SSL Certificate renewal automation with cert-manager

1. Download the GPG key so you can verify the signature of the helm chart

 curl -LO https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg

2. Install cert-manager with helm:

 helm install \
   cert-manager oci://quay.io/jetstack/charts/cert-manager \
   --version v1.21.3 \
   --namespace cert-manager \
   --create-namespace \
   --verify \
   --keyring ./cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg \
   --set crds.enabled=true

3. Create a secret for the HMAC value

 kubectl create secret generic NAME_OF_SECRET --from-literal secret=HMAC_VALUE -n cert-manager

NOTE: You should keep your HMAC secret, so maybe wrap this in a script!

4. Create a YAML file containing the details for your issuer

 apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: NAME_OF_MY_ISSUER
   spec:
     acme:
       email: me@mydomain.com
       server: https://ca_url.com
       externalAccountBinding:
         keyID: YOUR_KID_VALUE
         keySecretRef:
           name: NAME_OF_SECRET
           key: secret
       privateKeySecretRef:
         name: SOME_NAME_FOR_PRIVATE_KEY_REF
       solvers:

Set you own values for the parameters in bold.

5. Create the issuer

 kubectl apply -f file_from_step_4.yaml

6. Create a YAML file containing the details for your certificate

 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: some_metadata_name
   namespace: namespace_where_certificate_should_live
 spec:
   secretName: some_name_for_the_tle_cert_secret
   issuerRef:
     name:  NAME_OF_MY_ISSUER
     kind: ClusterIssuer
   commonName: mydomain.com
   dnsNames:
   - san.mydomain.com
   - san2.mydomain.com

NOTE: Obviously, the dnsNames section is only relevant for multi-domain certificates with SANs

7. Create the SSL certificate secret

 kubectl apply -f name_of_file_from_step_6.yaml