Skip to content

Commit 131cf90

Browse files
AiRanthemfurykerry
AiRanthem
authored and
furykerry
committed
docs(sandbox-manager): add a best practice for managing and deploying sandbox-manager self-signed certificates using cert-manager
Signed-off-by: AiRanthem <zhongtianyun.zty@alibaba-inc.com>
1 parent cdfa5e7 commit 131cf90

File tree

11 files changed

+207
-13
lines changed

11 files changed

+207
-13
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ go.work.sum
2626
*.swp
2727
*.swo
2828
*~
29+
30+
*.crt
2931
*.pem
3032
vendor/*
3133
dev/

‎config/sandbox-manager/deployment.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,21 @@ metadata:
44
name: sandbox-manager
55
namespace: sandbox-system
66
labels:
7-
control-plane: sandbox-manager
7+
component: sandbox-manager
88
app.kubernetes.io/name: sandbox-manager
99
app.kubernetes.io/managed-by: kustomize
1010
spec:
1111
replicas: 1
1212
selector:
1313
matchLabels:
14-
control-plane: sandbox-manager
14+
component: sandbox-manager
1515
app.kubernetes.io/name: sandbox-manager
1616
template:
1717
metadata:
1818
annotations:
1919
kubectl.kubernetes.io/default-container: controller
2020
labels:
21-
control-plane: sandbox-manager
21+
component: sandbox-manager
2222
app.kubernetes.io/name: sandbox-manager
2323
spec:
2424
serviceAccountName: sandbox-manager
@@ -62,7 +62,7 @@ spec:
6262
fieldRef:
6363
fieldPath: metadata.namespace
6464
- name: PEER_SELECTOR
65-
value: control-plane=sandbox-manager
65+
value: component=sandbox-manager
6666
- name: KUBE_CLIENT_QPS
6767
value: "10000"
6868
- name: KUBE_CLIENT_BURST

‎config/sandbox-manager/ingress.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@ metadata:
44
name: sandbox-manager
55
namespace: sandbox-system
66
labels:
7-
control-plane: sandbox-manager
7+
component: sandbox-manager
88
app.kubernetes.io/name: sandbox-manager
99
app.kubernetes.io/managed-by: kustomize
1010
spec:
1111
ingressClassName: nginx
1212
tls:
1313
- hosts:
1414
- "*.replace.with.your.domain"
15+
- "replace.with.your.domain"
1516
secretName: sandbox-manager-tls
1617
rules:
1718
- host: "*.replace.with.your.domain"
@@ -24,3 +25,13 @@ spec:
2425
name: sandbox-manager
2526
port:
2627
number: 7788
28+
- host: "replace.with.your.domain"
29+
http:
30+
paths:
31+
- path: /
32+
pathType: Prefix
33+
backend:
34+
service:
35+
name: sandbox-manager
36+
port:
37+
number: 7788

‎config/sandbox-manager/rbac.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kind: ClusterRole
33
metadata:
44
name: sandbox-manager
55
labels:
6-
control-plane: sandbox-manager
6+
component: sandbox-manager
77
app.kubernetes.io/name: sandbox-manager
88
rules:
99
- apiGroups: [""]
@@ -34,7 +34,7 @@ metadata:
3434
name: sandbox-manager-secrets
3535
namespace: sandbox-system
3636
labels:
37-
control-plane: sandbox-manager
37+
component: sandbox-manager
3838
app.kubernetes.io/name: sandbox-manager
3939
rules:
4040
- apiGroups: [ "" ]
@@ -48,7 +48,7 @@ kind: ClusterRoleBinding
4848
metadata:
4949
name: sandbox-manager
5050
labels:
51-
control-plane: sandbox-manager
51+
component: sandbox-manager
5252
app.kubernetes.io/name: sandbox-manager
5353
roleRef:
5454
apiGroup: rbac.authorization.k8s.io
@@ -65,7 +65,7 @@ metadata:
6565
name: sandbox-manager-secrets
6666
namespace: sandbox-system
6767
labels:
68-
control-plane: sandbox-manager
68+
component: sandbox-manager
6969
app.kubernetes.io/name: sandbox-manager
7070
roleRef:
7171
apiGroup: rbac.authorization.k8s.io

