Prerequisite

An existing trusted certificate and corresponding private keys, and it must be root certificate or an intermediate certificate.

Note:

Wildcard certificate is not applicable.

You can upload an existing intermediate certificate or root certificate, generate a new certificate by establishing a cert-manager issuing center, and then replace EonKube's self-signed certificate.

Applicable situations:

• Automated Management: This approach is best if you want to automatically manage and update credentials and want to leverage existing root or relay credentials to generate and issue new credentials.
• Centralized Management: Allows central management of all credentials and global control across the entire cluster using Cluster Issuer.

Procedure

1. Upload the certificate to create a secret:
   1. Go to EonKube > Storage > Secrets.
   2. Click Create.
   3. Select TLS Certificate.
   4. Choose a namespace and specify an identifying name for this Secret.
   5. At the bottom of Certificate, click Read for File.
   6. Select the certificate file from your computer and click Open.
   7. Click Create.
2. Configure a cert-manager CA issuer:
   There are two kinds of issuer:
   • Issuer: The certificate's secret must reside in the same namespace.
   • ClusterIssuer: The certificate's secret can be used in the cluster.
     1. To create an Issuer, go to EonKube > More Resources > Cert Manager > Issuers.
     2. To create a ClusterIssuer, go to EonKube > More Resources > Cert Manager > ClusterIssuer.
     3. You can also click the Resource Search and search Issuer or ClusterIssuer.
     4. Click Create from YAML.
     5. Enter the following information:
        • kind: When creating an Issuer, the kind indicates Issuer. When creating a ClusterIssuer, the kind indicates ClusterIssuer.
        • metadata.name: Specify the issuer name.
        • ca.secretName: Specify the secret name that you uploaded.
     6. Click Create.
3. Change the assigned issuer: You can create a certificate yourself or generate a certificate by using cert-manager and renew the certificate. It is recommended that you use cert-manager to manage the certificate automatically.
   • Create a certificate using cert-manager (Recommended)
     1. Go to EonKube > Service Discovery > Ingresses.
     2. The ingresses are listed according to the names of namespaces. Find the cattle-system. Click ⋮ and select Edit YAML.
     3. Change the following fields to the certificate information:
        • cert-manager.io/issuer: Specify the issuer name.
        • cert-manager.io/issuer-kind: Specify the kind as Issuer or ClusterIssuer.
        • cert-manager.io/cluster-issuer: Specify the issuer name. This is equivalent to cert-manager.io/issuer-kind:ClusterIssuer.
        • cert-manager.io/duration: Specify the validity period of the certificate in hours. The minimum value is 1 hour.
        • cert-manager.io/renewBefore: Specify when to renew the certificate in hours before it expires. The minimum value is 1 hour 1h.
     4. Save the settings.
   • Create a certificate
     1. Go to EonKube > More Resources > Cert Manager > Certificates.
     2. Click Create from YAML.
     3. Enter the following information:
        • metadata.name: Specify the certificate name.
        • metadata.namespace: Specify the namespace. For the cluster, specify cattle-system.
        • spec.dnsNames: Specify the domain name. You can also use wildcard characters, e.g. '*.example.com'.
        • spec.duration: Specify the validity period of the certificate in hours. The minimum value is 1 hour 1h.
        • spec.issuerRef: Specify the kind as Issuer or ClusterIssuer, and specify the name of the issuer.
        • spec.renewBefore: Specify when to renew the certificate in hours before it expires. The minimum value is 1 hour 1h.
        • spec.secretName: Specify the secret name of this certificate.
     4. Click Create.
     5. Go to EonKube > Service Discovery > Ingresses.
     6. The ingresses are listed according to the names of namespaces. Find the cattle-system. Click ⋮ and select Edit YAML.
     7. Change the following fields to the certificate information that you just configured:
        • metadata.annotations.cert-manager.io/issuer
        • cert-manager.io/issuer-kind
        • tls.secretName
     8. Save the settings.