Skip to content

Commit d3beac8

Browse files
author
Katie Horne
committed
Lint; fix typos
1 parent a54c2f4 commit d3beac8

File tree

3 files changed

+141
-132
lines changed

3 files changed

+141
-132
lines changed

‎guides/ssl-certificates/azureDNS.md

+107-102
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
title: Azure DNS
3-
description: Learn how to use cert-manager to set up SSL certificates using Azure DNS for DNS01 challenges.
3+
description:
4+
Learn how to use cert-manager to set up SSL certificates using Azure DNS for
5+
DNS01 challenges.
46
---
57

68
[cert-manager](https://cert-manager.io/) allows you to enable HTTPS on your
@@ -13,8 +15,8 @@ cluster to issue Let's Encrypt certificates for your Coder installation so that
1315
you can enable HTTPS on your Coder deployment. It will also show you how to
1416
configure your Coder hostname and dev URLs.
1517

16-
There are three available methods to configuring the Azure DNS DNS01 Challenge via
17-
cert-manager:
18+
There are three available methods to configuring the Azure DNS DNS01 Challenge
19+
via cert-manager:
1820

1921
- [Managed Identity Using AAD Pod Identities](#step-1:-set-up-a-managed-identity)
2022
- [Managed Identity Using AKS Kubelet Identity](https://cert-manager.io/docs/configuration/acme/dns01/azuredns/#managed-identity-using-aks-kubelet-identity)
@@ -31,20 +33,24 @@ are the same regardless of which option you choose.
3133

3234
You must have:
3335

34-
- A Kubernetes cluster [of a supported version](https://kubernetes.io/releases/version-skew-policy/#supported-version-skew) with internet connectivity
36+
- A Kubernetes cluster
37+
[of a supported version](../../setup/kubernetes/index.md#supported-kubernetes-versions)
38+
with internet connectivity
3539
- Installed [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
36-
- Installed [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest)
40+
- Installed
41+
[Azure CLI](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest)
3742

3843
You should also:
3944

4045
- Be a cluster admin
4146
- Have access to your DNS provider
42-
- Have a paid Azure account that allows you to access [Azure DNS](https://azure.microsoft.com/en-us/services/dns/)
47+
- Have a paid Azure account that allows you to access
48+
[Azure DNS](https://azure.microsoft.com/en-us/services/dns/)
4349

4450
## Step 1: Create an Azure DNS Zone
4551

4652
Log into the [Azure Portal](portal.azure.com). Using the search bar, look for
47-
**DNS Zones** and navigate to this service.
53+
**DNS Zones** and navigate to this service.
4854

4955
If Azure DNS is the registrar for your domain, the zone will already exist so
5056
you can skip to Step 3.
@@ -56,8 +62,8 @@ Click **New** to create a new zone, and when prompted:
5662

5763
1. Provide a **name** for your new zone
5864

59-
Click **Review + create**. Review the summary information, and if
60-
it's correct, click **Create** to proceed.
65+
Click **Review + create**. Review the summary information, and if it's correct,
66+
click **Create** to proceed.
6167

6268
Once Azure has deployed your resource, click **Go to resource**. Make a note of
6369
the name server records (e.g., `ns1-09.azure-dns.com.`) presented to you, since
@@ -74,7 +80,7 @@ the domain you're using for your Coder deployment.
7480
cert-manager:
7581

7682
```console
77-
$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml
83+
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml
7884
```
7985

8086
1. Check that cert-manager installs correctly by running
@@ -127,111 +133,110 @@ az role assignment create --role "DNS Zone Contributor" --assignee $PRINCIPAL_ID
127133

128134
1. Export the following environment variables with your own values:
129135

