دعونا تشفير شهادات SSL مع مدير الشهادة في Kubernetes

القليل من البرنامج التعليمي

مدير تصديق

kubectl create ns cert-manager
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v0.13.0/cert-manager.yaml

• Issuer يمكن استخدامها ضمن نفس مساحة الاسم ،
• ClusterIssuer هو كائن كتلة عمومي.

تدرب مع مدير الشهادة

رقم 1. شهادة موقعة ذاتيا

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: selfsigned
spec:
  selfSigned: {}

---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: selfsigned-crt
spec:
  secretName: tls-secret
  issuerRef:
    kind: Issuer
    name: selfsigned
  commonName: "yet-another.website"
  dnsNames:
  - "yet-another.website"
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: app
spec:
  tls:
  - hosts:
    - "yet-another.website"
    secretName: tls-secret
  rules:
  - host: "yet-another.website"
    http:
      paths:
      - path: /
        backend:
          serviceName: app
          servicePort: 8080

kubectl -n app describe  certificate selfsigned-crt
...
  Normal  GeneratedKey  5s    cert-manager  Generated a new private key
  Normal  Requested     5s    cert-manager  Created new CertificateRequest resource "selfsigned-crt-4198958557"
  Normal  Issued        5s    cert-manager  Certificate issued successfully

• مفتاح خاص tls.key،
• شهادة الجذر ca.crt،
• شهادتنا الموقعة ذاتيا tls.crt.

kubectl -n app get secret tls-secret -ojson | jq -r '.data."tls.crt"' | base64 -d | openssl x509 -dates -noout -issuer
notBefore=Feb 10 21:01:59 2020 GMT
notAfter=May 10 21:01:59 2020 GMT
issuer=O = cert-manager, CN = yet-another.website

رقم 2. دعونا تشفير الشهادة مع التحقق من صحة HTTP

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory 
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
       ingress:
         class: nginx
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef:
    kind: Issuer
    name: letsencrypt
  commonName: yet-another.website
  dnsNames:
  - yet-another.website

1. خلق الخلق Certificateمورد جديد CertificateRequest:
   
   

   kubectl -n app describe certificate le-crt
   ...
   Created new CertificateRequest resource "le-crt-1127528680"

2. في وصفه - علامة على الخلق Order:
   
   

   kubectl -n app describe certificaterequests le-crt-1127528680
   …
   Created Order resource app/le-crt-1127528680-1805948596

3. فإنه Orderيصف مع ما المعلمات يمر الاختبار وما وضعه الحالي هو. يتم تنفيذ هذا التحقق من قبل المورد Challenge:
   
   

   kubectl -n app describe order le-crt-1127528680-1805948596
   …
   Created Challenge resource "le-crt-1127528680-1805948596-1231544594" for domain "yet-another.website"

4. أخيرًا ، تحتوي تفاصيل هذا المورد على معلومات حول حالة الفحص نفسه:
   
   

   kubectl -n app describe challenges le-crt-1127528680-1805948596-1231544594
   ...
     Reason:      Successfully authorized domain                                                                                                                                                                      
   ...
     Normal  Started         2m45s  cert-manager  Challenge scheduled for processing
     Normal  Presented       2m45s  cert-manager  Presented challenge using http-01 challenge mechanism
     Normal  DomainVerified  2m22s  cert-manager  Domain "yet-another.website" verified with "http-01" validation

  Normal  PrivateKeyLost  44s                   cert-manager  Lost private key for CertificateRequest "le-crt-613810377", deleting old resource

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
       ingress:
         class: nginx

kubectl -n app get secret tls-secret -ojson | jq -r '.data."tls.crt"' | base64 -d | openssl x509 -dates -noout -issuer
notBefore=Feb 10 21:11:48 2020 GMT
notAfter=May 10 21:11:48 2020 GMT
issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

رقم 3. Wildcard LE مع التحقق من صحة DNS

1. الملف الشخصي → API Tokens → إنشاء رمز.
2. قم بتعيين الأذونات على النحو التالي:
   
   • أذونات:
     
     • المنطقة - DNS - تحرير
     • المنطقة - المنطقة - اقرأ
   • موارد المنطقة:
     
     • تضمين - جميع المناطق
3. انسخ الرمز المميز الذي تم تلقيه بعد الحفظ (على سبيل المثال :) y_JNkgQwkroIsflbbYqYmBooyspN6BskXZpsiH4M.

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token
type: Opaque
stringData:
  api-token: y_JNkgQwkroIsflbbYqYmBooyspN6BskXZpsiH4M
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory 
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - dns01:
        cloudflare:
          email: my-cloudflare-acc@example.com
          apiTokenSecretRef:
            name: cloudflare-api-token
            key: api-token

---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: le-crt
spec:
  secretName: tls-secret
  issuerRef:
    kind: Issuer
    name: letsencrypt
  commonName: yet-another.website
  dnsNames:
  - "yet-another.website"
  - "*.yet-another.website"

kubectl -n app describe challenges.acme.cert-manager.io le-crt-613810377-1285319347-3806582233
...
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for dns-01 challenge propagation: DNS record for "yet-another.website" not yet propagated
  State:       pending
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Started    54s   cert-manager  Challenge scheduled for processing
  Normal  Presented  53s   cert-manager  Presented challenge using dns-01 challenge mechanism

Domain "yet-another.website" verified with "dns-01" validation

kubectl -n app get secret tls-secret -ojson | jq -r '.data."tls.crt"' | base64 -d | openssl x509 -dates -noout -text |grep DNS:
          DNS:*.yet-another.website, DNS:yet-another.website

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - selector:
        dnsNames:
        - "*.yet-another.website"
      dns01:
        cloudflare:
          email: my-cloudflare-acc@example.com
          apiTokenSecretRef:
            name: cloudflare-api-token
            key: api-token            
    - selector:
        dnsNames:
        - "yet-another.website"
      http01:
        ingress:
          class: nginx

kubectl -n app describe orders le-crt-613810377-1285319347
…
  Normal  Created  3m29s  cert-manager  Created Challenge resource "le-crt-613810377-1285319347-3996324737" for domain "yet-another.website"                 
  Normal  Created  3m29s  cert-manager  Created Challenge resource "le-crt-613810377-1285319347-1443470517" for domain "yet-another.website"

عدد 4. استخدام شروح الدخول الخاصة

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  tls:
  - hosts:
    - "yet-another.website"
    secretName: tls-secret
  rules:
  - host: "yet-another.website"
    http:
      paths:
      - path: /
        backend:
          serviceName: app
          servicePort: 8080

بدلا من الاستنتاج

ملاحظة

• " مقدمة لسياسات شبكة Kubernetes لمحترفي الأمن " ؛
• « نصائح وحيل Kubernetes: صفحة خطأ مخصصة في Ingress NGINX » ؛
• « Ingress Kubernetes».