Skip to content

Latest commit

 

History

History
145 lines (113 loc) · 4.31 KB

getting-started.md

File metadata and controls

145 lines (113 loc) · 4.31 KB
Raw

Developing cert-management locally with a kind cluster

There is a local setup without dependencies to external services.

Setting Up the KinD Cluster

make kind-up

You find the kubeconfig at $PWD/cert-management/dev/kind-kubeconfig.yaml

This starts a kind cluster with

The pebble server is mapped to localhost:5443 on your local machine. You can use it with the server endpoint https://localhost:5443/dir.

Running cert-controller-manager from command line

Running the cert-controller-manager locally from the command line using the kind cluster is nearly straight-forward.

There are two configuration issues to overcome.

  • The local setup uses a DNS server running on the kind cluster. For checking the DNS propagation, your local cert-controller-manager must use this server (by setting the precheckNameservers). The make target local-issuer-up creates a suitable issuer in the default namespace.
  • Second, as the ACME server uses a self-signed certificate, the local cert-controller-manager must accept it. For this purpose, some environment variables need to be set

The complete list of steps are

make local-issuer-up
source ./dev/source-lego-env.sh
export KUBECONFIG=$PWD/dev/kind-kubeconfig.yaml
make build-local
./cert-controller-manager --default-issuer local-issuer --omit-lease

Note: The local issuer cannot be used from within the kind cluster. If you want to deploy the cert-controller-manager on the kind cluster, remove the issuer with

make local-issuer-down

Test if your setup is working

Now you can check if the issuer has been reconciled successfully:

$ kubectl get issuer local-issuer
NAME           SERVER                       EMAIL                    STATUS   TYPE   AGE
local-issuer   https://localhost:5443/dir   [email protected]   Ready    acme   80s

You can add a sample certificate for any subdomains of certman.kind with

cat << EOF | kubectl apply -f -
apiVersion: cert.gardener.cloud/v1alpha1
kind: Certificate
metadata:
  name: example
  namespace: default
spec:
  commonName: example.certman.kind
  secretRef:
    name: example
EOF

Check the certificate status, after a few seconds you should see

$ kubectl get cert example
NAME      COMMON NAME            ISSUER         STATUS   AGE
example   example.certman.kind   local-issuer   Ready    40s

Deploying cert-controller-manager in the KinD cluster

Alternatively to running the cert-controller-manager on your local machine, it can be deployed in the KinD cluster with

make certman-up

This command will build a container image and deploy it in the default namespace. Additionally, a suitable issuer kind-issuer is created and configured to use the ACME server and DNS server running on the kind cluster.

kubectl get deploy
NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
cert-controller-manager   1/1     1            1           20m

Test if your setup is working

You can check if the issuer has been reconciled successfully:

$ kubectl get issuer kind-issuer
NAME          SERVER                                               EMAIL                    STATUS   TYPE   AGE
kind-issuer   https://acme.certman-support.svc.cluster.local/dir   [email protected]   Ready    acme   17m

You can add a sample certificate for any subdomains of certman.kind with

cat << EOF | kubectl apply -f -
apiVersion: cert.gardener.cloud/v1alpha1
kind: Certificate
metadata:
  name: example
  namespace: default
spec:
  commonName: example.certman.kind
  secretRef:
    name: example
EOF

Check the certificate status, after a few seconds you should see

$ kubectl get cert example
NAME      COMMON NAME            ISSUER        STATUS   AGE
example   example.certman.kind   kind-issuer   Ready    8m50s

Removing the cert-controller-manager deployment

To remove the deployment and issuer, use

make certman-down

Deletion of KinD Cluster

make kind-down

This deletes the Kind cluster.