Page Comparison

...

With ClusterIssuer setup properly, we can proceed to generate SSL Certificate and import into OCI Certificate Certificates Service.

To generate certificate, create a yaml file named certificate.yaml with the following contents:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: lb-cert
spec:
  commonName: <cluster_dns_zone_name listed in the terraform output>
  dnsNames:
    - <cluster_dns_zone_name listed in the terraform output>
    - desktop-online.<cluster_dns_zone_name listed in the terraform output>
    - platform.<cluster_dns_zone_name listed in the terraform output>
    - ingress.<cluster_dns_zone_name listed in the terraform output>
    - grafana.<cluster_dns_zone_name listed in the terraform output>
  issuerRef:
    kind: ClusterIssuer
    name: example-issuer
  secretName: lb-cert

...

1. Execute the yaml file

...

kubectl apply -f certificate.yaml -n uepe

2. Wait for a while and confirm certificate has been generated successfully.

kubectl get certificate -n uepe 

3. The output shows the certificate named lbcert’s status is ready

NAME                                                 READY   SECRET                              AGE
lb-cert                                              True    lb-cert                             46h

4. Extract the server certificate and CA certificate from secret lbcert

kubectl get secrets lb-cert -n uepe -o yaml | yq '.data' | grep "tls.crt" | awk -F : '{print $2}'| tr -d " "|base64 -d > tls.crt

...

5. Separate server certificate and CA certificate into two files

kubectlcsplit get secrets lb-cert -n uepe -o yaml | yq '.data'tls.crt '/^-----BEGIN CERTIFICATE-----$/' 

6. Rename first generated file as server certificate file

mv xx00 tls.crt

7. Rename second generated file as CA certificate file

mv xx01 ca.crt

8. Extract the private key from secret lbcert

kubectl get secrets lb-cert -n uepe -o yaml | yq '.data' | grep "tls.key" | awk -F : '{print $2}'| tr -d " "|base64 -d > tls.key

By now, server certificate, CA certificate and private key are stored in tls.crt, ca.crt and tls.key respectively. Next step is to import into OCI Certificates Service.

Import into OCI Certificates Service

Go to OCI console management, search for Certificates service. On the Certificates service page, click Create Certificate and follow these steps

1. Select Certificate Type Imported and give it a unique name

2. Click Next and come to Certificate Configuration page.

3. Upload tls.crt, ca.crt and tls.key to the Certificate Configuration

4. Click Next and proceed to Create Certificate

5. Wait for the certificate to be created. Copy the certificate’s ocid and set it to oci.certificates.id

Install Helm Chart

Although the number of helm value combinations to set is virtually endless, some values should more or less always be set.

...