cat > vaules.yaml << EOF
server:
  ingress:
    enabled: true
    ingressClassName: "nginx"
    hosts:
      - host: vault.onwalk.net
        paths:
          - /
    tls:
      - secretName: vault-tls
        hosts:
          - vault.onwalk.net
EOF
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo up
kubectl create ns vault || echo true
kubectl create secret tls vault-tls  --key=/etc/ssl/onwalk.net.key --cert=/etc/ssl/onwalk.net.pem -n vault
helm upgrade --install vault-server hashicorp/vault -n vault --create-namespace -f vaules.yaml

kubectl exec -t -i vault-server-0 -n vault -- sh -c "vault operator init -key-shares=5 -key-threshold=3"

Unseal Key 1: jHeA/olf6URrxshlYqceyuRy8NMx8ICVWaolxfSnRvi+
Unseal Key 2: iAozcZmwczQpkoRwWUm7UO2yi2Ou0dtmsWREyXGaqiIH
Unseal Key 3: 28XG9Gmk/GN3rBJtNhK97dmlLY9jWO9VINAFY+d4lJZe
Unseal Key 4: U4/sW5k+FkIrgnHdBxZUnlg+SU7VRArKkb2Yfjx3qBjz
Unseal Key 5: LN3bp6kkwkeoYCoE7DZ7Y7QQCZPQ7N6NjsIo2PquwgUD
Initial Root Token: s.KJmwUJcHJMF6cUNwhJQpAaAY

NAME                                           READY   STATUS    RESTARTS   AGE

vault-server-agent-injector-59bd55cb5f-kdcr4   1/1     Running   0          25m

vault-server-0                                 1/1     Running   0          17m

name: Renew SSL Certs

on:

pull_request:

push:

paths:

- '.github/workflows/app-pipeline-renew-ssl-cert.yml'

workflow_dispatch:

branches:

- main

schedule:

- cron: '0 0 1 */2 *'  # 每两个月的第一天执行
jobs:

renew-ssl-certs:

uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-renew-ssl-certs.yml@main

with:

domain: 'onwalk.net'

secrets:

DNS_AK: ${{ secrets.DNS_AK }}

DNS_SK: ${{ secrets.DNS_SK }}

VAULT_URL: ${{ secrets.VAULT_URL }}

VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}

name: Workflow Call Renew SSL Certs

on:

workflow_call:

inputs:

domain:

required: true

type: string

secrets:

DNS_AK:

required: true

DNS_SK:

required: true

VAULT_URL:

required: true

VAULT_TOKEN:

required: true

jobs:

renew-ssl-certs:

runs-on: ubuntu-latest

env:

DOMAIN: ${{ inputs.domain }}

DNS_AK: ${{ secrets.DNS_AK }}

DNS_SK: ${{ secrets.DNS_SK }}

VAULT_URL: ${{ secrets.VAULT_URL }}

VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
steps:
  - name: Checkout code
    uses: actions/checkout@v3
    with:
      submodules: 'recursive'

  - name: Pre Setup
    run: |
      curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
      sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
      sudo apt-get update && sudo apt-get install vault -y

  - name: Renew SSL Cert
    run: |
      set -x

      # 检查参数是否为空
      check_not_empty() {
        if [[ -z $1 ]]; then
          echo "Error: $2 is empty. Please provide a value."
          exit 1
        fi
      }
      # 检查参数是否为空
      check_not_empty "$DNS_AK" "DNS_AK" && export Ali_Key=$DNS_AK
      check_not_empty "$DNS_SK" "DNS_SK" && export Ali_Secret=$DNS_SK
      check_not_empty "$VAULT_URL" "VAULT_URL"

      rm -fv ${DOMAIN}.key ${DOMAIN}.pem -f
      rm -fv /etc/ssl/${DOMAIN}.* -f
      # Try to issue a certificate from ZeroSSL. If it fails, try Let's Encrypt.
      curl https://get.acme.sh | sh -s email=156405189@qq.com
      sh ~/.acme.sh/acme.sh --set-default-ca --server zerossl --issue --force --dns dns_ali -d ${DOMAIN} -d "*.${DOMAIN}"
      if [ $? -eq 0 ]; then
          echo "Certificate from letsencrypt successfully issued"
      else
        sh ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --issue --force --dns dns_ali -d ${DOMAIN} -d "*.${DOMAIN}"
        if [ $? -eq 0 ]; then
            echo "Certificate from zerossl successfully issued"
        else
            echo "Command failed"
            exit 1
        fi
      fi
      cat ~/.acme.sh/${DOMAIN}_ecc/${DOMAIN}.cer > ${DOMAIN}.pem
      cat ~/.acme.sh/${DOMAIN}_ecc/ca.cer >> ${DOMAIN}.pem
      cat ~/.acme.sh/${DOMAIN}_ecc/${DOMAIN}.key > ${DOMAIN}.key
      sudo cp ${DOMAIN}.pem /etc/ssl/ -f && sudo cp ${DOMAIN}.key /etc/ssl/ -f