130-
```console
131-
export SUBSCRIPTION_ID="05e8b285-4ce1-46a3-b4c9-f51ba67d6acc"
132-
export RESOURCE_GROUP="workshop-202103"
133-
export CLUSTER_NAME="coder-workshop-202103"
134-
```
135-
136-
Subscription ID comes from your Azure subscription.
137-
Resource group should be set to the resource group that owns the cluster.
138-
Cluster name is the name Azure uses to refer to the prereq kubernetes cluster.
136+
```console
137+
export SUBSCRIPTION_ID="05e8b285-4ce1-46a3-b4c9-f51ba67d6acc"
138+
export RESOURCE_GROUP="workshop-202103"
139+
export CLUSTER_NAME="coder-workshop-202103"
140+
```
141+
142+
The **subscription ID** comes from your Azure subscription. The **resource
143+
group** should be set to the resource group that owns the cluster. The
144+
**cluster name** is the name Azure uses to refer to the required Kubernetes
145+
cluster.
139146

140147
1. Deploy the AAD Pod Identity components to an RBAC-enabled cluster:
141148

142-
```console
143-
kubectl apply -f https://raw.githubusercontent.com/Azure/ aad-pod-identity/master/deploy/infra/deployment-rbac.yaml
149+
```console
150+
kubectl apply -f https://raw.githubusercontent.com/Azure/ aad-pod-identity/master/deploy/infra/deployment-rbac.yaml
144151

145-
# For AKS clusters, deploy the MIC and AKS add-on exception by running the following
146-
kubectl apply -f https://raw.githubusercontent.com/Azure/ aad-pod-identity/master/deploy/infra/mic-exception.yaml
147-
```
152+
# For AKS clusters, deploy the MIC and AKS add-on exception by running the following
153+
kubectl apply -f https://raw.githubusercontent.com/Azure/ aad-pod-identity/master/deploy/infra/mic-exception.yaml
154+
```
148155

149-
> If you're using a non-RBAC cluster, remove the `-rbac` flag from the initial
150-
> command
156+
> If you're using a non-RBAC cluster, remove the `-rbac` flag from the
157+
> initial command
151158
152159
1. Deploy AzureIdentity and AzureIdentityBinding. To do so, create an
153-
`azureId.yaml` file using the template below to deploy the custom resources
154-
required to assign the identity:
155-
156-
```yaml
157-
apiVersion: "aadpodidentity.k8s.io/v1"
158-
kind: AzureIdentity
159-
metadata:
160-
annotations:
161-
# We recommend using namespaced identities https://azure.github.io/ aad-pod-identity/docs/configure/match_pods_in_namespace/
162-
aadpodidentity.k8s.io/Behavior: namespaced
163-
name: certman-identity
164-
namespace: cert-manager # Change to your preferred namespace
165-
spec:
166-
type: 0 # MSI
167-
resourceID: <Identity_Id> # Resource ID From Previous step
168-
clientID: <Client_Id> # Client ID from previous step
169-
---
170-
apiVersion: "aadpodidentity.k8s.io/v1"
171-
kind: AzureIdentityBinding
172-
metadata:
173-
name: certman-id-binding
174-
namespace: cert-manager # Change to your preferred namespace
175-
spec:
176-
azureIdentity: certman-identity
177-
selector: certman-label # The label that needs to be set on cert-manager pods
178-
```
160+
`azureId.yaml` file using the template below to deploy the custom resources
161+
required to assign the identity:
162+
163+
```yaml
164+
apiVersion: "aadpodidentity.k8s.io/v1"
165+
kind: AzureIdentity
166+
metadata:
167+
annotations:
168+
# We recommend using namespaced identities https://azure.github.io/ aad-pod-identity/docs/configure/match_pods_in_namespace/
169+
aadpodidentity.k8s.io/Behavior: namespaced
170+
name: certman-identity
171+
namespace: cert-manager # Change to your preferred namespace
172+
spec:
173+
type: 0 # MSI
174+
resourceID: <Identity_Id> # Resource ID From Previous step
175+
clientID: <Client_Id> # Client ID from previous step
176+
---
177+
apiVersion: "aadpodidentity.k8s.io/v1"
178+
kind: AzureIdentityBinding
179+
metadata:
180+
name: certman-id-binding
181+
namespace: cert-manager # Change to your preferred namespace
182+
spec:
183+
azureIdentity: certman-identity
184+
selector: certman-label # The label that needs to be set on cert-manager pods
185+
```
179186
180187
1. Apply the `azureId.yaml` file:
181188

