Credits: https://www.openshift.com/blog/requesting-and-installing-lets-encrypt-certificates-for-openshift-4

Prerequisites

Create AWS credentials as described in the previous article. Replace the values accordingly.

$ cat << EOF > aws.credentials
#!/bin/bash
export AWS_ACCESS_KEY_ID=REPLACE_AWSACCESSKEYID
export AWS_SECRET_ACCESS_KEY=REPLACE_AWSSECRETACCESSKEY
EOF

$ source aws.credentials
$

Make sure you are logged in to the cluster.

$ export KUBECONFIG=${PWD}/config/auth/kubeconfig
$ oc get node
NAME                                         STATUS   ROLES    AGE   VERSION
ip-10-0-128-29.eu-west-1.compute.internal    Ready    worker   68m   v1.17.1
ip-10-0-140-213.eu-west-1.compute.internal   Ready    master   78m   v1.17.1
ip-10-0-149-203.eu-west-1.compute.internal   Ready    master   77m   v1.17.1
ip-10-0-150-180.eu-west-1.compute.internal   Ready    worker   68m   v1.17.1
ip-10-0-169-24.eu-west-1.compute.internal    Ready    worker   68m   v1.17.1
ip-10-0-175-121.eu-west-1.compute.internal   Ready    master   78m   v1.17.1
$ oc whoami
system:admin
$

Clone acme.sh github repo.

$ git clone https://github.com/neilpang/acme.sh

Set LE_API and LE_WILDCARD variables to values of api fqdn and wildcard domain.

$ export LE_API=$(oc whoami --show-server | cut -f 2 -d ':' | cut -f 3 -d '/' | sed 's/-api././')
$ export LE_WILDCARD=$(oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.status.domain}')
$ env | grep LE_
LE_API=api.demo.okd.agolis.xyz
LE_WILDCARD=apps.demo.okd.agolis.xyz
$

Request and install certificates

Request certificates.

$ ./acme.sh/acme.sh --issue -d ${LE_API} -d \*.${LE_WILDCARD} --dns dns_aws
...snip...
[Mon Jun 15 14:01:07 CEST 2020] Your cert is in  ~/.acme.sh/api.demo.okd.agolis.xyz/api.demo.okd.agolis.xyz.cer
[Mon Jun 15 14:01:07 CEST 2020] Your cert key is in  ~/.acme.sh/api.demo.okd.agolis.xyz/api.demo.okd.agolis.xyz.key
[Mon Jun 15 14:01:07 CEST 2020] The intermediate CA cert is in  ~/.acme.sh/api.demo.okd.agolis.xyz/ca.cer
[Mon Jun 15 14:01:07 CEST 2020] And the full chain certs is there:  ~/.acme.sh/api.demo.okd.agolis.xyz/fullchain.cer
$

Save them into the working directory.

$ export CERTDIR=./certificates
$ mkdir -p ${CERTDIR}
$ ./acme.sh/acme.sh --install-cert -d ${LE_API} -d \*.${LE_WILDCARD} --cert-file ${CERTDIR}/cert.pem --key-file ${CERTDIR}/key.pem --fullchain-file ${CERTDIR}/fullchain.pem --ca-file ${CERTDIR}/ca.cer
[Mon Jun 15 14:02:31 CEST 2020] Installing cert to:./certificates/cert.pem
[Mon Jun 15 14:02:31 CEST 2020] Installing CA to:./certificates/ca.cer
[Mon Jun 15 14:02:31 CEST 2020] Installing key to:./certificates/key.pem
[Mon Jun 15 14:02:31 CEST 2020] Installing full chain to:./certificates/fullchain.pem
$

Install the certificates by using custom secret and updating ingresscontroller CRD.

$ oc create secret tls router-certs --cert=${CERTDIR}/fullchain.pem --key=${CERTDIR}/key.pem -n openshift-ingress
secret/router-certs created
$ oc patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch='{"spec": { "defaultCertificate": { "name": "router-certs" }}}'
ingresscontroller.operator.openshift.io/default patched
$

Watch the new pods to rollout

$ oc get po -w -n openshift-ingress
NAME                              READY   STATUS    RESTARTS   AGE
router-default-766f78647f-4tmtg   1/1     Running   0          108m
router-default-766f78647f-wmtzk   1/1     Running   0          109m
router-default-7b95578747-gzljm   0/1     Running   0          9s
router-default-7b95578747-gzljm   1/1     Running   0          16s
router-default-766f78647f-wmtzk   1/1     Terminating   0          109m
router-default-7b95578747-8t9nk   0/1     Pending       0          0s
router-default-7b95578747-8t9nk   0/1     Pending       0          0s
router-default-7b95578747-8t9nk   0/1     ContainerCreating   0          0s
router-default-7b95578747-8t9nk   0/1     ContainerCreating   0          0s
router-default-7b95578747-8t9nk   0/1     ContainerCreating   0          2s
router-default-7b95578747-8t9nk   0/1     Running             0          3s
router-default-7b95578747-8t9nk   1/1     Running             0          14s
router-default-766f78647f-4tmtg   1/1     Terminating         0          109m
router-default-766f78647f-wmtzk   0/1     Terminating         0          109m
^C
$

Resources