  - name: Write certificate into Vault Server
    run: |
      export VAULT_ADDR=${VAULT_URL}
      export CERT_PATH="certs/${DOMAIN}"

      # Write Certificate and Private Key to Vault

      vault login ${VAULT_TOKEN}
      vault secrets enable -path=certs kv || true
      vault kv put ${CERT_PATH}                             \
          certificate=@/etc/ssl/${DOMAIN}.pem               \
          private_key=@/etc/ssl/${DOMAIN}.key
      echo &#34;Certificate and private key written to Vault at path: ${CERT_PATH}&#34;</code></pre></div></div><p>至此，已经完成SSL Certs 申请的自动化，每两个月执行一次，确保Vault中永远存储有效的证书。</p><figure class=""><div class="rno-markdown-img-url" style="text-align:center"><div class="rno-markdown-img-url-inner" style="width:auto"><div style="width:100%"><img src="https://cdn.static.attains.cn/app/developer-bbs/upload/1722810704618076022.png" /></div></div></div></figure><p>流水线执行成功后，登录 Vault UI 已经看到域名证书已经保存</p><figure class=""><div class="rno-markdown-img-url" style="text-align:center"><div class="rno-markdown-img-url-inner" style="width:auto"><div style="width:100%"><img src="https://cdn.static.attains.cn/app/developer-bbs/upload/1722810704984057984.png" /></div></div></div></figure><h2 id="8uoro" name="%E5%BA%94%E7%94%A8%E9%9B%86%E7%BE%A4%E4%BE%A7%E9%85%8D%E7%BD%AE">应用集群侧配置</h2><h3 id="fcris" name="%E5%B0%86%E8%AF%81%E4%B9%A6%E5%88%86%E5%88%B0%E5%88%B0%E5%BA%94%E7%94%A8%E9%9B%86%E7%BE%A4%E4%B8%AD">将证书分到到应用集群中</h3><p>接下来的的工作就是，如何在IAC流水线中，集成Vault 操作，读取域名证书并写入集群master节点 /etc/ssl/ 目录</p><ul class="ul-level-0"><li>playbook/roles/cert-manager/tasks/main.yml</li></ul><div class="rno-markdown-code"><div class="rno-markdown-code-toolbar"><div class="rno-markdown-code-toolbar-info"><div class="rno-markdown-code-toolbar-item is-type"><span class="is-m-hidden">代码语言：</span>yaml</div></div><div class="rno-markdown-code-toolbar-opt"><div class="rno-markdown-code-toolbar-copy"><i class="icon-copy"></i><span class="is-m-hidden">复制</span></div></div></div><div class="developer-code-block"><pre class="prism-token token line-numbers language-yaml"><code class="language-yaml" style="margin-left:0">- name: Fetch Certificate and Private Key from Vault

script: files/get_certificate.sh {{ domain }} {{ vault_url }} {{ vault_token }}

when: (inventory_hostname in groups[group]) and (vault == true)

#!/bin/bash

sudo apt-get update

sudo apt install -y software-properties-common

curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/hashicorp-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list > /dev/null

sudo apt-get update

sudo apt-get install -y python3-pip jq vault
check_empty() {

if [ -z "$1" ]; then

echo "$2"

exit 1

fi

}
check_empty "$1" "Please provide DOMAIN" && DOMAIN=$1
check_empty "$2" "Please provide VAULT_ADDR" && VAULT_ADDR=$2
check_empty "$3" "Please provide VAULT_TOKEN" && VAULT_TOKEN=$3

SECRET_PATH="certs/$DOMAIN"
Output paths
CERTIFICATE_PATH="/etc/ssl/${DOMAIN}.pem"

PRIVATE_KEY_PATH="/etc/ssl/${DOMAIN}.key"
vault login
Read certificate from Vault
vault kv get -field=certificate certs/{DOMAIN} > "CERTIFICATE_PATH"
Read private key from Vault
vault kv get -field=private_key certs/{DOMAIN} > "PRIVATE_KEY_PATH"
Set permissions for the private key (modify as needed)
chmod 600 "$PRIVATE_KEY_PATH"
Check if certificate and private key files are non-empty
if [ ! -s "CERTIFICATE_PATH" ] || [ ! -s "PRIVATE_KEY_PATH" ]; then

echo "Certificate or private key is empty. Exiting..."

exit 1

else

echo "Certificate and private key have been written to CERTIFICATE_PATH and PRIVATE_KEY_PATH"

kubectl get secret my-cert-secret -o yaml

curl https://your_svc.com