Add letsencrypt

cloud-init.yaml

@@ -17,7 +17,7 @@ system_info:
 
 runcmd:
   - mkdir -p /home/ubuntu/.kube /home/ubuntu/.config/fish/completions
-  - microk8s alias microk8s.kubectl kubectl
+  - snap alias microk8s.kubectl kubectl
   - kubectl completion fish > /home/ubuntu/.config/fish/completions/kubectl.fish
   - chown -R ubuntu:ubuntu /home/ubuntu/.kube /home/ubuntu/.config/fish
   - microk8s enable dns ingress dashboard helm helm3

ingress/README.md

@@ -1,11 +1,25 @@
+# K8s setup with Nignx Ingress
+
+```kubectl apply -f k8s/ingress```
+
+Edit hosts file on host machine
+
+Get ip of vm
+
+```ip -o a | grep ens```
+
+```sudo nano /etc/hosts```
+
+```<ip> ingress.local```
+
+http://ingress.local
+
+http://ingress.local/v2
+
+
+https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect
+
 https://kubernetes.io/docs/tasks/access-application-cluster/ingress-minikube/
 
-```kubectl create deployment web --image=gcr.io/google-samples/hello-app:1.0```
+https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/
 
-```kubectl create deployment web2 --image=gcr.io/google-samples/hello-app:2.0 --replicas=3```
-
-```kubectl expose deployment web --type=NodePort --port=8080```
-
-```kubectl expose deployment web2 --type=ClusterIP --port=8080```
-
-```kubectl get service web```

ingress/web-deplyment.yaml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+spec:
+  selector:
+    matchLabels:
+      run: web
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        run: web
+    spec:
+      containers:
+      - name: web
+        image: gcr.io/google-samples/hello-app:1.0
+        ports:
+        - containerPort: 80

ingress/web-ingress.yaml

@@ -1,13 +1,14 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: example-ingress
+  name: web-ingress
   annotations:
     nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/preserve-trailing-slash: "true"
 spec:
   rules:
-    - host: hello-world.info
+    - http:
-      http:
         paths:
           - path: /
             pathType: Prefix
@@ -23,4 +24,7 @@ spec:
               service:
                 name: web2
                 port:
-                  number: 8080
+                  number: 8080
+  tls:
+    - hosts:
+      -  ingress.local

ingress/web-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: web
+  labels:
+    run: web
+spec:
+  ports:
+  - port: 8080
+    protocol: TCP
+  selector:
+    run: web

ingress/web2-deplyment.yaml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web2
+spec:
+  selector:
+    matchLabels:
+      run: web2
+  replicas: 3
+  template:
+    metadata:
+      labels:
+        run: web2
+    spec:
+      containers:
+      - name: web2
+        image: gcr.io/google-samples/hello-app:2.0
+        ports:
+        - containerPort: 80

ingress/web2-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: web2
+  labels:
+    run: web2
+spec:
+  ports:
+  - port: 8080
+    protocol: TCP
+  selector:
+    run: web2

letsencrypt/README.md

@@ -0,0 +1 @@
+https://stackoverflow.com/questions/67430592/how-to-setup-letsencrypt-with-kubernetes-microk8s-using-default-ingress

letsencrypt/ingress-routes.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ingress-routes
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  tls:
+  - hosts:
+  #change to your domain
+    - k8s.technical.kiwi
+    secretName: tls-secret
+  rules:
+#change yourdomain.com to your domain
+  - host: k8s.technical.kiwi
+    http:
+      paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: webserver-svc
+              port: 
+                number: 80

letsencrypt/letsencrypt-prod.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+#change to your email
+    email: admin@technical.kiwi
+    privateKeySecretRef:
+       name: letsencrypt-prod
+    solvers:
+    - http01:
+        ingress:
+          class: public

letsencrypt/letsencrypt-staging.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+#change to your email
+    email: admin@technical.kiwi
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+    - http01:
+        ingress:
+          class: public

letsencrypt/webserver-depl-svc.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webserver-depl
+spec:
+  selector:
+    matchLabels:
+      app: webserver-app
+  template:
+    metadata:
+      labels:
+        app: webserver-app
+    spec:
+      containers:
+        - name: webserver-app
+          image: nginx:1.8
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: webserver-svc
+spec:
+  selector:
+    app: webserver-app
+  ports:
+  - name: webserver-app
+    protocol: TCP
+    port: 80
+    targetPort: 80