openshift-acme is ACME Controller for OpenShift and Kubernetes clusters. It will automatically provision certificates using the ACME v2 protocol (RFC 8555) and manage their lifecycle including automatic renewals.
This is a fork. Upstream
tnozicka/openshift-acmehas been archived since 2023.gordon-code/openshift-acmemodernizes it for OpenShift 4.22 (Kubernetes 1.35). Controller and exposer images are published toghcr.io/gordon-code/openshift-acme-controllerandghcr.io/gordon-code/openshift-acme-exposer.
The controller is provider independent but to start with we would recommend you to use Let's Encrypt (https://letsencrypt.org). For more information checkout section Deploy.)
Once openshift-acme controller is running on your cluster all you have to do is annotate your Route or other supported object like this:
metadata:
annotations:
kubernetes.io/tls-acme: "true"openshift-acme provides multiple options to deploy the controller so you can deploy it even as a regular user in a shared cluster only for specific namespaces you have access to. We intentionally avoid using CRDs which require system:admin privileges.
We have created deployments to get you started in just a few seconds. (But feel free to create one that suits your needs.)
Let's encrypt provides two environments: live and staging. The environment is chosen based on the issuer ConfigMap that is created.
staging is meant for testing the controller or making sure you can try it out without the fear or exhausting your rate limits and it will provide you with certificates signed by Let's Encrypt staging CA making the certs not trusted!
live will provide you with trusted certificates but has lower rate limits. This is what you want when you're done testing/evaluating the controller
openshift-acme implements the ACME v2 protocol (RFC 8555) only; there is no ACME v1 support or legacy image in this fork.
OpenShift Routes are fully supported.
If you annotate your Route with "acme.openshift.io/secret-name": "<secret_name>", the controller will synchronize the Route certificates into a Secret so you can use SSL in the passthrough mode and mount the secret into pods.
- Advanced rate limiting (there is now support for basic rate limits)
- Ingress (and Kubernetes) support
- DNS validation support
- CertificateRequests objects (when not using http-01 validation you don't need a Route)
- Operator managing the deployment and upgrades