182-
```console
183-
kubectl apply -f azureId.yaml
184-
```
189+
```console
190+
kubectl apply -f azureId.yaml
191+
```
185192

186193
1. Set the pod identity label on the cert-manager pod:
187194

188-
```yaml
189-
spec:
190-
template:
191-
metadata:
192-
labels:
193-
aadpodidbinding: certman-label # must match selector in AzureIdentityBinding
194-
```
195-
196-
This label tells the cluster which pods are allowed to use the IAM
197-
role specified earlier. For our puropses, we want the cert-manager pod
198-
to be able to set the DNS records for dns01 challenges. The side-effect
199-
is that any pod with that label will be able to change DNS settings in
200-
the authorized zone.
195+
```yaml
196+
spec:
197+
template:
198+
metadata:
199+
labels:
200+
aadpodidbinding: certman-label # must match selector in AzureIdentityBinding
201+
```
202+
203+
This label tells the cluster which pods are allowed to use the IAM role
204+
specified earlier. For our purposes, we want the cert-manager pod to be able
205+
to set the DNS records for dns01 challenges. The side effect is that any pod
206+
with that label will be able to change DNS settings in the authorized zone.
201207

202208
## Step 6: Create the ACME Issuer
203209

204210
1. Create a file called `letsencrypt.yaml` (you can name it whatever you'd like)
205-
to specify the `hostedZoneName`, `resourceGroupName` and `subscriptionID` fields
206-
for the DNS Zone:
207-
208-
```yaml
209-
apiVersion: cert-manager.io/v1
210-
kind: ClusterIssuer
211-
metadata:
212-
name: letsencrypt
213-
spec:
214-
acme:
215-
email: user@example.com
216-
server: https://acme-v02.api.letsencrypt.org/directory
217-
privateKeySecretRef:
218-
name: example-issuer-account-key
219-
solvers:
220-
- selector:
221-
dnsZones:
222-
- # Your Azure DNS Zone
223-
dns01:
224-
azureDNS:
225-
subscriptionID: SUBSCRIPTION_ID
226-
resourceGroupName: RESOURCE_GROUP
227-
hostedZoneName: ZONE_ID
228-
# Azure Cloud Environment, default to AzurePublicCloud
229-
environment: AzurePublicCloud
230-
```
231-
232-
More information on the values in the yaml file above can be found in [the dns01
233-
solver configuration documentation](https://cert-manager.io/docs/configuration/acme/dns01/)
211+
to specify the `hostedZoneName`, `resourceGroupName` and `subscriptionID`
212+
fields for the DNS Zone:
213+
214+
```yaml
215+
apiVersion: cert-manager.io/v1
216+
kind: ClusterIssuer
217+
metadata:
218+
name: letsencrypt
219+
spec:
220+
acme:
221+
email: user@example.com
222+
server: https://acme-v02.api.letsencrypt.org/directory
223+
privateKeySecretRef:
224+
name: example-issuer-account-key
225+
solvers:
226+
- selector:
227+
dnsZones:
228+
- # Your Azure DNS Zone
229+
dns01:
230+
azureDNS:
231+
subscriptionID: SUBSCRIPTION_ID
232+
resourceGroupName: RESOURCE_GROUP
233+
hostedZoneName: ZONE_ID
234+
# Azure Cloud Environment, default to AzurePublicCloud
235+
environment: AzurePublicCloud
236+
```
234237

238+
More information on the values in the YAML file above can be found in
239+
[the dns01 solver configuration documentation](https://cert-manager.io/docs/configuration/acme/dns01/).
235240

