Scenario

An application requires TLS certificates for internal service communication.

Task

Setup cert-manager to issue a valid TLS certificate using a SelfSigned ClusterIssuer to bootstrap a CA Issuer.

Template files available at /home/interview/.

Step 1: Edit SelfSigned ClusterIssuer template selfsigned-issuer.yaml:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer        # Fix: my-issuer -> selfsigned-issuer
spec:
  selfSigned: {}                 # Fix: add selfSigned type

kubectl apply -f /home/interview/selfsigned-issuer.yaml

Step 2: Edit CA Certificate template ca-cert.yaml:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ca-cert                  # Fix: my-ca -> ca-cert
  namespace: preparesh                # Fix: default -> preparesh
spec:
  isCA: true                     # Add: mark as CA
  commonName: preparesh-ca
  secretName: ca-secret          # Fix: my-secret -> ca-secret
  issuerRef:
    name: selfsigned-issuer      # Fix: my-issuer -> selfsigned-issuer
    kind: ClusterIssuer          # Fix: Issuer -> ClusterIssuer

kubectl apply -f /home/interview/ca-cert.yaml

Step 3: Edit CA Issuer template ca-issuer.yaml:

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: ca-issuer                # Fix: my-ca-issuer -> ca-issuer
  namespace: preparesh                # Fix: default -> preparesh
spec:
  ca:
    secretName: ca-secret        # Fix: my-secret -> ca-secret

kubectl apply -f /home/interview/ca-issuer.yaml

Step 4: Edit Certificate template web-cert.yaml:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: web-cert                 # Fix: my-cert -> web-cert
  namespace: preparesh                # Fix: default -> preparesh
spec:
  secretName: web-cert-tls       # Fix: my-tls -> web-cert-tls
  issuerRef:
    name: ca-issuer              # Fix: my-issuer -> ca-issuer
    kind: Issuer
  dnsNames:                      # Fix: update DNS names
    - web.preparesh.svc
    - web.preparesh.svc.cluster.local

kubectl apply -f /home/interview/web-cert.yaml

Step 5: Verify:

kubectl get clusterissuer selfsigned-issuer
kubectl get issuer ca-issuer -n preparesh
kubectl get certificate -n preparesh
kubectl get secret web-cert-tls -n preparesh