Installing cert-manager webhook for OCI and Let's Encrypt ClusterIssuer on an OKE cluster
Published: 2023-01-29 01:57:13

---
title: Installing cert-manager webhook for OCI and  Let's Encrypt ClusterIssuer on an OKE cluster
published: true
date: 2023-01-24 02:00:45 UTC
tags: 
canonical_url: https://blog.cloudmonk.me/installing-cert-manager-webhook-for-oci-and-lets-encrypt-clusterissuer-on-an-oke-cluster
---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1674523413659/7cdd6e05-69c9-402a-9a5f-c6914e85ec7b.png)

If you're an operator maintaining a footprint of [Kubernetes](https://kubernetes.io/) clusters, then you already know that there's more to provisioning and granting access to a cluster. For a cluster to be useful for an end consumer an operator will usually install, enable and configure several other components. One such component is [cert-manager](https://cert-manager.io/). Its purpose is to issue certificates from a variety of supported sources. Consulting the [docs](https://cert-manager.io/docs/), you might learn about the [ACME issuer type](https://cert-manager.io/docs/configuration/acme/) and the [DNS01 challenge validation](https://cert-manager.io/docs/configuration/acme/dns01/) method. Then depending on your [IaaS](https://www.gartner.com/en/information-technology/glossary/infrastructure-as-a-service-iaas) requirements, you will find a limited set of [supported providers](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and [webhooks](https://cert-manager.io/docs/configuration/acme/dns01/#webhook).

And now we come to the reason why I'm writing this post. If you're contemplating installing cert-manager an [OKE](https://www.oracle.com/cloud/cloud-native/container-engine-kubernetes/) cluster on [OCI](https://www.oracle.com/cloud/), you'll want to employ a webhook. However, it is not as straightforward as you might think. Uninitiated, you might visit [this link](https://gitlab.com/dn13/cert-manager-webhook-oci) and follow the instructions to install it. The implementation has not kept up with the API changes over successive releases of cert-manager. So, you would be forced to install a pre-v1.x version of cert-manager. Not a great option as you'd be left open to many security vulnerabilities. I want to share how I built, tested and published an up-to-date version of the aftermentioned, [here](https://github.com/pacphi/cert-manager-webhook-oci).

## Upgrading the implementation

I decided to target [compatibility](https://cert-manager.io/docs/installation/supported-releases/) with cert-manager v1.10 or better, so that the updated webhook would be functional on Kubernetes clusters, versions 1.20 through 1.26.

As I reviewed the Gitlab repository where the original webhook implementation and Helm chart reside, I noticed that another developer had made an effort to upgrade the webhook to be compatible with cert-manager 1.8 in this [fork](https://gitlab.com/jcotton/cert-manager-webhook-oci/-/tree/fix_and_update). So, I cloned that fork and began to make updates.

I upgraded the [Golang](https://go.dev/) version in `go.mod` to 1.19 and decided to target Kubernetes version 1.24 in `Makefile`. I also updated the args in `Dockerfile` to be

```python
ARG GOLANG_VERSION=1.19.4
ARG ALPINE_VERSION=3.17

```

First, I upgraded the libraries

```bash
go get -u all
go mod tidy

```

Then, I attempted to build the container image that would be employed by the Helm chart.

```bash
docker build -t pacphi/cert-manager-webhook-oci .

```

Where to host this image? In a public container image registry repository. I chose an [OCI registry](https://www.oracle.com/webfolder/technetwork/tutorials/obe/oci/registry/index.html) instead of [Dockerhub](https://hub.docker.com/) because I (and others who might want to consume my pre-built image) won't get [rate-limited](https://docs.docker.com/docker-hub/download-rate-limit/) on image pull requests.

Lastly, I authored a [BaSH](https://www.gnu.org/software/bash/) [script](https://github.com/pacphi/cert-manager-webhook-oci/blob/main/scripts/prepare-cert-manager-webhook-oci.sh) to help me remember the sequence of steps to create a repo (if it doesn't already exist), build and tag the image, obtain an auth token, authenticate to the registry, and finally push the image.

## Inspecting the image

I put myself in the shoes of a potential consumer. Could they successfully pull the image with no authentication credentials from the public repository I had just created? And how might they learn about what's truly inside the image?

To pull the image, they'd execute

```bash
docker pull phx.ocir.io/axyd58snjxbf/cert-manager-webhook-oci:latest

```

To explore the layers of the image, they could use [dive](https://github.com/wagoodman/dive)

```bash
dive phx.ocir.io/axyd58snjxbf/cert-manager-webhook-oci:latest

```

## Upgrading the Helm chart

The chart configuration required only one update. In [apiservice.yaml](https://github.com/pacphi/cert-manager-webhook-oci/blob/main/deploy/cert-manager-webhook-oci/templates/apiservice.yaml), I needed to revert all occurrences of `v1` back to `v1alpha`. Why? The `acme.d-n.be` apiservice is not discoverable otherwise.

## Installing and uninstalling the Helm chart

Instructions in the [README](https://gitlab.com/dn13/cert-manager-webhook-oci/-/blob/develop/README.md) of the original repository left much to be desired. So, I authored another BaSH [script](https://github.com/pacphi/cert-manager-webhook-oci/blob/main/scripts/install-cert-manager-webhook-oci.sh) to help me consistently install the prerequisites and the webhook itself. And what about teardown? There's a [script](https://github.com/pacphi/cert-manager-webhook-oci/blob/main/scripts/uninstall-cert-manager-webhook-oci.sh) for that too.

## Testing it out

Before you can leverage the install and uninstall scripts, you'll need to:

\* [add a DNS zone](https://docs.oracle.com/en-us/iaas/Content/DNS/Tasks/managingdnszones.htm) in OCI  
\* [add a VCN](https://docs.oracle.com/en/learn/lab_virtual_network/index.html#introduction) in OCI  
\* provision a cluster  
\* update the install script's environment variables

> That last bullet I might improve upon soon so that you don't need to edit the script itself.

Here's a fast and inexpensive way to test

```bash
#! Create a single-node cluster on your workstation with kind; @see https://kind.sigs.k8s.io/
kind create cluster
#! Setup access to your Oracle Cloud Infastructure account
oci setup config
#! Clone the repo where the updated webhook implementation resides
git clone https://github.com/paphi/cert-manager-webhook-oci
#! Change directories into the scripts directory
cd cert-manager-webhook-oci/scripts
#! Edit and save updates to install-cert-manager-webhook-oci.sh
#! Then run this script to install
./install-cert-manager-webhook-oci.sh
#! To validate the installation...
kubectl get pods -A
kubectl get apiservice | grep acme.d-n.be
kubectl get clusterissuer
kubectl get cert -A
kubectl get secret -A
#! To uninstall, run this script
./uninstall-cert-manager-webhook-oci.sh
#! To destroy the cluster
kind delete cluster

```

But if you want to test this out against an OKE cluster, you could follow [this tutorial](https://www.oracle.com/webfolder/technetwork/tutorials/obe/oci/oke-full/index.html).