-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add documentation for Serving Encryption (#5804)
* Add Serving encryption overview page * Add Serving encryption sub-pages * Lint fixes, minor updates * Review improvement * Add activator restart and fix CM label * Update docs about net-certmanager * Add wildcard config as a string * Review improvements
- Loading branch information
Showing
19 changed files
with
876 additions
and
643 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,42 +1,22 @@ | ||
| # Installing cert-manager for TLS certificates | ||
|
|
||
| Install the [Cert-Manager](https://github.com/jetstack/cert-manager) tool to | ||
| obtain TLS certificates that you can use for secure HTTPS connections in | ||
| Knative. For more information about enabling HTTPS connections in Knative, see | ||
| [Using custom certificates in networking-layer](../serving/encryption/using-certificates-in-networking-layer.md). | ||
|
|
||
| You can use cert-manager to either manually obtain certificates, or to enable | ||
| Knative for automatic certificate provisioning. Complete instructions about this are provided in | ||
| [Enabling automatic TLS certificate provisioning](../serving/encryption/enabling-automatic-tls-certificate-provisioning.md). | ||
|
|
||
| Regardless of if your want to manually obtain certificates, or configure Knative | ||
| for automatic provisioning, you can use the following steps to install | ||
| cert-manager. | ||
| Knative leverages [cert-manager](https://github.com/jetstack/cert-manager) to request TLS certificates | ||
| used for secure HTTPS connections in Knative. Installing [cert-manager](https://github.com/jetstack/cert-manager) | ||
| is required before enabling any of the Knative encryption features. Follow the steps below for the installation. | ||
|
|
||
| ## Before you begin | ||
|
|
||
| You must meet the following requirements to install cert-manager for Knative: | ||
|
|
||
| - Knative Serving must be installed. For details about installing the Serving | ||
| component, see the [Knative installation guide](yaml-install/serving/install-serving-with-yaml.md). | ||
| - You must configure your Knative cluster to use a | ||
| [custom domain](../serving/using-a-custom-domain.md). | ||
| - Knative currently supports cert-manager version `1.0.0` and higher. | ||
|
|
||
| ## Downloading and installing cert-manager | ||
|
|
||
| To download and install cert-manager, follow the [Installation steps](https://cert-manager.io/docs/installation/kubernetes/) from the official `cert-manager` website. | ||
| To download and install cert-manager, follow the [Installation steps](https://cert-manager.io/docs/installation/) from the official `cert-manager` website. | ||
|
|
||
| ## Completing the Knative configuration for TLS support | ||
| ## Using cert-manager with Knative | ||
|
|
||
| Before you can use a TLS certificate for secure connections, you must finish | ||
| configuring Knative: | ||
| Knative encryption can be configured in: | ||
|
|
||
| - **Manual**: If you installed cert-manager to manually obtain certificates, | ||
| continue to the following topic for instructions about creating a Kubernetes | ||
| secret: | ||
| [Manually adding a TLS certificate](../serving/encryption/using-certificates-in-networking-layer.md#manually-adding-a-tls-certificate) | ||
| * [Serving: Encryption Overview](../serving/encryption/encryption-overview.md) | ||
|
|
||
| - **Automatic**: If you installed cert-manager to use for automatic certificate | ||
| provisioning, continue to the following topic to enable that feature: | ||
| [Enabling automatic TLS certificate provisioning](../serving/encryption/enabling-automatic-tls-certificate-provisioning.md) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| # Configure cluster-local domain encryption | ||
|
|
||
| {% include "encryption-notice.md" %} | ||
|
|
||
| ## Before you begin | ||
|
|
||
| You must meet the following requirements to enable secure HTTPS connections: | ||
|
|
||
| - Knative Serving must be installed. For details about installing the Serving | ||
| component, see the [Knative installation guides](../../install/yaml-install/serving/install-serving-with-yaml.md). | ||
|
|
||
| !!! warning | ||
| This feature is currently only supported with Kourier and Istio as a networking layer. | ||
|
|
||
|
|
||
| ## Installing and configuring cert-manager and integration | ||
|
|
||
| First, you need to install and configure `cert-manager` and the Knative cert-manager integration. | ||
| Please refer to [Configuring Knative cert-manager integration](./configure-certmanager-integration.md) for details. | ||
|
|
||
|
|
||
| ## Enabling cluster-local-domain-tls | ||
|
|
||
| To enable `cluster-local-domain-tls` update the [`config-network` ConfigMap](https://github.com/knative/serving/blob/main/config/core/configmaps/network.yaml) in the `knative-serving` namespace: | ||
|
|
||
| 1. Run the following command to edit your `config-network` ConfigMap: | ||
|
|
||
| ```bash | ||
| kubectl edit configmap config-network -n knative-serving | ||
| ``` | ||
|
|
||
| 1. Add the `cluster-local-domain-tls: Enabled` attribute under the `data` section: | ||
|
|
||
| ```yaml | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: config-network | ||
| namespace: knative-serving | ||
| data: | ||
| ... | ||
| cluster-local-domain-tls: Enabled | ||
| ... | ||
| ``` | ||
|
|
||
| 1. Restart the Knative Serving controller to start the Knative cert-manager integration: | ||
|
|
||
| ```bash | ||
| kubectl rollout restart deploy/controller -n knative-serving | ||
| ``` | ||
|
|
||
| Congratulations! Knative is now configured to obtain and renew TLS certificates for cluster-local domains. | ||
|
|
||
|
|
||
| ## Verification | ||
|
|
||
| 1. Deploy a Knative Service | ||
|
|
||
| 1. Check the URL with `kubectl get ksvc -n <your-namespace> -o yaml` | ||
|
|
||
| 1. The service URL cluster-local domain (https://helloworld.test.svc.cluster.local) should now be **https**: | ||
|
|
||
| ```yaml | ||
| apiVersion: serving.knative.dev/v1 | ||
| kind: Service | ||
| metadata: | ||
| name: helloworld | ||
| namespace: test | ||
| spec: | ||
| # ... | ||
| status: | ||
| address: | ||
| # cluster-local-domain: | ||
| url: https://helloworld.test.svc.cluster.local | ||
| # ... | ||
| # external domain: | ||
| url: http://helloworld.first.example.com | ||
| ``` | ||
|
|
||
|
|
||
| ## Trust | ||
|
|
||
| !!! note | ||
| A quick note on trust, all clients that call the cluster-local domain of a Knative Service need to trust the Certificate Authority | ||
| that signed the certificates. This is out of scope of Knative, but needs to be addressed to ensure a working system. Especially | ||
| when a Certificate Authority performs a rotation of the CA or the intermediate certificates. Find more information on | ||
| [Configuring Knative cert-manager integration](./configure-certmanager-integration.md#managing-trust-and-rotation-without-downtime). | ||
|
|
Oops, something went wrong.