Skip to content

Improve Serving encryption docs #5955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 13, 2024
+6 −5
Merged

Improve Serving encryption docs #5955

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
13be0df
Review improvements
ReToCode May 1, 2024
a7231cf
Review improvements
ReToCode May 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/serving/encryption/configure-certmanager-integration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,22 +70,22 @@ As this is also not possible via ACME protocol (DNS01/HTTP01), you need to confi

```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
kind: ClusterIssuer # this issuer is used by cert-manager to sign all certificates
metadata:
name: selfsigned-cluster-issuer
name: cluster-selfsigned-issuer
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
kind: ClusterIssuer # this issuer is specifically for Knative, it will use the CA stored in the secret created by the Certificate below
metadata:
name: knative-selfsigned-issuer
spec:
ca:
secretName: knative-selfsigned-ca
---
apiVersion: cert-manager.io/v1
kind: Certificate
kind: Certificate # this creates a CA certificate, signed by cluster-selfsigned-issuer and stored in the secret knative-selfsigned-ca
metadata:
name: knative-selfsigned-ca
namespace: cert-manager # If you want to use it as a ClusterIssuer the secret must be in the cert-manager namespace.
Expand All @@ -97,13 +97,13 @@ As this is also not possible via ACME protocol (DNS01/HTTP01), you need to confi
isCA: true
issuerRef:
kind: ClusterIssuer
name: selfsigned-cluster-issuer
name: cluster-selfsigned-issuer
```

1. Ensure that the `ClusterIssuer` is ready:

```bash
kubectl get clusterissuer selfsigned-cluster-issuer -o yaml
kubectl get clusterissuer cluster-selfsigned-issuer -o yaml
kubectl get clusterissuer knative-selfsigned-issuer -o yaml
```
Result: The `Status.Conditions` should include `Ready=True`.
Expand Down
Loading