‎config/sandbox-manager/secret.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ metadata:
44
name: e2b-key-store
55
namespace: sandbox-system
66
labels:
7-
control-plane: sandbox-manager
7+
component: sandbox-manager
88
app.kubernetes.io/name: sandbox-manager
99
type: Opaque
1010
data: { }

‎config/sandbox-manager/service.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ metadata:
44
name: sandbox-manager
55
namespace: sandbox-system
66
labels:
7-
control-plane: sandbox-manager
7+
component: sandbox-manager
88
app.kubernetes.io/name: sandbox-manager
99
app.kubernetes.io/managed-by: kustomize
1010
spec:
@@ -15,5 +15,5 @@ spec:
1515
protocol: TCP
1616
name: http-envoy
1717
selector:
18-
control-plane: sandbox-manager
18+
component: sandbox-manager
1919
app.kubernetes.io/name: sandbox-manager

‎config/sandbox-manager/serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ metadata:
44
name: sandbox-manager
55
namespace: sandbox-system
66
labels:
7-
control-plane: sandbox-manager
7+
component: sandbox-manager
88
app.kubernetes.io/name: sandbox-manager
99
app.kubernetes.io/managed-by: kustomize
1010
automountServiceAccountToken: true

‎docs/best-practices/cert-manager-zh_CN.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# 最佳实践：使用 cert-manager 管理 sandbox-manager 自签证书
2+
3+
本文提供了一种使用 cert-manager 来管理和部署 sandbox-manager 自签证书的最佳实践。
4+
5+
## 前提条件
6+
7+
1. 集群中已安装 sandbox-manager
8+
2. 确保具备 kubectl 命令行工具并具有相应权限
9+
10+
## 步骤一：安装 cert-manager
11+
12+
如果您还没有安装 cert-manager，请参考 [官方文档](https://cert-manager.io/docs/installation/) 进行安装。
13+
14+
## 步骤二：通过 cert-manager 自动管理证书
15+
16+
1. 将 [cert-manager.yaml](cert-manager.yaml) 中的 "*.your.domain.com" 与 "your.domain.com" 替换为你的域名。
17+
2. 将配置添加到 Kubernetes 集群中：`kubectl apply -f cert-manager.yaml`
18+
19+
## 步骤三：验证证书状态
20+
21+
检查证书是否正确创建和颁发：
22+
23+
```bash
24+
kubectl get certificates -n sandbox-system
25+
kubectl describe certificate sandbox-manager-ingress-cert -n sandbox-system
26+
kubectl describe secret sandbox-manager-tls -n sandbox-system
27+
```
28+
29+
检查 Ingress 状态：
30+
31+
```bash
32+
kubectl get ingress sandbox-manager -n sandbox-system
33+
kubectl describe ingress sandbox-manager -n sandbox-system
34+
```
35+
36+
## 步骤四：配置客户端信任
37+
38+
由于您使用的是自签名证书，客户端需要信任根 CA 证书。
39+
40+
### 4.1 获取 CA 证书
41+
42+
```bash
43+
kubectl get secret sandbox-ca-key-pair -n sandbox-system -o jsonpath='{.data.tls\.crt}' | base64 -d > ca.crt
44+
```
45+
46+
### 4.2 配置客户端
47+
48+
客户端需要设置环境变量 `SSL_CERT_FILE` 为获取的 CA 证书路径：
49+
50+
```bash
51+
export SSL_CERT_FILE=/path/to/ca.crt
52+
```
53+
54+
或者将 CA 证书添加到系统的信任存储中。

