Add Jetstack Helm repository

プラットフォーム	コマンド
kubectl (Static Manifests)	kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
Helm (Recommended)	helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true
macOS (cmctl CLI)	brew install cmctl
Linux (cmctl CLI)	`curl -sSL https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cmctl-linux-amd64.tar.gz \
Windows (cmctl CLI)	curl.exe -L -o cmctl.exe https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cmctl-windows-amd64.exe
Verify Installation	kubectl get pods -n cert-manager

# Add Jetstack Helm repository
helm repo add jetstack https://charts.jetstack.io

# Update repository
helm repo update

# Install with custom values
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.13.3 \
  --values custom-values.yaml
```## インストール

| コマンド | 説明 |
|---------|-------------|
| `kubectl get certificates` | 現在の名前空間のすべての証明書を一覧表示 |
| `kubectl get certificates -A` | すべての名前空間で証明書を一覧表示 |
| `kubectl describe certificate <name>` | 詳細な証明書情報を表示 |
| `kubectl get certificate <name> -o yaml` | YAML形式で証明書を表示 |
| `kubectl get issuer` | 現在の名前空間内のすべての発行者を一覧表示 |
| `kubectl get clusterissuer` | クラスター全体の発行者をすべて一覧表示 |
| `kubectl describe issuer <name>` | 発行者の詳細情報を表示 |
| `kubectl get certificaterequest` | 証明書リクエストをリスト表示 |
| `kubectl get order` | ACMEの証明書の注文を表示 |
| `kubectl get challenge` | ドメイン検証のためのACMEチャレンジを表示 |
| `kubectl logs -n cert-manager deployment/cert-manager` | cert-manager コントローラーのログを表示 |
| `kubectl logs -n cert-manager deployment/cert-manager-webhook` | Webhookログを表示 |
| `kubectl logs -n cert-manager deployment/cert-manager-cainjector` | CA インジェクターのログを表示 |
| `cmctl check api` | cert-managerのAPIが利用可能であることを確認する |
| `cmctl version` | cert-managerのバージョン情報を表示 |
| `cmctl status certificate <name>` | 証明書のステータスと準備状況を確認 |
| `cmctl inspect secret <secret-name>` | cert-managerによって作成されたTLSシークレットを検査する |
| `cmctl renew <cert-name>` | 証明書の更新を手動でトリガー |
| `kubectl get crd \ | grep cert-manager` | cert-managerのカスタムリソース定義をすべて一覧表示 |
| `kubectl get events --field-selector involvedObject.name=<cert-name>` | 特定の証明書に関連するイベントを表示 |### Helmリポジトリのセットアップ

| コマンド | 説明 |
|---------|-------------|
| `cmctl approve <certificaterequest-name>` | 証明書リクエストを手動で承認する |
| `cmctl deny <certificaterequest-name>` | 証明書リクエストを拒否する |
| `cmctl create certificaterequest test --from-certificate-file=cert.yaml` | ファイルから証明書リクエストを作成 |
| `cmctl convert --output-format=pem --input-file=cert.yaml` | 証明書をPEM形式に変換する |
| `cmctl experimental create acmeaccount --server=<url> --email=<email>` | ACMEアカウント登録をテスト |
| `kubectl annotate certificate <name> cert-manager.io/issue-temporary-certificate="true" --overwrite` | 証明書の即時更新を強制 |
| `kubectl delete certificaterequest <name>` | 失敗した証明書リクエストを削除 |
| `kubectl delete order <name>` | ACMEの注文を削除 |
| `kubectl delete challenge <name>` | 詰まった ACME チャレンジを削除 |
| `kubectl get certificate <name> -o jsonpath='{.status.conditions}'` | 証明書のステータス条件を抽出する |
| `kubectl get secret <tls-secret> -o jsonpath='{.data.tls\.crt}' \ | base64 -d \ | openssl x509 -text -noout` | 証明書の詳細をデコードして表示 |
| `kubectl get secret <tls-secret> -o jsonpath='{.data.tls\.crt}' \ | base64 -d \ | openssl x509 -noout -dates` | 証明書の有効期限を確認する |
| `helm upgrade cert-manager jetstack/cert-manager --namespace cert-manager --version v1.13.3` | cert-managerを新しいバージョンにアップグレード |
| `kubectl rollout restart deployment -n cert-manager` | すべての cert-manager コンポーネントを再起動 |
| `kubectl scale deployment cert-manager -n cert-manager --replicas=2` | cert-managerの高可用性スケーリング |
| `kubectl get certificate --watch` | 証明書のステータス変更をリアルタイムで監視 |
| `kubectl patch certificate <name> --type merge -p '{"spec":{"renewBefore":"720h"}}'` | 証明書の更新ウィンドウを変更 |
| `kubectl delete secret <tls-secret>` | 証明書シークレットを削除（再作成をトリガー） |
| `cmctl experimental install` | cmctl ツールを使用して cert-manager をインストールする |
| `cmctl experimental uninstall` | cert-managerをアンインストールし、リソースをクリーンアップする |## 基本コマンド
```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
```## 高度な使用法
```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    - http01:
        ingress:
          class: nginx
```## 設定
```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - dns01:
        cloudDNS:
          project: my-gcp-project
          serviceAccountSecretRef:
            name: clouddns-dns01-solver
            key: key.json
```### 自己署名クラスター発行者
```yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: ca-issuer
  namespace: default
spec:
  ca:
    secretName: ca-key-pair
```### Let's Encrypt ステージング（HTTP-01チャレンジ）
```yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - example.com
  - www.example.com
  duration: 2160h      # 90 days
  renewBefore: 360h    # 15 days before expiry
```### Let's Encrypt 本番環境（DNS-01チャレンジ）
```yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
  namespace: default
spec:
  secretName: wildcard-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - "*.example.com"
  - example.com
```### CAイシュアー（内部PKI）
```yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: vault-issuer
  namespace: default
spec:
  vault:
    server: https://vault.example.com
    path: pki/sign/example-dot-com
    auth:
      kubernetes:
        mountPath: /v1/auth/kubernetes
        role: cert-manager
        secretRef:
          name: vault-token
          key: token
```### 証明書リソース
```yaml
# custom-values.yaml
installCRDs: true
replicaCount: 2

