56:24Z