An Azure AKS + Let's Encrypt Tutorial by wallrj · Pull Request #1120 · cert-manager/website

wallrj · 2022-11-25T22:44:42Z

Preview: https://deploy-preview-1120--cert-manager-website.netlify.app/docs/tutorials/getting-started-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ssl/

Written during the course of testing cert-manager/cert-manager#5570

feat(AzureDNS): Add support for Workload Identity cert-manager#5570

netlify · 2022-11-25T22:51:04Z

✅ Deploy Preview for cert-manager-website ready!

Name	Link
🔨 Latest commit	`637e157`
🔍 Latest deploy log	https://app.netlify.com/sites/cert-manager-website/deploys/63bd7e3d02aca20008d1c6ba
😎 Deploy Preview	https://deploy-preview-1120--cert-manager-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

pinkfloydx33 · 2022-11-26T10:21:28Z

AZWI can be installed as a first class feature of AKS using the --enable-workload-identity switch. It's behind a feature flag currently but will be the recommended way to install once the feature is GA. Not sure if it's worth including that information or not: here

pinkfloydx33 · 2022-11-26T10:30:44Z

Also FWIW, I think most people may be used to specifying the managed identity's clientID using the ServiceAccount annotation. The value on the CRD is meant to act as an override for cases where you are dealing with multiple DNS zones that need different MSI's for access (though it can work perfectly fine this way).

I pushed for that feature to be added to the PR so that there was parity with pod-identity and so that cert-manager behaved similarly to other applications that have already added AZWI support. Personally, I only need interaction with one DNS zone per cluster, so specifying the clientId as a ServiceAccount annotation and omitting the managedIdentity object is what I would do. I'm not sure what the common case would look like though...

Maybe include an example of both ways? One using the annotation only and another example for "configuring cert-manager to use multiple DNS zones requiring different MSI's"?

weisdd · 2022-11-26T12:50:54Z

...d-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ingress-ssl/README.md

+    --node-count 1 \
+    --node-vm-size "Standard_B2s" \
+    --load-balancer-sku basic \
+    --enable-oidc-issuer # ℹ️ This is required for workload identity federation and is only available when using the aks-preview extension.


Thanks for writing the detailed docs! I'll try to have a closer look at the document soon.

There's a tiny thing that I've just spotted:

OIDC issuer has been promoted to GA in AKS 2022-10-16, so I think the aks-preview extension is no longer a requirement for that.

Suggested change

--enable-oidc-issuer # ℹ️ This is required for workload identity federation and is only available when using the aks-preview extension.

--enable-oidc-issuer # ℹ️ This is required for workload identity federation.

aks-preview is definitely needed when Workload Identity Webhook itself is installed as a preview extension, not sure if it's mandatory for running az identity federated-credential create assuming the webhook is installed through a chart.

wallrj · 2022-11-29T14:53:03Z

Thanks both of you for the feedback. I've updated the tutorial to use the --enable-workload-identity flag,
and I've added the service account label through a helm install --set-string flag,
and that simplifies things quite a lot.

weisdd · 2022-11-30T14:33:53Z

...d-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ingress-ssl/README.md

+    --node-vm-size "Standard_B2s" \
+    --load-balancer-sku basic \
+    --enable-oidc-issuer \
+    --enable-workload-identity # ℹ️ This is currently only available when using the aks-preview extension.


I think it'd be useful to mention that if EnableWorkloadIdentityPreview feature flag is not yet enabled for the subscription, a user will have to follow these steps: https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster#register-the-enableworkloadidentitypreview-feature-flag

wallrj · 2022-11-30T17:33:21Z

Maybe include an example of both

@pinkfloydx33 I didn't have the energy to document client-id both ways.
It seems to me that adding the client-id to the issuer spec is more appropriate because otherwise it requires a decision to be made about which managed identity to associate with the cert-manager service account by a cluster administrator at cert-manager install time.
This seems like a decision to be made by a cert-manager administrator who is responsible for configuring the clusterissuer....that's my excuse anyway :-)

pinkfloydx33 · 2022-11-30T18:22:51Z

Fine by me, makes sense. Like I said, not sure what the common case will be.

weisdd · 2023-01-04T16:42:46Z

...g-started-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ssl/README.md

+    --wait \
+    --namespace cert-manager \
+    --set installCRDs=true \
+    --set-string 'serviceAccount.labels.azure\.workload\.identity/use=true' # ❗ Label the cert-manager service account for the attention of workload-identity webhook


There's upcoming change in workload identity webhook, which would require the label to rather be set on pods (Azure/azure-workload-identity#601). For the transition period, any of those would work (serviceAccount or pod label: https://github.com/Azure/azure-workload-identity/blob/df6362a239c5d3fc19f48ff8bc7ae2ced594f116/pkg/webhook/webhook.go#L136). Since we never know which version of the webhook is installed in a cluster, I guess we can make the example universal by simply setting the label in two places.