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 200m
    memory: 256Mi

prometheus:
  enabled: true
  servicemonitor:
    enabled: true

webhook:
  replicaCount: 2

cainjector:
  replicaCount: 2
```### ワイルドカード証明書
```bash
# Create ClusterIssuer
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
EOF

# Create Ingress with TLS annotation
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    secretName: example-com-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              number: 80
EOF

# Verify certificate creation
kubectl get certificate
kubectl describe certificate example-com-tls
```### Vaultイシュアー
```bash
# Create self-signed CA
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: my-ca
  secretName: my-ca-secret
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
EOF

# Create CA issuer from generated CA
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: my-ca-issuer
spec:
  ca:
    secretName: my-ca-secret
EOF

# Issue service certificates
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: service-a-cert
  namespace: default
spec:
  secretName: service-a-tls
  duration: 8760h
  renewBefore: 720h
  subject:
    organizations:
    - my-org
  commonName: service-a.default.svc.cluster.local
  dnsNames:
  - service-a.default.svc.cluster.local
  issuerRef:
    name: my-ca-issuer
    kind: ClusterIssuer
EOF
```### Helm値の設定
```bash
# Create DNS provider secret (example: Cloudflare)
kubectl create secret generic cloudflare-api-token \
  --from-literal=api-token=YOUR_CLOUDFLARE_API_TOKEN

# Create ClusterIssuer with DNS-01 solver
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dns
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-dns
    solvers:
    - dns01:
        cloudflare:
          email: admin@example.com
          apiTokenSecretRef:
            name: cloudflare-api-token
            key: api-token
EOF

# Request wildcard certificate
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-example
  namespace: default
spec:
  secretName: wildcard-example-tls
  issuerRef:
    name: letsencrypt-dns
    kind: ClusterIssuer
  dnsNames:
  - "*.example.com"
  - example.com
EOF

# Monitor certificate issuance
kubectl get certificate wildcard-example -w
```## 一般的なユースケース
```bash
# Create certificate for webhook
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: webhook-cert
  namespace: webhook-system
spec:
  secretName: webhook-server-cert
  duration: 8760h
  renewBefore: 720h
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
  dnsNames:
  - webhook-service.webhook-system.svc
  - webhook-service.webhook-system.svc.cluster.local
EOF

# Reference in webhook configuration
kubectl apply -f - <<EOF
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: my-webhook
  annotations:
    cert-manager.io/inject-ca-from: webhook-system/webhook-cert
webhooks:
- name: webhook.example.com
  clientConfig:
    service:
      name: webhook-service
      namespace: webhook-system
      path: "/validate"
    caBundle: "" # Injected by cert-manager
EOF
```### ユースケース1：Let's Encryptを使用した安全なIngress
```bash
# Create certificate with short duration for testing
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: short-lived-cert
  namespace: default
spec:
  secretName: short-lived-tls
  duration: 24h
  renewBefore: 8h
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
  dnsNames:
  - test.example.com
EOF

# Monitor renewal
kubectl get certificate short-lived-cert -w

# Force immediate renewal
kubectl annotate certificate short-lived-cert \
  cert-manager.io/issue-temporary-certificate="true" \
  --overwrite

