14.4. cert-manager Operator 설치

cert-manager Operator를 설치할 프로젝트를 생성합니다.

$ oc new-project cert-manager-operator

cert-manager Operator for Red Hat OpenShift를 설치합니다.

$ cat << EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: openshift-cert-manager-operator-group
  namespace: cert-manager-operator
spec:
  targetNamespaces:
  - cert-manager-operator
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: openshift-cert-manager-operator
  namespace: cert-manager-operator
spec:
  channel: stable-v1
  installPlanApproval: Automatic
  name: openshift-cert-manager-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
EOF

cert-manager Operator가 실행 중인지 확인합니다.

$ oc -n cert-manager-operator get pods

NAME                                                        READY   STATUS    RESTARTS   AGE
cert-manager-operator-controller-manager-84b8799db5-gv8mx   2/2     Running   0          12s

이전에 생성한 AWS IAM 역할을 사용하여 cert-manager Pod에서 사용하는 서비스 계정에 주석을 답니다.

$ oc -n cert-manager annotate serviceaccount cert-manager eks.amazonaws.com/role-arn=${ROLE_ARN}

다음 명령을 실행하여 기존 cert-manager 컨트롤러 Pod를 다시 시작합니다.

$ oc -n cert-manager delete pods -l app.kubernetes.io/name=cert-manager

Operator의 구성을 패치하여 외부 이름 서버를 사용하여 DNS-01 챌린지 확인 문제를 방지합니다.

$ oc patch certmanager.operator.openshift.io/cluster --type merge \
  -p '{"spec":{"controllerConfig":{"overrideArgs":["--dns01-recursive-nameservers-only","--dns01-recursive-nameservers=1.1.1.1:53"]}}}'

다음 명령을 실행하여 Let's Encrypt를 사용하도록 ClusterIssuer 리소스를 만듭니다.

$ cat << EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ${EMAIL}
    # This key doesn't exist, cert-manager creates it
    privateKeySecretRef:
      name: prod-letsencrypt-issuer-account-key
    solvers:
    - dns01:
        route53:
         hostedZoneID: ${ZONE_ID}
         region: ${REGION}
         secretAccessKeySecretRef:
           name: ''
EOF

ClusterIssuer 리소스가 준비되었는지 확인합니다.

$ oc get clusterissuer.cert-manager.io/letsencrypt-production

NAME                     READY   AGE
letsencrypt-production   True    47s