Преглед изворни кода

HUE-8744 [k8s] Adding cert-manager for SSL

Romain пре 6 година
родитељ
комит
2d990dbea7

+ 31 - 30
tools/kubernetes/helm/hue/README.md

@@ -24,52 +24,53 @@ By default you should see these running containers:
     hue-4n2ck                                     1/1       Running   0          3h
     hue-postgres-5jg77                            1/1       Running   0          12d
 
-## Uninstall
-
-    helm delete hue --purge
-
+And just copy paste the information printed on the screen or run
 
+    kubectl port-forward svc/hue 8888:8888 --address 0.0.0.0
 
-helm install stable/nginx-ingress -n nginx-ingress
-kubectl get svc --namespace=ingress-nginx
+and open-up http://localhost:8888
 
+## Uninstall
 
-kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.8/deploy/manifests/00-crds.yaml
-
-# Create the namespace for cert-manager
-kubectl create namespace cert-manager
+    helm delete hue --purge
 
-# Label the cert-manager namespace to disable resource validation
-kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
+## Ingress
 
-# Add the Jetstack Helm repository
-helm repo add jetstack https://charts.jetstack.io
+Minimal:
 
-# Update your local Helm chart repository cache
-helm repo update
+    microk8s.enable ingress
+    kubectl edit daemonsets nginx-ingress-microk8s-controller
 
-# Install the cert-manager Helm chart
-helm install \
-  --name cert-manager \
-  --namespace cert-manager \
-  --version v0.8.0 \
-  jetstack/cert-manager
+And can edit `--default-backend-service=$(POD_NAMESPACE)/default-http-backend`.
 
-kubectl get pods --namespace cert-manager
+## SSL
 
+Based on Jetstack and Let's encrypt and nginx-ingress:
 
-# Check email in config and run
-kubectl create -f tools/kubernetes/yaml/cert-manager/clusterissuer-letsencrypt.yaml
+    helm install stable/nginx-ingress -n nginx-ingress
 
-kubectl apply -f ingress-ssl.yaml
+    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.8/deploy/manifests/00-crds.yaml
+    kubectl label namespace cert-manager certmanager.k8s.io/disable-validation="true"
+    helm repo add jetstack https://charts.io.jetstack
+    helm repo update
+    helm install --name cert-manager --namespace cert-manager jetstack/cert-manager
 
+Generate certificates:
 
-kubectl create -f prod_issuer.yaml
+    kubectl apply -f tools/kubernetes/yaml/cert-manager/clusterissuer-letsencrypt-prod.yaml
+    kubectl apply -f tools/kubernetes/yaml/cert-manager/ingress-https.yaml
 
-kubectl describe certificate letsencrypt-prod
+    kubectl get certificate
+    kubectl describe ingress
 
+### Reset certificate
 
+    kubectl delete certificate letsencrypt-prod
+    kubectl delete secrets letsencrypt-prod
 
-# Quick test
+### Debug certificate
 
-kubectl port-forward svc/hue 8888:8888 --address 0.0.0.0
+    kubectl describe certificate
+    # <events>  Normal  OrderCreated  77m   cert-manager  Created Order resource "example-tls-754518127"
+    kubectl describe  order example-tls-754518127
+    kubectl describe  challenges.certmanager.k8s.io example-tls-754518127

+ 15 - 0
tools/kubernetes/yaml/cert-manager/clusterissuer-letsencrypt-prod.yaml

@@ -0,0 +1,15 @@
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # The ACME server URL
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: romain.rigaux@gmail.com
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    # Enable the HTTP-01 challenge provider
+    http01: {}

+ 15 - 0
tools/kubernetes/yaml/cert-manager/clusterissuer-letsencrypt-staging.yaml

@@ -0,0 +1,15 @@
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+ name: letsencrypt-staging
+spec:
+ acme:
+   # The ACME server URL
+   server: https://acme-staging-v02.api.letsencrypt.org/directory
+   # Email address used for ACME registration
+   email: romain.rigaux@gmail.com
+   # Name of a secret used to store the ACME account private key
+   privateKeySecretRef:
+     name: letsencrypt-staging
+   # Enable the HTTP-01 challenge provider
+   http01: {}

+ 22 - 0
tools/kubernetes/yaml/cert-manager/ingress-http.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: hue-ingress
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    # certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+    # certmanager.k8s.io/acme-challenge-type: http01
+    # nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  rules:
+  - host: demo2.gethue.com
+    http:
+      paths:
+      - backend:
+          serviceName: hue-balancer
+          servicePort: 80
+        path: /
+  # tls:
+  # - hosts:
+  #   - demo2.gethue.com
+  #   secretName: letsencrypt-pro

+ 22 - 0
tools/kubernetes/yaml/cert-manager/ingress-https.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: hue-ingress
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+    certmanager.k8s.io/acme-challenge-type: http01
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  rules:
+  - host: demo2.gethue.com
+    http:
+      paths:
+      - backend:
+          serviceName: hue-balancer
+          servicePort: 80
+        path: /
+  tls:
+  - hosts:
+    - demo2.gethue.com
+    secretName: letsencrypt-pro