‎docs/best-practices/cert-manager.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Best Practice: Managing sandbox-manager Self-Signed Certificates with cert-manager
2+
3+
This document provides a best practice for managing and deploying sandbox-manager self-signed certificates using
4+
cert-manager.
5+
6+
## Prerequisites
7+
8+
1. sandbox-manager is installed in the cluster
9+
2. Ensure kubectl command-line tool is available with appropriate permissions
10+
11+
## Step 1: Install cert-manager
12+
13+
If you haven't installed cert-manager yet, please refer to
14+
the [official documentation](https://cert-manager.io/docs/installation/) for installation.
15+
16+
## Step 2: Automatic Certificate Management with cert-manager
17+
18+
1. Replace "*.your.domain.com" and "your.domain.com" in [cert-manager.yaml](cert-manager.yaml) with your domain.
19+
2. Add the configuration to the Kubernetes cluster: `kubectl apply -f cert-manager.yaml`
20+
21+
## Step 3: Verify Certificate Status
22+
23+
Check if certificates are created and issued correctly:
24+
25+
```bash
26+
kubectl get certificates -n sandbox-system
27+
kubectl describe certificate sandbox-manager-ingress-cert -n sandbox-system
28+
kubectl describe secret sandbox-manager-tls -n sandbox-system
29+
```
30+
31+
Check Ingress status:
32+
33+
```bash
34+
kubectl get ingress sandbox-manager -n sandbox-system
35+
kubectl describe ingress sandbox-manager -n sandbox-system
36+
```
37+
38+
## Step 4: Configure Client Trust
39+
40+
Since you are using self-signed certificates, clients need to trust the root CA certificate.
41+
42+
### 4.1 Obtain CA Certificate
43+
44+
```bash
45+
kubectl get secret sandbox-ca-key-pair -n sandbox-system -o jsonpath='{.data.tls\.crt}' | base64 -d > ca.crt
46+
```
47+
48+
### 4.2 Configure Client
49+
50+
Clients need to set the environment variable `SSL_CERT_FILE` to the path of the obtained CA certificate:
51+
52+
```bash
53+
export SSL_CERT_FILE=/path/to/ca.crt
54+
```
55+
56+
Or add the CA certificate to the system's trust store.

‎docs/best-practices/cert-manager.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: sandbox-ca-issuer
6+
namespace: sandbox-system
7+
spec:
8+
selfSigned: {}
9+
---
10+
apiVersion: cert-manager.io/v1
11+
kind: Issuer
12+
metadata:
13+
name: sandbox-signing-issuer
14+
namespace: sandbox-system
15+
spec:
16+
ca:
17+
secretName: sandbox-ca-key-pair
18+
---
19+
apiVersion: cert-manager.io/v1
20+
kind: Certificate
21+
metadata:
22+
name: sandbox-ca
23+
namespace: sandbox-system
24+
spec:
25+
isCA: true
26+
duration: 87600h # 10 years
27+
secretName: sandbox-ca-key-pair
28+
privateKey:
29+
algorithm: ECDSA
30+
size: 256
31+
issuerRef:
32+
name: sandbox-ca-issuer
33+
kind: Issuer
34+
group: cert-manager.io
35+
commonName: sandbox-ca
36+
subject:
37+
organizations:
38+
- openkruise
39+
---
40+
apiVersion: cert-manager.io/v1
41+
kind: Certificate
42+
metadata:
43+
name: sandbox-manager-ingress-cert
44+
namespace: sandbox-system
45+
spec:
46+
secretName: sandbox-manager-tls
47+
duration: 2160h # 90 days
48+
renewBefore: 360h # 15 days
49+
subject:
50+
organizations:
51+
- openkruise
52+
isCA: false
53+
dnsNames:
54+
- "*.your.domian.com"
55+
- "your.domian.com"
56+
issuerRef:
57+
name: sandbox-signing-issuer
58+
kind: Issuer
59+
group: cert-manager.io

0 commit comments

Comments
 (0)