knative
/
docs
mirror of https://github.com/knative/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve Serving encryption docs (#5955) 

* Review improvements

* Review improvements
This commit is contained in:
Reto Lehmann 2024-05-13 10:46:18 +02:00 committed by GitHub
parent 187fe78b97
commit 872e83e91a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
docs/serving/encryption/configure-certmanager-integration.md
View File

@ -69,15 +69,16 @@ As this is also not possible via ACME protocol (DNS01/HTTP01), you need to confi
1. Create and apply the following self-signed `ClusterIssuer` to your cluster:
```yaml
# this issuer is used by cert-manager to sign all certificates
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned-cluster-issuer
name: cluster-selfsigned-issuer
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
kind: ClusterIssuer # this issuer is specifically for Knative, it will use the CA stored in the secret created by the Certificate below
metadata:
name: knative-selfsigned-issuer
spec:
@ -85,7 +86,7 @@ As this is also not possible via ACME protocol (DNS01/HTTP01), you need to confi
secretName: knative-selfsigned-ca
---
apiVersion: cert-manager.io/v1
kind: Certificate
kind: Certificate # this creates a CA certificate, signed by cluster-selfsigned-issuer and stored in the secret knative-selfsigned-ca
metadata:
name: knative-selfsigned-ca
namespace: cert-manager # If you want to use it as a ClusterIssuer the secret must be in the cert-manager namespace.
@ -97,13 +98,13 @@ As this is also not possible via ACME protocol (DNS01/HTTP01), you need to confi
isCA: true
issuerRef:
kind: ClusterIssuer
name: selfsigned-cluster-issuer
name: cluster-selfsigned-issuer
```
1. Ensure that the `ClusterIssuer` is ready:
```bash
kubectl get clusterissuer selfsigned-cluster-issuer -o yaml
kubectl get clusterissuer cluster-selfsigned-issuer -o yaml
kubectl get clusterissuer knative-selfsigned-issuer -o yaml
```
Result: The `Status.Conditions` should include `Ready=True`.