Red Hat OpenShift Container Platform

Configuring an ACME issuer by using explicit credentials for Google Cloud DNS

You can use the cert-manager Operator for Red Hat OpenShift to set up an ACME issuer to solve DNS-01 challenges by using explicit credentials on Google Cloud. This procedure uses Let’s Encrypt as the ACME CA server and shows how to solve DNS-01 challenges with Google Cloud DNS.

Prerequisites

You have set up a Google Cloud service account with a desired role for Google Cloud DNS.

You can use Google Cloud DNS with explicit credentials in an Red Hat OpenShift Container Platform cluster that is not running on Google Cloud.

Procedure

Optional: Override the name server settings for the DNS-01 self check.

This step is required only when the target public-hosted zone overlaps with the cluster’s default private-hosted zone.
1. Edit the CertManager resource by running the following command:
  $ oc edit certmanager cluster
2. Add a spec.controllerConfig section with the following override arguments:
  apiVersion: operator.openshift.io/v1alpha1 kind: CertManager metadata: name: cluster ... spec: ... controllerConfig: overrideArgs: - '--dns01-recursive-nameservers-only' - '--dns01-recursive-nameservers=1.1.1.1:53'
  where:
  
  --dns01-recursive-nameservers-only
  
  Specifies recursive name servers instead of checking the authoritative name servers associated with that domain.
  
  --dns01-recursive-nameservers=1.1.1.1:53
  
  Specifies a comma-separated list of <host>:<port> name servers to query for the DNS-01 self check. You must use a 1.1.1.1:53 value to avoid the public and private zones overlapping.
3. Save the file to apply the changes.
Optional: Create a namespace for the issuer:
```
$ oc new-project my-issuer-namespace
```

Create a secret to store your Google Cloud credentials by running the following command:

$ oc create secret generic clouddns-dns01-solver-svc-acct --from-file=service_account.json=<path/to/gcp_service_account.json> -n my-issuer-namespace

Create an issuer:
1. Create a YAML file, for example, issuer.yaml, that defines the Issuer object:
  apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: <acme_dns01_clouddns_issuer> namespace: <issuer_namespace> spec: acme: preferredChain: "" privateKeySecretRef: name: <secret_private_key> server: <server> solvers: - dns01: cloudDNS: project: <project_id> serviceAccountSecretRef: name: <secret> key: <service_account.json>
  where:
  
  <acme_dns01_clouddns_issuer>
  
  Specifies a name for the issuer.
  
  <issuer_namespace>
  
  Specifies your issuer namespace.
  
  <secret_private_key>
  
  Specifies the name of the secret to store the ACME account private key in.
  
  <server>
  
  Specifies the URL to access the ACME server’s directory endpoint. This example uses the Let’s Encrypt staging environment.
  
  <project_id>
  
  Specifies the name of the Google Cloud project that contains the Cloud DNS zone.
  
  <secret>
  
  Specifies the name of the secret you created.
  
  <service_account.json>
  
  Specifies the key in the secret you created that stores your Google Cloud secret access key.
2. Create the Issuer object by running the following command:
  $ oc create -f issuer.yaml