Suggested change

--set-string 'serviceAccount.labels.azure\.workload\.identity/use=true' # ❗ Label the cert-manager service account for the attention of workload-identity webhook

--set-string 'podLabels.azure\.workload\.identity/use=true' \

--set-string 'serviceAccount.labels.azure\.workload\.identity/use=true' # ❗ Label the cert-manager service account and pod for the attention of workload-identity webhook

Done. I've moved these to a separate values.yaml file for easier readability.

weisdd · 2023-01-06T09:25:18Z

...started-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ssl/values.yaml

@@ -0,0 +1,6 @@
+# values.yaml
+podLabels:
+    azure.workload.identity/use: "true"


Suggested change

azure.workload.identity/use: "true"

azure.workload.identity/use: "true"

The indentation is a bit off, the rest looks great :)

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

…ndex page Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

wallrj

@SgtCoDFish I think I addressed all your code review comments.
PTAL

clusterissuer-selfsigned.yaml

content/docs/manifest.json

...g-started-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ssl/README.md

SgtCoDFish

/lgtm
/approve
/hold

I've added a couple of suggestions - should've thought about the embedded file thing before. Happy to merge as-is, but added a hold in case you'd like to embed the files!

SgtCoDFish · 2023-01-10T15:26:24Z

README.md

  Add it to `docs/` and possibly to the specific version of cert-manager that's latest (e.g. `v1.8-docs/`)
 - Something which only applies to the next major version of cert-manager? <br />
-  Add it to `next-docs`
+  Add it to `docs/` but branch from the [`release-next` branch](https://github.com/cert-manager/website/tree/release-next) and merge the PR into that branch.


Great drive-by improvement 👍

SgtCoDFish · 2023-01-10T15:32:55Z

content/docs/tutorials/getting-started-aks-letsencrypt/README.md

+```yaml
+# certificate.yaml
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: www
+spec:
+  secretName: www-tls
+  privateKey:
+    rotationPolicy: Always
+  commonName: www.$DOMAIN_NAME
+  dnsNames:
+    - www.$DOMAIN_NAME
+  usages:
+    - digital signature
+    - key encipherment
+    - server auth
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+```
+🔗 <a href="certificate.yaml">`certificate.yaml`</a>


suggestion: I don't think it's required for you to do this, but seeing this just triggered a memory for me of one of the benefits of the website migration - embedding YAML files.

See for example the old ACME tutorial (which maybe should be a redirect to your newer/better one, but that's a task for another day) here.

(Which produces this page)

That would ensure that the YAML in this document doesn't get out of sync with the YAML in certificate.yaml.

I like that you've got an explicit link to it as well as embedding it, in any case!

Done. In #1140

I didn't know about that feature. Thanks.

SgtCoDFish · 2023-01-10T15:33:27Z

content/docs/tutorials/getting-started-aks-letsencrypt/README.md

+```
+helm upgrade cert-manager jetstack/cert-manager \
+    --namespace cert-manager \
+    --reuse-values \
+    --values values.yaml


nit (non-blocking): missing a tag for the code block, but it doesn't really matter!

jetstack-bot · 2023-01-10T15:34:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SgtCoDFish, wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [SgtCoDFish,wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

SgtCoDFish · 2023-01-10T15:34:44Z

Should also say that I've not tested this (no Azure env) but I think it looks awesome!

wallrj · 2023-01-10T15:51:20Z

/hold cancel

jetstack-bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 25, 2022

wallrj changed the title ~~An Azure AKS + Let's Encrypt Tutorial~~ WIP: An Azure AKS + Let's Encrypt Tutorial Nov 25, 2022

jetstack-bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Nov 25, 2022

wallrj force-pushed the azure-aks-tutorial branch from 643a24d to ee86856 Compare November 25, 2022 22:51

weisdd reviewed Nov 26, 2022

View reviewed changes

jetstack-bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 29, 2022

weisdd suggested changes Nov 30, 2022

View reviewed changes

wallrj force-pushed the azure-aks-tutorial branch from fce5700 to 65c36a5 Compare November 30, 2022 17:12

wallrj changed the title ~~WIP: An Azure AKS + Let's Encrypt Tutorial~~ An Azure AKS + Let's Encrypt Tutorial Nov 30, 2022

jetstack-bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 30, 2022

This comment was marked as outdated.