# Check renewal history
kubectl get certificaterequest -l cert-manager.io/certificate-name=short-lived-cert

# Verify new certificate
cmctl inspect secret short-lived-tls
```### ユースケース2：内部サービスmTLS
`renewBefore`### ユースケース3：DNS-01を使用したワイルドカード証明書
`certmanager_certificate_expiration_timestamp_seconds`
- **DNSの-01を使用してワイルドカードと内部サービスに対応**: DNSの-01チャレンジは、ワイルドカード証明書に必要であり、インターネットに公開されていないサービスでより効果的に動作します

- **適切なRBACを実装**: Kubernetes RBACを使用して、発行者と証明書のシークレットへのアクセスを制限し、不正な証明書の作成を防止します

- **設定をバージョン管理**: 証明書と発行者のマニフェストをGitに保存して、変更を追跡し、GitOpsワークフローを有効にします

- **環境ごとに別々の発行者を使用**: 開発/ステージング/本番環境ごとに異なる発行者を作成し、認証情報を分離し、環境間の証明書の問題を防止します

- **Webhookに対するCA注入を有効化**: 注釈を使用して、Webhook設定に自動的にCAバンドルを注入します
`cert-manager.io/inject-ca-from`[No complete text provided]

## トラブルシューティング

| 問題 | ソリューション |
|-------|----------|
| **Certificate stuck in "Pending"** | Check certificate request: `kubectl describe certificaterequest <name>`. Look for ACME challenge failures or issuer configuration errors |
| **ACME HTTP-01 challenge failing** | Verify ingress is accessible: `curl http://<domain>/.well-known/acme-challenge/test`. Check ingress class matches solver configuration |
| **DNS-01 challenge timeout** | Confirm DNS provider credentials: `kubectl get secret <dns-secret> -o yaml`. Verify DNS propagation: `dig TXT _acme-challenge.<domain>` |
| **"Too many certificates" rate limit** | Let's Encryptのステージングサーバーに切り替えるか、7日間待ってください。レート制限を確認: https://letsencrypt.org/docs/rate-limits/ |
| **Certificate not renewing automatically** | Check `renewBefore` setting and cert-manager logs: `kubectl logs -n cert-manager deployment/cert-manager`. Verify controller is running |
| **Webhook connection failures** | Verify webhook service is running: `kubectl get svc -n cert-manager`. Check webhook certificate validity: `cmctl check api` |
| **CA injection not working** | Ensure cainjector is running: `kubectl get pods -n cert-manager`. Verify annotation syntax: `cert-manager.io/inject-ca-from: namespace/certificate` |
| **Certificate shows "Ready=False"** | Get detailed status: `cmctl status certificate <name>`. Check events: `kubectl get events --field-selector involvedObject.name=<cert-name>` |
| **Order stuck in "Pending"** | Delete order to retry: `kubectl delete order <order-name>`. Certificate controller will create new order automatically |
| **Secret not created after certificate ready** | Check secret name matches `secretName` in Certificate spec. Verify namespace: `kubectl get secret <name> -n <namespace>` |
| **Wildcard certificate validation fails** | DNS-01 ソルバーが設定されていることを確認（HTTP-01 はワイルドカードをサポートしていません）。TXTレコード作成のためのDNSプロバイダーの権限を確認してください |
| **Certificate shows wrong issuer** | Delete certificate request: `kubectl delete certificaterequest <name>`. Update Certificate spec with correct `issuerRef` |
| **High memory usage** | Reduce certificate count or increase resources: `kubectl set resources deployment cert-manager -n cert-manager --limits=memory=512Mi` |
| **Duplicate certificates created** | Check for multiple Certificate resources with same `secretName`. Remove duplicates to prevent conflicts |
| **ACME account registration fails** | 発行者仕様でメールフォーマットを確認。ACME サーバーのURLが正しいことを確認。詳細なエラーメッセージについてcert-managerのログを確認 |
### デバッグコマンドシーケンス
```bash
# Complete troubleshooting workflow
kubectl describe certificate <cert-name>
kubectl get certificaterequest -l cert-manager.io/certificate-name=<cert-name>
kubectl describe certificaterequest <request-name>
kubectl get order
kubectl describe order <order-name>
kubectl get challenge
kubectl describe challenge <challenge-name>
kubectl logs -n cert-manager deployment/cert-manager --tail=100
```[No complete text provided]

Would you like me to clarify or complete the missing texts?```bash
# Search for specific certificate errors
kubectl logs -n cert-manager deployment/cert-manager | grep "certificate=<cert-name>"

# Find ACME challenge errors
kubectl logs -n cert-manager deployment/cert-manager | grep "challenge"

# Check for rate limit errors
kubectl logs -n cert-manager deployment/cert-manager | grep "rate limit"

# Monitor certificate renewal attempts
kubectl logs -n cert-manager deployment/cert-manager -f | grep "renewal"