kubernetes 에서 cert-manager로 무료 letsencrypt 인증서 발급 설정

쿠버네티스 클러스터에 ingress 컨트롤러가 설치되어 있는지 확인한다. 만약 없다면 설치하고 설치한 ingress 컨트롤러 타입을 기억한다.

1. cert-manager 설치하기

kubectl apply -f https://<a href="http://github.com/jetstack">github.com/jetstack</a>/cert-manager/releases/download/v1.8.0/cert-manager.yaml
...


# cert-manager 설치 확인
kubectl get pod -n cert-manager

2. cluster-issuer 생성하기

아래 yaml 파일에서 이메일 주소(spec.acme.email)와 ingress 타입(spec.acme.solvers.selector[0].http01.ingrss.class)을 확인하고 nginx 또는 traefik 등 자신이 사용할 ingress 타입을 기입한다.

# vi cluster-issuer.yaml

apiVersion: <a href="http://cert-manager.io/v1">cert-manager.io/v1</a>
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # The ACME server URL
    server: <a href="https://acme-staging-v02.api.letsencrypt.org/directory">https://acme-staging-v02.api.letsencrypt.org/directory</a>
    # Email address used for ACME registration
    email: abc@efg.com # 자신의 이메일 주소를 기재
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    # Enable the HTTP-01 challenge provider
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
      http01:
        ingress:
          class: nginx # 자신의 ingress 컨트롤러 타입 기재

---
apiVersion: <a href="http://cert-manager.io/v1">cert-manager.io/v1</a>
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: <a href="https://acme-v02.api.letsencrypt.org/directory">https://acme-v02.api.letsencrypt.org/directory</a>
    # Email address used for ACME registration
    email: abc@efg.com # 자신의 이메일 주소를 기재
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx # 자신의 ingress 컨트롤러 타입 기재

cluster issuer 생성 및 생성 여부 확인

kubectl create -f cluster-issuer.yaml

kubectl get clusterissuer

3. 인증서를 사용할 web 및 ingress 배포

# vi deploy-web.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: <a href="http://pghmv2sm.kr.private-ncr.ntruss.com/webweb:1.0">pghmv2sm.kr.private-ncr.ntruss.com/webweb:1.0</a> # 컨테이너 이미지는 알아서 변경
        ports:
        - containerPort: 80
      imagePullSecrets:
      - name: regcred
      nodeSelector:
        <a href="http://ncloud.com/nks-nodepool">ncloud.com/nks-nodepool</a>: kr2-node-01
---
apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: NodePort
  selector:
    app: web
  ports:
    - protocol: TCP
      port: 80

kubectl create -f deploy-web.yaml

# vi web-ingress.yaml

apiVersion: <a href="http://networking.k8s.io/v1">networking.k8s.io/v1</a>
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    <a href="http://ingress.kubernetes.io/ssl-redirect">ingress.kubernetes.io/ssl-redirect</a>: "true"
    <a href="http://kubernetes.io/ingress.class">kubernetes.io/ingress.class</a>: nginx # 자신의 ingress 컨트롤러 타입 기재
    <a href="http://kubernetes.io/tls-acme">kubernetes.io/tls-acme</a>: "true"
    <a href="http://cert-manager.io/cluster-issuer">cert-manager.io/cluster-issuer</a>: letsencrypt-prod
spec:
  tls:
  - hosts:
    - <a href="http://abc.com/">abc.com</a> # 인증서를 적용할 도메인으로 변경
    secretName: web-devbox-kr-cert # 인증서 key가 저장되는 secret
  rules:
  - host: <a href="http://abc.com/">abc.com</a> # 인증서를 적용할 도메인으로 변경
    http:
      paths:
      - path: /
        backend:
          service:
            name: web
            port: 
              number: 80

kubectl create -f web-ingress.yaml

4. 브라우저로 접속 확인

https://abc.com