Certificate resources are used to declare one or more Let's Encrypt issued TLS certificates. Certificate resources are consumed by the Kubernetes Certificate Manager.
Before you can create a Certificate resource you must create the Certificate Third Party Resource in your Kubernetes cluster.
- apiVersion - The Kubernetes API version. See Certificate Third Party Resource.
- kind - The Kubernetes resource type.
- metadata.name - The name of the Certificate resource.
- spec.domain - The DNS domain to obtain a Let's Encrypt certificate for.
- spec.secretName - The name of the created secret. If not set or empty, a name will be generated based on the domain name.
- spec.email - The email address used for a Let's Encrypt registration. Optional, if you set the
-default-email
argument. - spec.provider - The name of the challenge provider plugin (see Configuring your challenge provider(s)). Optional, if you set the
-default-provider
argument. - spec.altNames - A string array of optional subject alternative names to be included in the certificate.
The following Kubernetes Certificate configuration assume the following:
- The necessary environment variables for the googlecloud provider are set.
- The
psg.io
domain is registered. - The
psg.io
domain is managed by Google Cloud DNS
apiVersion: "stable.k8s.psg.io/v1"
kind: "Certificate"
metadata:
name: "psg-dot-io"
spec:
domain: "psg.io"
email: "admin@psg.io"
provider: "googlecloud"