14.4. 安装 cert-manager Operator

创建一个项目，将 cert-manager Operator 安装到其中：

$ oc new-project cert-manager-operator

为 Red Hat OpenShift 安装 cert-manager Operator：

$ cat << EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: openshift-cert-manager-operator-group
  namespace: cert-manager-operator
spec:
  targetNamespaces:
  - cert-manager-operator
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: openshift-cert-manager-operator
  namespace: cert-manager-operator
spec:
  channel: stable-v1
  installPlanApproval: Automatic
  name: openshift-cert-manager-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
EOF

验证 cert-manager Operator 是否正在运行：

$ oc -n cert-manager-operator get pods

NAME                                                        READY   STATUS    RESTARTS   AGE
cert-manager-operator-controller-manager-84b8799db5-gv8mx   2/2     Running   0          12s

使用之前创建的 AWS IAM 角色注解 cert-manager pod 使用的服务帐户：

$ oc -n cert-manager annotate serviceaccount cert-manager eks.amazonaws.com/role-arn=${ROLE_ARN}

运行以下命令重启现有的 cert-manager 控制器 pod：

$ oc -n cert-manager delete pods -l app.kubernetes.io/name=cert-manager

修补 Operator 配置以使用外部名称服务器以防止 DNS-01 质询问题：

$ oc patch certmanager.operator.openshift.io/cluster --type merge \
  -p '{"spec":{"controllerConfig":{"overrideArgs":["--dns01-recursive-nameservers-only","--dns01-recursive-nameservers=1.1.1.1:53"]}}}'

运行以下命令，创建一个 ClusterIssuer 资源以使用 Let 的 Encrypt ：

$ cat << EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ${EMAIL}
    # This key doesn't exist, cert-manager creates it
    privateKeySecretRef:
      name: prod-letsencrypt-issuer-account-key
    solvers:
    - dns01:
        route53:
         hostedZoneID: ${ZONE_ID}
         region: ${REGION}
         secretAccessKeySecretRef:
           name: ''
EOF

验证 ClusterIssuer 资源是否已就绪：

$ oc get clusterissuer.cert-manager.io/letsencrypt-production

NAME                     READY   AGE
letsencrypt-production   True    47s