# Cert-Manager

Cert-Manager builds on top of Kubernetes and OpenShift to provide X.509 certificates and issuers as first-class resource types.


# DNS-01 validation

To get a `Certificate`, Cert-Manager creates a `CertificateRequest` that uses an `Issuer` (or `ClusterIssuer`) to manage the process of creating/managing the cert.

For LetsEncrypt DNS-01 validation, the `Issuer` will create an `Order` and a `Challenge` to validate ownership of the domain associated with the cert.

Staging and production are provided as two separate `ClusterIssuer` resources: `letsencrypt-staging` and `letsencrypt-production`. Point a `Certificate`'s `issuerRef` at the **staging** `ClusterIssuer` to provision a test certificate before switching to production:

``` sh
# review k8s objects
kubectl get CertificateRequest -n network
kubectl get Order -n network
kubectl get Challenge -n network

# once the DNS challenge has propagated
kubectl get Certificate -n network
```


# ⚠️ Rate Limits

- [Let's Encrypt rate limits](https://letsencrypt.org/docs/rate-limits/) can be mitigated by testing with the `letsencrypt-staging` `ClusterIssuer` before switching to `letsencrypt-production`.
- Check on your requests count w/r/t rate limits here: <https://crt.sh/>


# 🔀 Cross-namespace certs

Cluster can use `reflector` to copy secrets across namespaces. In particular, this can share the tls certificates from `network` to `security`.

- Cert-manager's [faq](https://cert-manager.io/docs/tutorials/syncing-secrets-across-namespaces/)
- [Emberstack Reflector](https://github.com/emberstack/kubernetes-reflector)


## Process

1.  `reflector` will check secrets for an annotation indicating it may be replicated to other namespaces

    ``` yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: <SECRET_NAME>
      namespace: <SECRET_NAMESPACE>
      annotations:
        reflector.v1.k8s.emberstack.com/reflection-allowed: 'true'
        reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ns1,ns2,...   # "" (empty) == all namespaces
        # automatically create mirrored resources
        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: 'true'
        reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: ns1, ns2
        #
    ```

> **Note**
>
> Source: [`kubernetes/apps/cert-manager/README.md`](https://github.com/ahgraber/homelab-gitops-k3s/blob/main/kubernetes/apps/cert-manager/README.md)