cert-manager / signer-ca

Experimental 'local CA' based signer for Kubernetes 1.18 CSR API

signer-ca

signer-ca is an operator for automatically signing an approved CertificateSigningRequest.

NOTE: This operator is EXPERIMENTAL and requires Kubernetes >= 1.18. It uses Certificates API Enhancements which are only available in Kubernetes >= 1.18.

It watches CertificateSigningRequest (CSR) resources and if the CSR has a .spec.signerName that it recognizes, and if the CSR has been approved, it creates a signed certificate using a certificate-authority file that you supply as a command-line argument to the operator. The signed certificate is configured using the encoded CSR in .spec.request. The signed certificate is added to the .status.certificate of the CSR resource.

Installation

signer-ca can be deployed using kubectl apply -k config/default. See config/e2e for an example of how to make a CA file available to the operator, as a mounted secret.

Build

You can build and deploy signer-ca using make docker-build docker-push deploy-e2e DOCKER_PREFIX=gcr.io/<YOUR_PROJECT>/signer-ca/. See the Makefile for details.

Demo

signer-ca's Issues

kubectl -k

I'm failing on the installation using kubectl -k config/default. I get the error message

kubectl -k config/default
Error: unknown shorthand flag: 'k' in -k
See 'kubectl --help' for usage.

kubectl is 1.22

kubectl version --client
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.0", GitCommit:"c2b5237ccd9c0f1d600d3072634ca66cefdf272f", GitTreeState:"clean", BuildDate:"2021-08-04T17:56:19Z", GoVersion:"go1.16.6", Compiler:"gc", Platform:"darwin/amd64"}

Any ideas? What does -k stand for?