How to Install Cert Manager on Kubernetes

Securing communication over the internet is crucial, and Kubernetes, as a powerful container orchestration system, emphasizes the importance of robust security measures. One such essential component for ensuring secure communication within a Kubernetes cluster is Cert Manager. Cert Manager simplifies the management of TLS certificates, automating their issuance and renewal. In this guide, we will walk you through the step-by-step process of installing Cert Manager on Kubernetes, ensuring that your applications can communicate securely.

Prerequisites:

Before we begin, make sure you have the following prerequisites in place:

1. A running Kubernetes cluster.
2. kubectl command-line tool installed.
3. Helm installed on your local machine.

Step 1: Install Helm on your local machine

Helm is a package manager for Kubernetes that simplifies the deployment and management of applications. If you haven't installed Helm yet, run the following commands:

curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh

Step 2: Deploy Cert Manager using Helm

Now that Helm is installed, we can use it to deploy Cert Manager on our Kubernetes cluster. Run the following commands:

kubectl create namespace cert-manager
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v1.5.3 \
  --set installCRDs=true

These commands create a namespace for Cert Manager, add the Jetstack Helm repository, and install Cert Manager using Helm.

Step 3: Verify the installation

After the installation, you can verify that Cert Manager is running correctly by checking the pods in the cert-manager namespace:

kubectl get pods --namespace cert-manager

Ensure that all the Cert Manager pods are in the "Running" state.

Step 4: Create a ClusterIssuer

To enable Cert Manager to issue certificates, you need to create a ClusterIssuer resource. Below is an example YAML configuration for a Let's Encrypt ClusterIssuer:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: your-email@example.com
    privateKeySecretRef:
      name: letsencrypt-private-key
    solvers:
      - http01:
          ingress:
            class: nginx

Adjust the email address and other parameters as needed, then apply the configuration:

kubectl apply -f your-clusterissuer-config.yaml

Step 5: Obtain a TLS certificate

Now that Cert Manager is set up, you can request a TLS certificate for your application. Create a Certificate resource:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-tls
  namespace: default
spec:
  secretName: example-tls-secret
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  commonName: your-domain.com
  dnsNames:
    - your-domain.com

Adjust the commonName and dnsNames fields, then apply the configuration:

kubectl apply -f your-certificate-config.yaml

Step 6: Verify the certificate issuance

Check the status of the Certificate resource to ensure that Cert Manager has successfully obtained and issued the TLS certificate:

kubectl get certificate example-tls -o yaml

Look for the status.conditions field; it should show that the certificate has been "Issued."

Congratulations! You have successfully installed Cert Manager on your Kubernetes cluster and obtained a TLS certificate for your application. This ensures secure communication, enhancing the overall security of your Kubernetes environment. As you continue to deploy and manage applications within your cluster, Cert Manager will play a crucial role in automating certificate management.