[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Installing applications from Cloud Marketplace > Installing cert-manager with the Cloud DNS ACME webhook plugin # Installing cert-manager with the Yandex Cloud DNS ACME webhook plugin [cert-manager](https://cert-manager.io) is an application that adds certificates and certificate issuers as resource types in [Managed Service for Kubernetes clusters](../../concepts/index.md#kubernetes-cluster), which makes it easier to get, renew, and use such certificates. For example, to get [Let's Encrypt®](https://letsencrypt.org/) certificates, you can pass the following [challenges](https://letsencrypt.org/docs/challenge-types/) to prove domain ownership: * [DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge). To pass this challenge, use [Yandex Cloud DNS](../../../dns/index.md). Together with cert-manager, you need to install the Yandex Cloud DNS ACME webhook plugin for integration with the service. * [HTTP-01](https://letsencrypt.org/docs/challenge-types/#http-01-challenge). To pass this challenge, use an Ingress controller installed in a cluster. {% note info %} The cert-manager application with the Yandex Cloud DNS ACME webhook plugin supports [wildcard certificates](https://en.wikipedia.org/wiki/Public_key_certificate#Wildcard_certificate). {% endnote %} ## Getting started {#before-you-begin} 1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Make sure your Managed Service for Kubernetes cluster is located in the same [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) as the [public Cloud DNS zone](../../../dns/concepts/dns-zone.md#public-zones). 1. [Make sure](../connect/security-groups.md) the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If a rule is missing, [add it](../../../vpc/operations/security-group-add-rule.md). {% note warning %} The configuration of security groups determines performance and availability of the cluster and the services and applications running in it. {% endnote %} 1. [Add](../../../vpc/operations/security-group-add-rule.md) the following rules to your security groups: * Add to the [cluster security group](../connect/security-groups.md#rules-master) an outbound traffic rule allowing certificate checks via a cert-manager webhook: * **Port range**: `10250`. * **Protocol**: `TCP`. * **Destination name**: `CIDR`. * **CIDR blocks**: `0.0.0.0/0`. * Add to the [node group security group](../connect/security-groups.md#rules-internal-nodegroup) an outbound traffic rule allowing connection to Let's Encrypt® servers for certificates: * **Port range**: `443`. * **Protocol**: `TCP`. * **Destination name**: `CIDR`. * **CIDR blocks**: `0.0.0.0/0`. 1. [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect). 1. [Create](../../../iam/operations/sa/create.md) a service account to run cert-manager. 1. [Assign](../../../iam/operations/sa/assign-role-for-sa.md) the service account the `dns.editor` role for the folder hosting the public DNS zone. 1. [Create](../../../iam/operations/authentication/manage-authorized-keys.md#create-authorized-key) an authorized key for this service account and save it to the `key.json` file. ## Installation from Yandex Cloud Marketplace {#marketplace-install} 1. In the [management console](https://console.yandex.cloud), select a folder. 1. Navigate to **Managed Service for Kubernetes**. 1. Click the name of the Managed Service for Kubernetes cluster you need and select the ![image](../../../_assets/console-icons/shopping-cart.svg) **Marketplace** tab. 1. Under **Application available for installation**, select [cert-manager with the Yandex Cloud DNS ACME webhook plugin](https://yandex.cloud/en/marketplace/products/yc/cert-manager-webhook-yandex) and click **Go to install**. 1. Configure the application: * **Namespace**: Create a new [namespace](../../concepts/index.md#namespace), e.g., `cert-manager-dns-space`. If you leave the default namespace, cert-manager with the Yandex Cloud DNS plugin may work incorrectly. * **Application name**: Specify the application name, e.g., `cert-manager`. * **Service account key**: Paste the contents of the `key.json` file or create a new [key](../../../iam/concepts/authorization/key.md). * **Folder ID**: Specify the ID of the folder the Cloud DNS zone resides in to confirm domain ownership during the DNS-01 challenge. * **Email address to get notifications from Let's Encrypt**: Specify the email address for Let's Encrypt® notifications. * **Let's Encrypt server address**: Select a Let's Encrypt® server address from the list: * `https://acme-v02.api.letsencrypt.org/directory`: Primary URL. * `https://acme-staging-v02.api.letsencrypt.org/directory`: Test URL. 1. Click **Install**. 