Sign in to view

jetstack-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 30, 2022

wallrj changed the base branch from master to release-next December 2, 2022 12:17

jetstack-bot added the do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. label Dec 2, 2022

mkemmerz mentioned this pull request Dec 6, 2022

Using Azure workload identity instead of AAD Pod Identities to configure the AzureDNS DNS01 challenge. cert-manager/cert-manager#5543

Closed

weisdd reviewed Jan 4, 2023

View reviewed changes

wallrj force-pushed the azure-aks-tutorial branch 2 times, most recently from 6e7ded7 to 89a41fd Compare January 5, 2023 16:41

weisdd reviewed Jan 6, 2023

View reviewed changes

wallrj force-pushed the azure-aks-tutorial branch from 89a41fd to 0f36191 Compare January 6, 2023 10:07

jetstack-bot removed the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jan 6, 2023

wallrj added 11 commits January 10, 2023 14:37

Remove accidentally committed yaml manifest

2a5eb86

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Re-order the getting started items

cf05546

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Use a shorter URL path

9a074f8

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Link to README.md files rather than parent directory

f8bb86b

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Move envsubst tip closer to the envsubst command

6dccd1d

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Move the --insecure warning closer to the first use

77eb21d

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Fewer SSL references.

e0bdc1b

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Add a release note about Azure workload identity federation

92bafcf

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Fix relative links

10e97c9

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Move getting started tutorials to the top of the tutorials menu and i…

2bf8486

…ndex page Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Fewer SSL references

b202db5

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

wallrj force-pushed the azure-aks-tutorial branch from 0f36191 to b202db5 Compare January 10, 2023 14:55

wallrj added 3 commits January 10, 2023 14:59

Fix relative link

08088d9

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Use the terminal code fence annotation

5c4f8c2

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

Another warning explaining why we're using --insecure

637e157

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

wallrj commented Jan 10, 2023

View reviewed changes

clusterissuer-selfsigned.yaml Outdated Show resolved Hide resolved

content/docs/manifest.json Outdated Show resolved Hide resolved

...g-started-with-cert-manager-on-azure-kubernetes-service-using-lets-encrypt-for-ssl/README.md Outdated Show resolved Hide resolved

SgtCoDFish approved these changes Jan 10, 2023

View reviewed changes

jetstack-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 10, 2023

jetstack-bot assigned SgtCoDFish Jan 10, 2023

jetstack-bot added the lgtm Indicates that a PR is ready to be merged. label Jan 10, 2023

jetstack-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 10, 2023

jetstack-bot merged commit aada753 into cert-manager:release-next Jan 10, 2023

jetstack-bot mentioned this pull request Jan 10, 2023

cert-manager release 1.11 #1136

Merged

wallrj deleted the azure-aks-tutorial branch January 10, 2023 16:30

wallrj mentioned this pull request Jan 10, 2023

Fix Azure AKS tutorial file downloads #1140

Merged

jetstack-bot mentioned this pull request Jan 14, 2023

Merg #1158

Closed

wallrj mentioned this pull request Jan 19, 2023

Use include files for tutorial manifests #1166

Merged

	--enable-oidc-issuer # ℹ️ This is required for workload identity federation and is only available when using the aks-preview extension.
	--enable-oidc-issuer # ℹ️ This is required for workload identity federation.

	--set-string 'serviceAccount.labels.azure\.workload\.identity/use=true' # ❗ Label the cert-manager service account for the attention of workload-identity webhook
	--set-string 'podLabels.azure\.workload\.identity/use=true' \
	--set-string 'serviceAccount.labels.azure\.workload\.identity/use=true' # ❗ Label the cert-manager service account and pod for the attention of workload-identity webhook

	azure.workload.identity/use: "true"
	azure.workload.identity/use: "true"

Conversation

wallrj commented Nov 25, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Nov 25, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cert-manager-website ready!

Uh oh!

pinkfloydx33 commented Nov 26, 2022

Uh oh!

pinkfloydx33 commented Nov 26, 2022

Uh oh!

weisdd Nov 26, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wallrj commented Nov 29, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

wallrj commented Nov 30, 2022

Uh oh!

pinkfloydx33 commented Nov 30, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wallrj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SgtCoDFish left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jetstack-bot commented Jan 10, 2023

Uh oh!

SgtCoDFish commented Jan 10, 2023

Uh oh!

wallrj commented Jan 10, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

wallrj commented Nov 25, 2022 •

edited

Loading

netlify bot commented Nov 25, 2022 •

edited

Loading

weisdd Nov 26, 2022 •

edited

Loading