cert-manager

https://cloud.tencent.com/document/product/457/49368#Certificate
https://cert-manager.io/docs/
https://cert-manager.io/docs/releases/
# helm
```
helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.13.1 \
  --set installCRDs=true \
  --set prometheus.enabled=false \  
  --set webhook.timeoutSeconds=4 
```

```
#crd
kubectl get crd | grep cert-manager
certificaterequests.cert-manager.io                   2023-10-26T20:24:49Z
certificates.cert-manager.io                          2023-10-26T20:24:49Z
challenges.acme.cert-manager.io                       2023-10-26T20:24:49Z
clusterissuers.cert-manager.io                        2023-10-26T20:24:49Z
issuers.cert-manager.io                               2023-10-26T20:24:49Z
orders.acme.cert-manager.io                           2023-10-26T20:24:49Z
```

```yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: test-davidops-me
  namespace: default
spec:
  dnsNames:
  - test.davidops.me # 要签发证书的域名
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-dns01 # 引用 ClusterIssuer，指示采用 dns01 方式进行校验
  secretName: test-davidops-me-tls # 最终签发出来的证书会保存在这个 Secret 里面
---
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: cert-manager
type: Opaque
stringData:
  api-token: cf token
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dns01
spec:
  acme:
    privateKeySecretRef:
      name: letsencrypt-dns01
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - dns01:
        cloudflare:
          email: david9665241926@gmail.com  # 替换成你的 cloudflare 邮箱账号，API Token 方式认证非必需，API Keys 认证是必需
          apiTokenSecretRef:
            key: api-token
            name: cloudflare-api-token-secret # 引用保存 cloudflare 认证信息的 Secret
```
```
# READY 为 True 就是已经创建好证书了
[root@master cert-manager]# kubectl get  certificates
NAME               READY   SECRET                 AGE
test-davidops-me   True    test-davidops-me-tls   2m33s
#
[root@master cert-manager]# kubectl get secret
NAME                   TYPE                DATA   AGE
test-davidops-me-tls   kubernetes.io/tls   2      92s
```

```yaml
#ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - "test.davidops.me"
      secretName: test-davidops-me-tls
  rules:
    - host: test.davidops.me
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: front-end-svc
                port:
                  number: 80
```