aws-privateca-issuer使ってみた

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.14.1/deploy/static/provider/cloud/deploy.yam

apiVersion: v1
kind: Pod
metadata:
  name: test-web
  labels:
    app: test-web
spec:
  containers:
  - name: nginx
    image: nginx:1.14.2
    ports:
    - containerPort: 80

apiVersion: v1
kind: Service
metadata:
  name: test-service
spec:
  type: NodePort
  selector:
    app: test-web
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.local
  rules:
  - host: example.local
    http:
      paths:
      - path: /top_page
        pathType: Prefix
        backend:
          service:
            name: test-service
            port:
              number: 80

$ kubectl get service -n ingress-nginx

<IPアドレス> example.local

helm install \
  cert-manager oci://quay.io/jetstack/charts/cert-manager \
  --version v1.19.2 \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "awspcaissuer",
      "Action": [
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificate",
        "acm-pca:IssueCertificate"
      ],
      "Effect": "Allow",
      "Resource": "<作成したprivate caのARN>"
    }
  ]
}

helm repo add awspca https://cert-manager.github.io/aws-privateca-issuer
helm install awspca/aws-privateca-issuer --generate-name

apiVersion: v1
kind: Secret
metadata:
  name: pca-secret
  namespace: default
data:
  AWS_ACCESS_KEY_ID: <base64_encoded_access_key_id> 
  AWS_SECRET_ACCESS_KEY: <base64_encoded_secret_access_key>

$ echo -n "<encodeしたい文字列>" |base64

apiVersion: awspca.cert-manager.io/v1beta1
kind: AWSPCAIssuer
metadata:
  name: pca-issuer-rsa
  namespace: default
spec:
  arn: "<aws private caのARN>"
  region: <region>
  secretRef:
    namespace: default
    name: pca-secret

$ kubectl describe awspcaissuer

kind: Certificate
apiVersion: cert-manager.io/v1
metadata:
  name: test-cert
  namespace: default
spec:
  #なんでもOK
  commonName: Nara
  #httpsアクセス時のurlのホスト名と照合するため、クライアントのhostsファイルに記載したホスト名
  dnsNames:
    - example.local
  #有効期限
  duration: 72h0m0s
  issuerRef:
    group: awspca.cert-manager.io
    kind: AWSPCAIssuer
    name: pca-issuer-rsa
  #有効期限が切れるどれくらい前に証明書を再発行するか
  renewBefore: 24h0m0s
  #証明書のoutput先のsecret名
  secretName: tls-test-secret
  usages:
    - server auth
   #AWS Private CA側で定義したアルゴリズムを指定
  privateKey:
    algorithm: "RSA"
    size: 2048

$ kubectl get certificate

$ kubectl get secret tls-test-secret

$ kubectl logs <Pod名>

$ kubectl describe certificaterequest

$ kubectl describe certificate

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.local
    secretName: tls-test-secret
  rules:
  - host: example.local
    http:
      paths:
      - path: /top_page
        pathType: Prefix
        backend:
          service:
            name: test-service
            port:
              number: 80