You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Guide on integrating kube-bind with cert-manager for automated TLS certificate management.
5
+
weight: 10
6
+
---
7
+
8
+
# Cert-Manager Integration
9
+
10
+
1.**Install cert-manager** in your Kubernetes cluster, where kube-bind backend is running, if you haven't already. You can follow the official installation guide [here](https://cert-manager.io/docs/installation/kubernetes/).
11
+
12
+
13
+
2.**Create a `kube-bind` template for `Certificate` resources** to allow service consumers to request TLS certificates. Below is an example template:
14
+
15
+
```yaml
16
+
kubectl apply -f - <<EOF
17
+
apiVersion: kube-bind.io/v1alpha2
18
+
kind: APIServiceExportTemplate
19
+
metadata:
20
+
labels:
21
+
provider: cert-manager
22
+
name: certificate
23
+
spec:
24
+
permissionClaims:
25
+
- group: ""
26
+
resource: secrets
27
+
selector:
28
+
references:
29
+
- resource: certificates
30
+
group: cert-manager.io
31
+
jsonPath:
32
+
name: 'spec.secretName'
33
+
resources:
34
+
- group: cert-manager.io
35
+
resource: certificates
36
+
versions:
37
+
- v1
38
+
scope: Namespaced
39
+
EOF
40
+
```
41
+
42
+
3.**Login into the kube-bind CLI** and request a binding to the `certificate` template created above. This will allow you to create `Certificate` resources in your consumer cluster.
43
+
44
+
```bash
45
+
kubectl bind login https://kube-bind.example.com
46
+
# you will get redirected to UI to authenticate and pick the template
47
+
kubectl bind
48
+
```
49
+
50
+
4.**Wait for the binding to be established.** Once the binding is active, you can create `Certificate` resources in your consumer cluster, and you will get `Certificate` objects synced from the provider cluster.
🔒 Created secret kube-bind/kubeconfig-p6mfh for host https://api.kcp-prod.kcp.internal.canary.k8s.ondemand.com:443, namespace kube-bind-dkxkx
64
+
🚀 Deploying konnector v0.6.0 to namespace kube-bind with custom image "ghcr.io/kube-bind/konnector:v0.6.0-rc1".
65
+
Waiting for the ...................
66
+
✅ Created APIServiceBinding certificate for 1 resources
67
+
Created 1 APIServiceBinding(s):
68
+
- certificate
69
+
Resources bound successfully!
70
+
```
71
+
72
+
5.**Create a `Certificate` resource** in your consumer cluster. The cert-manager in the provider cluster will handle the issuance and management of the TLS certificate.
73
+
74
+
!!! note
75
+
my-selfsigned-issuer must be present in the provider cluster for this example to work.
76
+
77
+
```yaml
78
+
kubectl apply -f - <<EOF
79
+
apiVersion: cert-manager.io/v1
80
+
kind: Certificate
81
+
metadata:
82
+
name: my-tls-cert
83
+
namespace: default
84
+
spec:
85
+
commonName: my-ca
86
+
isCA: true
87
+
issuerRef:
88
+
kind: ClusterIssuer
89
+
name: my-selfsigned-issuer
90
+
secretName: my-tls-cert
91
+
EOF
92
+
```
93
+
94
+
6. Observe that the `Certificate` resource is created in the consumer cluster and the corresponding TLS secret is generated.
logger.Error(err, "failed to list objects for reference claim. Invalidating all claim.", "group", ref.Group, "resource", ref.Resource, "version", version)
want: true, // Should match because certificate's .spec.secretName equals secret name and no namespace JSONPath means namespace matching is handled by caller
844
+
},
845
+
{
846
+
name: "cert-manager secret reference - should not match when certificate references different secret",
0 commit comments