## CA인증서 필요! :: 테스트할 rootca 인증서가 없다면 문서 하단의 "테스트용 ca keypair 발행 방법" 참조

#워크스페이스로 이동
cd ~

#namespace 생성
kubectl create ns cert-manager

#헬름차트 다운로드
helm pull bitnami/cert-manager --untar

cd cert-manager

#cert-manager crd 생성 ($appVersion 교체 후 실행)
#vi Chart.yaml #appVersion 확인
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v$(cat Chart.yaml | yq .appVersion)/cert-manager.crds.yaml

#cert-manager 설치
vi values.yaml #storageClass 등 필요정보 변경
helm install -n cert-manager cert-manager .

k apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
EOF
kubectl get clusterissuers.cert-manager.io #READY=True 확인

#인증서위치에 따라 변경, "테스트용 ca keypair 발행 방법"을 따라 진행했다면 아래 예문 그대로 사용
sudo kubectl create secret tls -n cert-manager ca-key-pair --cert=/etc/ssl/test/v1/rootca.crt --key=/etc/ssl/test/v1/rootca.key

#샘플 참조하여 clusterIssure 생성
kubectl apply -f ClusterIssuer.yaml
kubectl get clusterissuers.cert-manager.io #READY=True 확인

#샘플 참조하여 certificate 생성 (generate-certificate.sh)
#$name, $namespace, $domain을 수정하여 실행함 
#ex: bash generate-certificate.sh test-cert -n harbor harbor.dev.Enterprise Cloud.cld
bash generate-certificate.sh $name $namespace $domain #표준출력으로 yaml 확인 가능
bash generate-certificate.sh $name $namespace $domain | kubectl apply -f - #certificate 생성

#생성된 secret (인가된 tls) 확인
kubectl get certificates.cert-manager.io -n $namespace #READY=True 확인
kubectl get secret #생성된 tls 확인

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: ca-issuer #요청받는 cluster-issuer
    kubernetes.io/ingress.class: nginx
  labels:
    app.kubernetes.io/name: grafana
  name: grafana
  namespace: monitoring
spec:
  ingressClassName: nginx
  rules:
  - host: grafana.fredric.playground.cld
    http:
      paths:
      - backend:
          service:
            name: grafana
            port:
              name: http
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - grafana.fredric.playground.cld
    secretName: grafana.fredric.playground.cld-tls #생성될 certs, secret name

# 10년짜리 ca 인증서 및 issuer 생성
k apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-rootca
  namespace: cert-manager
spec:
  isCA: true
  secretName: selfsigned-rootca
  commonName: SelfSigned CA
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
  duration: 87600h  # 10년
  renewBefore: 360h # 만료 15일 전 갱신 시도
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: rootca-issuer
spec:
  ca:
    secretName: selfsigned-rootca
EOF
#READY=True 확인: rootca-issuer는 좀 걸릴 수 있음.
k get secret,certs,clusterissuers.cert-manager.io -n cert-manager

# 이후 rootCA Issuer를 사용하여 Cert를 생성 & 인그레스 등록.

# rootca pem파일 얻기
secretname=
k get secret -n cert-manager $secretname -o jsonpath='{.data.tls\.crt}' | base64 -d > $secretname.pem

# scp로 로컬로 파일 이동

# 로컬에서 신뢰하기
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $my.pem

# TMI: /etc/hosts 등록 없이 curl 사용 가능
curl -LO https://${domain}/${path}/${upstream_file} \
     --cacert ${cacert} \
     --resolve ${domain}:443:${ip}

# rootca
secretname=
k get secret -n cert-manager $secretname -o jsonpath='{.data.tls\.crt}' | base64 -d > $secretname.pem

# server
domain=
ns=
k get secret -n $ns ${domain}-tls -o jsonpath='{.data.tls\.crt}' | base64 -d > ${ns}-${domain}-tls.pem

app=
ns=
openssl pkcs12 -export \
  -in <(k get secret -n $ns ${app}-client-cert -o jsonpath='{.data.tls\.crt}' | base64 -d) \
  -inkey <(k get secret -n $ns ${app}-client-cert -o jsonpath='{.data.tls\.key}' | base64 -d) \
  -certfile <(k get secret -n cert-manager selfsigned-rootca -o jsonpath='{.data.tls\.crt}' | base64 -d) \
  -out ${ns}-${app}-client.p12 \
  -name "${ns}-${app} mTLS Client Cert"

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $my.pem