236241
1. Apply your configuration changes:
237242

@@ -263,9 +268,9 @@ helm install coder coder/coder --namespace coder \
263268
--wait
264269
```
265270

266-
The `hostSecretName` and `devurlsHostSecretName` are abritrary strings
267-
that you should set to some value that does not conflict with any other
268-
secrets in the Coder namespace.
271+
The `hostSecretName` and `devurlsHostSecretName` are arbitrary strings that you
272+
should set to some value that does not conflict with any other secrets in the
273+
Coder namespace.
269274

270275
There are also a few additional steps to make sure that your hostname and dev
271276
URLs work.
@@ -280,8 +285,8 @@ URLs work.
280285

281286
1. Return to Azure and go to **DNS zones**.
282287

283-
1. Create a new record for your hostname; provide `coder` as the record name, and
284-
paste the external IP as the `value`. Save.
288+
1. Create a new record for your hostname; provide `coder` as the record name,
289+
and paste the external IP as the `value`. Save.
285290

286291
1. Create another record for your dev URLs: set it to `*.dev.exampleCo` or
287292
similar and use the same external IP as the previous step for `value`. Save.

‎guides/ssl-certificates/cloudflare.md

+16-14
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,19 @@ you can enable HTTPS on your Coder deployment.
2222

2323
You must have:
2424

25-
- A Kubernetes cluster [of a supported version](https://kubernetes.io/releases/version-skew-policy/#supported-version-skew) with internet connectivity
26-
- kubectl matching cluster version
25+
- A Kubernetes cluster
26+
[of a supported version](../../setup/kubernetes/index.md#supported-kubernetes-versions)
27+
with internet connectivity
28+
- Installed [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
2729

2830
## Step 1: Add cert-manager to your Kubernetes cluster
2931

3032
```console
31-
$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml
33+
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml
3234
```
3335

34-
More specifics can be found in the [cert-manager install documentation](https://cert-manager.io/docs/installation/kubernetes/#installing-with-regular-manifests).
36+
More specifics can be found in the
37+
[cert-manager install documentation](https://cert-manager.io/docs/installation/kubernetes/#installing-with-regular-manifests).
3538

3639
Once you've started the installation process, you can verify that all the pods
3740
are running:
@@ -121,8 +124,8 @@ spec:
121124
- "example.com"
122125
```
123126
124-
More information on the values in the yaml file above can be found in [the dns01
125-
solver configuration documentation](https://cert-manager.io/docs/configuration/acme/dns01/)
127+
More information on the values in the YAML file above can be found in
128+
[the dns01 solver configuration documentation](https://cert-manager.io/docs/configuration/acme/dns01/).
126129
127130
### ClusterIssuers
128131
@@ -135,8 +138,7 @@ following changes:
135138
- Change the namespace of the secret to **cert-manager**
136139
- Change the kind of the **Issuer** to **ClusterIssuer**
137140
- Remove the namespace of the **ClusterIssuer**
138-
- Change the annotations to
139-
`cert-manager.io/cluster-issuer: "letsencrypt"`
141+
- Change the annotations to `cert-manager.io/cluster-issuer: "letsencrypt"`
140142

141143
For further information, see
142144
[Setting Up Issuers](https://docs.cert-manager.io/en/release-0.8/tasks/issuers/index.html).
@@ -176,11 +178,11 @@ devurls:
176178
host: "*.coder.example.com"
177179
```
178180

179-
The `hostSecretName` and `devurlsHostSecretName` are abritrary strings
180-
that you should set to some value that does not conflict with any other
181-
secrets in the Coder namespace.
181+
The `hostSecretName` and `devurlsHostSecretName` are arbitrary strings that you
182+
should set to some value that does not conflict with any other secrets in the
183+
Coder namespace.
182184

183185
Be sure to redeploy Coder after changing your Helm values. If, after
184-
redeploying, you're not getting a valid certificate, see [cert-manager's
185-
troubleshooting guide](https://cert-manager.io/docs/faq/acme/) for additional
186-
assistance.
186+
redeploying, you're not getting a valid certificate, see
187+
[cert-manager's troubleshooting guide](https://cert-manager.io/docs/faq/acme/)
188+
for additional assistance.

0 commit comments

Comments
 (0)