Search code examples
kubernetescertificateharbor

How to set the ssl issuer for Harbor

I have installed https://docs.cert-manager.io/en/release-0.11/reference/clusterissuers.html on my K8S cluster and use it with Nginx ingress controller.

It is working properly with my hello demo service:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-kubernetes-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  rules:
    - host: hello.co.databaker.io
      http:
        paths:
          - backend:
              serviceName: hello-kubernetes-first
              servicePort: 80
  tls:
    - hosts:
        - hello.co.databaker.io
      secretName: hello-kubernetes-tls

But the harbor service does not work: 

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: harbor-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  rules:
    - host: shiphub.co.databaker.io
      http:
        paths:
          - backend:
              serviceName: shiphub-harbor-portal
              servicePort: 80
            path: /
          - backend:
              serviceName: shiphub-harbor-core
              servicePort: 80
            path: /api/
          - backend:
              serviceName: shiphub-harbor-core
              servicePort: 80
            path: /service/
          - backend:
              serviceName: shiphub-harbor-core
              servicePort: 80
            path: /v2/
          - backend:
              serviceName: shiphub-harbor-core
              servicePort: 80
            path: /chartrepo/
          - backend:
              serviceName: shiphub-harbor-core
              servicePort: 80
            path: /c/
    - host: notary.co.databaker.io
      http:
        paths:
          - backend:
              serviceName: shiphub-harbor-notary-server
              servicePort: 4443
            path: /
  tls:
    - hosts:
        - shiphub.co.databaker.io
      secretName: secretName
    - hosts:
        - notary.co.databaker.io
      secretName: secretName

And it shows wrong issuer:

enter image description here

How to set the right issuer?

Solution

  • Please keep in mind, that resource names in Kubernetes needs to be in lower-case:

    secretName

    that's probably causing your issue.