Chapter 4. OpenShift Service Mesh and cert-manager

Procedure

1. Create the istio-system namespace by running the following command:

   $ oc create namespace istio-system

   Copy to Clipboard Toggle word wrap

2. Create the root issuer by creating an Issuer object in a YAML file.

   1. Create an Issuer object similar to the following example:

      Example issuer.yaml file

      apiVersion: cert-manager.io/v1
      kind: Issuer
      metadata:
        name: selfsigned
        namespace: istio-system
      spec:
        selfSigned: {}
      ---
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
          name: istio-ca
          namespace: istio-system
      spec:
        isCA: true
        duration: 87600h # 10 years
        secretName: istio-ca
        commonName: istio-ca
        privateKey:
          algorithm: ECDSA
          size: 256
        subject:
          organizations:
            - cluster.local
            - cert-manager
        issuerRef:
          name: selfsigned
          kind: Issuer
          group: cert-manager.io
      ---
      apiVersion: cert-manager.io/v1
      kind: Issuer
      metadata:
        name: istio-ca
        namespace: istio-system
      spec:
        ca:
          secretName: istio-ca
      ---

      Copy to Clipboard Toggle word wrap

   2. Create the objects by running the following command:

      $ oc apply -f issuer.yaml

      Copy to Clipboard Toggle word wrap

   3. Wait for the istio-ca certificate to contain the "Ready" status condition by running the following command:

      $ oc wait --for=condition=Ready certificates/istio-ca -n istio-system

      Copy to Clipboard Toggle word wrap

3. Copy the istio-ca certificate to the cert-manager namespace so it can be used by istio-csr:

   1. Copy the secret to a local file by running the following command:

      $ oc get -n istio-system secret istio-ca -o jsonpath='{.data.tls\.crt}' | base64 -d > ca.pem

      Copy to Clipboard Toggle word wrap

   2. Create a secret from the local certificate file in the cert-manager namespace by running the following command:

      $ oc create secret generic -n cert-manager istio-root-ca --from-file=ca.pem=ca.pem

      Copy to Clipboard Toggle word wrap