Install and configure open source cert-manager

Introduction

F5 BIG-IP Cloud-Native Edition requires cert-manager and an associated cluster issuer to sign certificates used for internal communication between the CNE-core and CNE-instance components. The following instructions explain how to install open source cert-manager and create a cluster issuer.

Note

If you already have open source cert-manager installed, skip these instructions and create a new cluster issuer or designate an existing cluster issuer to use to sign these certificates. Where necessary in later instructions, you’ll be given the opportunity to substitute the name of your cluster issuer for the f5-cne-internal-ca cluster issuer created below.

Install open source cert-manager

  1. Use the following tables to determine the latest version of cert-manager that’s compatible with the version of your container-orchestration platform:

    For example, for OpenShift 4.18, the latest version of cert-manager that was compatible at the time this was written was v1.19.6.

  2. Install cert-manager and its custom resource definitions (CRDs), making sure to replace <VERSION> with the cert-manager version you determined in step 1:

    helm install cert-manager \
  oci://quay.io/jetstack/charts/cert-manager \
  --version <VERSION> \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true \
  --wait

Create a cluster issuer

  1. In a terminal window on your computer, make sure you’re in the F5 BIG-IP Cloud-Native Edition directory (for example, f5-big-ip-cne).

  2. Create a manifest that creates the f5-cne-internal-ca cluster issuer:

    cat <<'EOF' > f5-cne-cluster-issuer.yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
    name: selfsigned-cluster-issuer
spec:
    selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
    name: f5-cne-internal-signing-cert
    namespace: cert-manager
spec:
    isCA: true
    commonName: f5-cne-internal-signing-cert
    secretName: f5-cne-internal-signing-cert
    issuerRef:
        name: selfsigned-cluster-issuer
        kind: ClusterIssuer
        group: cert-manager.io
    privateKey:
      rotationPolicy: Always
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
    name: f5-cne-internal-ca
spec:
    ca:
        secretName: f5-cne-internal-signing-cert
EOF

  3. Create the cluster issuer:

    kubectl apply -f f5-cne-cluster-issuer.yaml

    Expected output

    clusterissuer.cert-manager.io/selfsigned-cluster-issuer created
certificate.cert-manager.io/f5-cne-internal-signing-cert created
clusterissuer.cert-manager.io/f5-cne-internal-ca created

  4. List the cluster issuers and confirm that they’re ready (READY is True):

    kubectl get clusterissuers

    Expected output

    NAME                        READY   AGE
f5-cne-internal-ca          True    83s
selfsigned-cluster-issuer   True    83s

  5. If READY is not True, check cert-manager pod health and events:

    kubectl get pods --namespace cert-manager
kubectl describe clusterissuer f5-cne-internal-ca

Next steps