Red Hat Summit9.10.
중요
9.10.1.
9.10.1.1.
$ oc -n cert-manager-operator patch subscription openshift-cert-manager-operator --type='merge' -p '{"spec":{"config":{"env":[{"name":"UNSUPPORTED_ADDON_FEATURES","value":"IstioCSR=true"}]}}}'
$ oc rollout status deployment/cert-manager-operator-controller-manager -n cert-manager-operator
deployment "cert-manager-operator-controller-manager" successfully rolled out
9.10.1.2.
참고
apiVersion: cert-manager.io/v1 kind: Issuer 1 metadata: name: selfsigned namespace: <istio_project_name> 2 spec: selfSigned: {} --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: istio-ca namespace: <istio_project_name> spec: isCA: true duration: 87600h # 10 years secretName: istio-ca commonName: istio-ca privateKey: algorithm: ECDSA size: 256 subject: organizations: - cluster.local - cert-manager issuerRef: name: selfsigned kind: Issuer 3 group: cert-manager.io --- kind: Issuer metadata: name: istio-ca namespace: <istio_project_name> 4 spec: ca: secretName: istio-ca
$ oc get issuer istio-ca -n <istio_project_name>
NAME READY AGE istio-ca True 3m
9.10.1.3.
- 참고
$ oc new-project <istio_csr_project_name>
- 참고
apiVersion: operator.openshift.io/v1alpha1 kind: IstioCSR metadata: name: default namespace: <istio_csr_project_name> spec: IstioCSRConfig: certManager: issuerRef: name: istio-ca 1 kind: Issuer 2 group: cert-manager.io istiodTLSConfig: trustDomain: cluster.local istio: namespace: istio-system$ oc create -f IstioCSR.yaml
$ oc get deployment -n <istio_csr_project_name>
NAME READY UP-TO-DATE AVAILABLE AGE cert-manager-istio-csr 1/1 1 1 24s
$ oc get pod -n <istio_csr_project_name>
NAME READY STATUS RESTARTS AGE cert-manager-istio-csr-5c979f9b7c-bv57w 1/1 Running 0 45s
$ oc -n <istio_csr_project_name> logs <istio_csr_pod_name>
$ oc -n cert-manager-operator logs <cert_manager_operator_pod_name>
9.10.2.
$ oc -n <istio-csr_project_name> delete istiocsrs.operator.openshift.io default
- 중요
$ oc get clusterrolebindings,clusterroles -l "app=cert-manager-istio-csr,app.kubernetes.io/name=cert-manager-istio-csr"
$ oc get certificate,deployments,services,serviceaccounts -l "app=cert-manager-istio-csr,app.kubernetes.io/name=cert-manager-istio-csr" -n <istio_csr_project_name>
$ oc get roles,rolebindings -l "app=cert-manager-istio-csr,app.kubernetes.io/name=cert-manager-istio-csr" -n <istio_csr_project_name>
$ oc -n <istio_csr_project_name> delete <resource_type>/<resource_name>
9.10.3.
