ACM Day 1

Goal of this page is to document a series of common best practices during the initial setup of ACM

Installation

Install ACM through OperatorHub

After Installation

Add an ACME certificate

This document will add a valid ACME certificate to the HUB Openshift Route and to the API endpoint

Version: Tested with Openshift 4.7

$ git clone https://github.com/acmesh-official/acme.sh.git
$ cd acme.sh

export API=$(oc whoami --show-server | cut -f 2 -d ':' | cut -f 3 -d '/' | sed 's/-api././')
export WILDCARD=$(oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.status.domain}')

AWS

Here we show how to add a `lets encrypt certificate for AWS cloud provider

AWS_SECRET_ACCESS_KEY=<your AWS secret access key> AWS_ACCESS_KEY=<your AWS access key> /acme.sh  --issue   --dns dns_aws -d ${API} -d *.${WILDCARD}

Now the certificate bundle and the private key are generated in the folder named ${API}. You should create a secret with the key and the full chain certificate, both in PEM` format

oc create secret tls router-certs --cert=fullchain.cer --key=${API}.key -n openshift-ingress

As soon you have the secret you can modify the `ingress controller

oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" } } }'

Now using the same set of certificates you can also add the same let's encrypt certificate to APIs:

oc create secret tls api-certs --cert=fullchain.cer --key=${API}.key -n openshift-config
oc patch apiserver cluster \
     --type=merge -p \
     "{\"spec\":{\"servingCerts\": {\"namedCertificates\": [{\"names\": [\"${API}\"], \"servingCertificate\": {\"name\": \"api-certs\"}}]}}}"

According to the acme.sh cert will be automatically renewd every 60 days

Thanks to Blog: Installing letsencrypt certificate for Openshift 4 and to Official documentation for API certs