starlingx/docs
Code Issues Proposed changes
833451bd9f
docs/doc/source/security/kubernetes/enable-use-of-cert-manager-acmesolver-image-in-a-particular-namespace.rst
Keane Lim 3c5fa979a4 Security guide update 
Re-organized topic hierarchy

Tiny edit to restart review workflow.

Squashed with Resolved index.rst conflict commit

Change-Id: I13472792cb19d1e9975ac76c6954d38054d606c5
Signed-off-by: Keane Lim <keane.lim@windriver.com>
Signed-off-by: MCamp859 <maryx.camp@intel.com>
2021-03-12 15:10:40 -05:00

1.3 KiB
Raw Blame History

Enable Use of cert-manager-acmesolver Image in a Particular Namespace

When an arbitrary user creates a certificate with an external , cert-manager dynamically creates the cert-manager-acmesolver pod and an ingress in the user-specified namespace in order to handle the http01 challenge from the external CA.

In order to pull the registry.local:9001:/public/cert-manager-acmesolver:<tag> image from the local registry, the credentials for the public repository must be in a secret and referenced in an ImagePullSecret in the default serviceAccount of that user-specified namespace.

  1. Execute the following commands, substituting your deployment-specific value for <USERNAMESPACE>.

    % kubectl get secret registry-local-public-key -n kube-system -o yaml | grep -v '^\s*namespace:\s'  | kubectl apply --namespace=<USERNAMESPACE> -f -

% kubectl patch serviceaccount default  -p "{\"imagePullSecrets\": [{\"name\": \"registry-local-public-key\"}]}" -n <USERNAMESPACE>