Aller au contenu

CaaS-CNP : Certificate management#

Official documentation: CaaS-CNP Documentation

The generation of internal certificates via cert-manager can be done with:

  • An issuer
  • Some annotations inside the ingress resource.

Issuer#

First of all, we need to create an Issuer. This issuer will use the HTTP01 challenge to deliver certificates.

In order to register properly, we need to specify 2 emails.

  • The first one MUST be the email of a PKI Holder
  • The second one will be the email used for notifications.

Both e-mails must be specified in the email field, separated by a comma ,

The following working example use the emails of Mickael and Yann. Please update before apply 

---
# Source: https://documentation.factory.orange-business.com/caas-cnp/how_to_start/cert_manager/#acme-issuer

# ACME issuer using LORAND Production ACME server
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: acme-issuer

spec:
  acme:
    # E-mails for notifications
    # 2 mandatory e-mails: pki-email being a PKI holder (e.g. appl. manager), notif-email for notifications
    email: mickael.sourget@orange.com,yann.ponzoni.ext@orange.com
    server: https://pki-lorand.security.intraorange/lorand-acme/g2-server-acme
    privateKeySecretRef:
      # Secret resource that will be used to store the account's private key.
      name: acme-issuer-account-key
    # Declare HTTP01 default challenge solver (selector: all resources)
    solvers:
      - selector: {}
        http01:
          ingress:
            class: nginx
            serviceType: ClusterIP
...

Ingress Annotations#

Once the issuer created and ready, it can be used to deliver all the certificates handled by the ACME server (*.intraorange) in the same namespace.

To use it with ingress object, you just have to add the following annotations:

acme.cert-manager.io/http01-ingress-class: nginx    # Ingress class to use
cert-manager.io/issuer: acme-issuer                 # Issuer previously declared

acme.cert-manager.io/http01-ingress-class: traefik  # Ingress class to use
cert-manager.io/issuer: acme-issuer                 # Issuer previously declared
  • The acme.cert-manager.io/http01-ingress-class annotation define the ingress class to address the HTTP01 challenge
  • The cert-manager.io/issuer annotation refers to the issuer previously created in the same namespace.

Note that this ingress class annotation is only for the HTTP01 challenge: You also MUST declare the ingress class for the ingress with the ingressClassName spec.

Debug#

You can take a look at: