1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  annotations: {}
5
  labels:
6
    k8s.kuboard.cn/name: step-ca-server
7
  name: step-ca-server
8
  namespace: step-ca
9
spec:
10
  selector:
11
    matchLabels:
12
      k8s.kuboard.cn/name: step-ca-server
13
  template:
14
    metadata:
15
      annotations:
16
      labels:
17
        k8s.kuboard.cn/name: step-ca-server
18
    spec:
19
      containers:
20
        - env:
21
            - name: DOCKER_STEPCA_INIT_NAME
22
              value: Smallstep
23
            - name: DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT
24
              value: 'true'
25
            - name: DOCKER_STEPCA_INIT_DNS_NAMES
26
              value: stepca.k8s.lan
27
            - name: CA_PASSWORD
28
              valueFrom:
29
                secretKeyRef:
30
                  key: password
31
                  name: step-ca-password
32
          image: 'smallstep/step-ca:latest'
33
          imagePullPolicy: IfNotPresent
34
          name: step-ca-server
35
          ports:
36
            - containerPort: 9000
37
              name: stepca
38
              protocol: TCP
39
          volumeMounts:
40
            - mountPath: /home/step/config/ca.json
41
              name: config
42
              subPath: ca.json
43
            - mountPath: /home/step/certs/intermediate_ca.crt
44
              name: intermediate-ca
45
              subPath: intermediate_ca.crt
46
            - mountPath: /home/step/certs/root_ca.crt
47
              name: root-ca
48
              subPath: root_ca.crt
49
            - mountPath: /home/step/secrets/intermediate_ca_key
50
              name: intermediate-ca-key
51
              subPath: intermediate_ca_key
52
            - mountPath: /home/step/secrets/password
53
              name: password
54
              subPath: password
55
            - mountPath: /home/step/db
56
              name: data
57
      securityContext:
58
        runAsGroup: 0
59
        runAsUser: 0
60
      volumes:
61
        - configMap:
62
            defaultMode: 420
63
            name: step-ca-configmap
64
          name: config
65
        - name: intermediate-ca
66
          secret:
67
            defaultMode: 420
68
            items:
69
              - key: intermediate_ca.crt
70
                path: intermediate_ca.crt
71
            secretName: step-ca-certs
72
        - name: root-ca
73
          secret:
74
            defaultMode: 420
75
            items:
76
              - key: root-ca.crt
77
                path: root_ca.crt
78
            secretName: step-ca-certs
79
        - name: intermediate-ca-key
80
          secret:
81
            defaultMode: 420
82
            items:
83
              - key: intermediate_ca_key
84
                path: intermediate_ca_key
85
            secretName: step-ca-password
86
        - name: password
87
          secret:
88
            defaultMode: 420
89
            items:
90
              - key: password
91
                path: password
92
            secretName: step-ca-password
93
        - name: data
94
          persistentVolumeClaim:
95
            claimName: step-ca-pvc

1
apiVersion: v1
2
data:
3
  ca.json: |2-
4
     {
5
          "root": "/home/step/certs/root_ca.crt",
6
          "crt": "/home/step/certs/intermediate_ca.crt",
7
          "key": "/home/step/secrets/intermediate_ca_key",
8
          "address": ":9000",
9
          "dnsNames": ["step-ca-server.step-ca.svc.cluster.local", "ca.k8s.lan"],
10
          "logger": {
11
            "format": "text"
12
          },
13
          "db": {
14
            "type": "badger",
15
            "dataSource": "/home/step/db"
16
          },
17
          "authority": {
18
            "provisioners": [
19
              {
20
                "type": "ACME",
21
                "name": "acme",
22
                "forceCN": true
23
              }
24
            ]
25
          }
26
        }
27
kind: ConfigMap
28
metadata:
29
  name: step-ca-configmap
30
  namespace: step-ca

1
apiVersion: cert-manager.io/v1
2
kind: ClusterIssuer
3
metadata:
4
  name: step-ca
5
spec:
6
  acme:
7
    server: https://ca.k8s.lan/acme/acme/directory  #ACME服务器地址
8
    email: admin@k8s.lan
9
spec:
10
  acme:
11
    privateKeySecretRef:
12
      name: my-acme-account-key
13
    server: https://ca.k8s.lan/acme/acme/directory
14
    solvers:
15
      - http01:
16
          ingress:
17
            class: nginx-ingress  # Ingress类名 负责http挑战

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  annotations:
5
    cert-manager.io/cluster-issuer: my-acme-issuer # 这里要改
6
  labels:
7
    app: longhorn-ui
8
  name: longhorn-ui
9
  namespace: longhorn-system
10
spec:
11
  ingressClassName: nginx-ingress
12
  rules:
13
    - host: longhorn.k8s.lan
14
      http:
15
        paths:
16
          - backend:
17
              service:
18
                name: longhorn-ui
19
                port:
20
                  number: 8000
21
            path: /
22
            pathType: Prefix
23
  tls:
24
    - hosts:
25
        - longhorn.k8s.lan  # 这里改成你需要的域名
26
      secretName: longhorn-tls-secret  # SSL的Secret 名称随意