1. Wait for the application status to change to `Deployed`. ## Installation using a Helm chart {#helm-install} 1. [Install Helm](https://helm.sh/docs/intro/install/) v3.8.0 or higher. 1. [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect). 1. To install a [Helm chart](https://helm.sh/docs/topics/charts/) with cert-manager and the Yandex Cloud DNS plugin, run this command: ```bash helm pull oci://cr.yandex/yc-marketplace/yandex-cloud/cert-manager-webhook-yandex/cert-manager-webhook-yandex \ --version 1.0.11 \ --untar && \ helm install \ --namespace \ --create-namespace \ --set-file config.auth.json=key.json \ --set config.email='' \ --set config.folder_id='' \ --set config.server='Lets_Encrypt_server_URL' \ cert-manager-webhook-yandex ./cert-manager-webhook-yandex/ ``` As a Let's Encrypt® server URL, use these: * `https://acme-v02.api.letsencrypt.org/directory`: Primary URL. * `https://acme-staging-v02.api.letsencrypt.org/directory`: Test URL. This command will also create a new namespace required for cert-manager. If you set `namespace` to the default namespace, cert-manager may work incorrectly. We recommend specifying a value different from all the existing namespaces, e.g., `cert-manager-dns-space`. {% note info %} If you are using a Helm version below 3.8.0, add the `export HELM_EXPERIMENTAL_OCI=1 && \` string at the beginning of the command to enable [Open Container Initiative](https://opencontainers.org/) (OCI) support in the Helm client. {% endnote %} 1. Make sure the cert-manager [pod](../../concepts/index.md#pod) has changed its status to `Running`: ```bash kubectl get pods --namespace= -l app=cert-manager-webhook-yandex -w ``` ## Getting a test certificate {#issue-certificate} To test the installed application, get a test certificate. We are going to use `yc-clusterissuer` to issue a certificate. It is created when you install cert-manager and pre-configured to work with Let's Encrypt®. 1. Create a file named `certificate.yaml` with a request for a test certificate: ```yaml apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: domain-name namespace: spec: secretName: domain-name-secret issuerRef: # ClusterIssuer created along with the Yandex Cloud DNS ACME webhook. name: yc-clusterissuer kind: ClusterIssuer dnsNames: # The domain must belong to your public Cloud DNS zone. # Make sure to specify the domain name, e.g., test.example.com, rather than the DNS record name. - ``` 1. Install the certificate in the Managed Service for Kubernetes cluster: ```bash kubectl apply -f certificate.yaml ``` 1. Check if the certificate is available: ```bash kubectl get certificate ``` Result: ```text NAME READY SECRET AGE domain-name True domain-name-secret 45m ``` The `True` status in the `READY` column means that the certificate was issued successfully. 1. Optionally, get detailed information about the certificate: ```bash kubectl -n describe certificate domain-name ``` The command output will contain similar events: ```text Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Issuing ... cert-manager-certificates-trigger Issuing certificate as Secret does not exist Normal Generated ... cert-manager-certificates-key-manager Stored new private key in temporary Secret resource... ``` Certificates are [used bundled with matching Kubernetes secrets](https://cert-manager.io/docs/), which store key pairs and service information. If there is no secret, the certificate is reissued automatically and a new secret is created, with a notification in the events. For more information about certificate reissue, see [this cert-manager guide](https://cert-manager.io/docs/faq/#when-do-certs-get-re-issued). As the certificate is being issued for the first time, it has no matching secret. Any events notifying about it should not be considered an error. ## Use cases {#examples} * [DNS challenge for Let's Encrypt® certificates](../../tutorials/dnschallenge.md) ## Useful links {#see-also} * [Let's Encrypt® documentation](https://letsencrypt.org/docs/client-options/) * [cert-manager documentation](https://cert-manager.io/docs/configuration/)