From 8b2ffbd2bc359a837032190c1cb2376c745ceca1 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 8 Jun 2018 13:10:10 +0100 Subject: [PATCH] Add docs on selfsigned Issuer --- docs/index.rst | 2 +- docs/reference/issuers.rst | 26 +++++------ docs/reference/issuers/selfsigned/index.rst | 48 +++++++++++++++++++++ 3 files changed, 63 insertions(+), 13 deletions(-) create mode 100644 docs/reference/issuers/selfsigned/index.rst diff --git a/docs/index.rst b/docs/index.rst index cca58248d51..f302d9eecce 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -9,7 +9,7 @@ Welcome to cert-manager's documentation! cert-manager is a native Kubernetes_ certificate management controller. It can help with issuing certificates from a variety of sources, such as -`Let's Encrypt`_, `HashiCorp Vault`_ or a simple signing keypair. +`Let's Encrypt`_, `HashiCorp Vault`_, a simple signing keypair, or self signed. It will ensure certificates are valid and up to date, and attempt to renew certificates at a configured time before expiry. diff --git a/docs/reference/issuers.rst b/docs/reference/issuers.rst index 3cf0c6d5224..da54446fb14 100644 --- a/docs/reference/issuers.rst +++ b/docs/reference/issuers.rst @@ -117,18 +117,20 @@ Supported Issuer types cert-manager has been designed to support pluggable Issuer backends. The currently supported Issuer types are: -=================================== ========================================= -Name Description -=================================== ========================================= -:doc:`ACME ` Supports obtaining certificates from an - ACME server, validating with HTTP01 or - DNS01 -:doc:`CA ` Supports issuing certificates using a - simple signing keypair, stored in a Secret - in the Kubernetes API server -:doc:`Vault ` Supports issuing certificates using - HashiCorp Vault. -=================================== ========================================= ++-----------------------------------------------+----------------------------------------------------------------------+ +| Name | Description | ++===============================================+======================================================================+ +| :doc:`ACME ` | Supports obtaining certificates from an ACME server, validating with | +| | HTTP01 or DNS01 | ++-----------------------------------------------+----------------------------------------------------------------------+ +| :doc:`CA ` | Supports issuing certificates using a simple signing keypair, stored | +| | in a Secret in the Kubernetes API server | ++-----------------------------------------------+----------------------------------------------------------------------+ +| :doc:`Vault ` | Supports issuing certificates using HashiCorp Vault. | ++-----------------------------------------------+----------------------------------------------------------------------+ +| :doc:`Self signed ` | Supports issuing self signed Certificates | ++-----------------------------------------------+----------------------------------------------------------------------+ + Each Issuer resource is of one, and only one type. The type of an Issuer is inferred by which field it specifies in its spec, such as ``spec.acme`` diff --git a/docs/reference/issuers/selfsigned/index.rst b/docs/reference/issuers/selfsigned/index.rst new file mode 100644 index 00000000000..0141af805de --- /dev/null +++ b/docs/reference/issuers/selfsigned/index.rst @@ -0,0 +1,48 @@ +========================= +Self-signed Configuration +========================= + +.. toctree:: + :maxdepth: 1 + +Self signed Issuers will issue self signed certificates. + +This is useful when building PKI within Kubernetes, or as a means to generate a +root CA for use with the :doc:`CA Issuer ` once +cert-manager supports setting the ``isCA`` flag on Certificate resources +(`#85`_). + +A self-signed Issuer contains no additional configuration fields, and can be +created with a resource like so: + +.. code-block:: yaml + + apiVersion: certmanager.k8s.io/v1alpha1 + kind: ClusterIssuer + metadata: + name: selfsigning-issuer + spec: + selfSigned: {} + +.. note:: + The presence of the ``selfSigned: {}`` line is enough to indicate that this Issuer + is of type 'self signed'. + +Once created, you should be able to Issue certificates like normal by +referencing the newly created Issuer in your ``issuerRef``: + +.. code-block:: yaml + + apiVersion: certmanager.k8s.io/v1alpha1 + kind: Certificate + metadata: + name: example-crt + spec: + secretName: my-selfsigned-cert + dnsNames: + - example.com + issuerRef: + name: selfsigning-issuer + kind: ClusterIssuer + +.. _`#85`: https://github.com/jetstack/cert-manager/issues/85 \ No newline at end of file