Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarify differences between example configs for CA issuer and cluster CA issuer #1516

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Clarify differences between example configs for CA issuer and cluster CA issuer #1516

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions content/docs/configuration/selfsigned.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,14 +117,10 @@ spec:
secretName: root-secret
```

Alternatively, if you are looking to use `ClusterIssuer` for signing `Certificates` anywhere in your cluster with the `SelfSigned` `Certificate` CA, use the YAML below (slight modification to the last step):
Alternatively, if you are looking to use `ClusterIssuer` for signing `Certificates` anywhere in your cluster with the `SelfSigned` `Certificate` CA, use the YAML below (slight modification):

```yaml
apiVersion: v1
kind: Namespace
metadata:
name: sandbox
---
# `sandbox` namespace is no longer needed.
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
Expand All @@ -136,6 +132,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: my-selfsigned-ca
# Create CA root secret in `cert-manager` namespace instead of `sandbox` namespace.
namespace: cert-manager
spec:
isCA: true
Expand All @@ -155,6 +152,7 @@ metadata:
name: my-ca-issuer
spec:
ca:
# `ClusterIssuer` resource is not namespaced, so `secretName` is assumed to reference secret in `cert-manager` namespace.
secretName: root-secret
```
The "selfsigned-issuer" `ClusterIssuer` is used to issue the Root CA Certificate. Then, "my-ca-issuer" `ClusterIssuer` is used to issue but also sign certificates using the newly created Root CA `Certificate`, which is what you will use for future certificates cluster-wide.
Expand Down