1

Currently, certbot and nginx are used to create a trusted webpage. Recently, an attempt was made to move the images to a kubernetes cluster on google cloud platform. A guide was found to configure an SSL loadbalancer. It was tried and it shows multiple textboxes to insert a key, cert and chain.

An attempt was made to see whether Google offers wildcard certs as well, but no information was found. Certbot itself announced last year that they will support wildcard certs, but that does not seem to be the case as well. First impression is that using certbot in the google loadbalancer will not be possible or will be cumbersome as the certs have to be renewed every three months.

When one Googles: cheap wildcard ssl then a lot of results are shown. The questions are which of these providers can be considered as safe, what are the costs and what providers do you use and why?

2

Have a look at "Ingress" and "Cert-Manager":

  • 1
    Note that wildcard Let's Encrypt certificates are a very recent offering (I'm not sure if they are generally released) and only available via their ACME v2 API. See letsencrypt.org/2017/07/06/…. – Dan Cornilescu Mar 12 '18 at 14:54
  • You're right. I missed to make clear that with cert-manager it might be ok to not use wildcard certificates at all, but just go on like now with certbot. I understood that the need for wildcards was coming from the problem on how to renew certs in a k8s cluster every 3 months ("First impression is that using certbot in the google loadbalancer will not be possible or will be cumbersome..."), and cert-manager solves exactly that problem. – slintes Mar 12 '18 at 16:02
  • Still, the answer is IMHO valuable as things are definitely moving in the right direction. – Dan Cornilescu Mar 12 '18 at 16:13
  • @MarcSluiter You used helm as well? – 030 Mar 12 '18 at 20:06
  • I'm not using cert-manager myself yet, I'm still using the predecessor project "kube-lego" ;) – slintes Mar 12 '18 at 20:11
0

For using kube-lego you can follow this step:

Visit https://github.com/jetstack/kube-lego/tree/master/examples/gce and follow instructions to have a kube-lego namespace working.

Create an ingress like this:

    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: app-ingress
      annotations:
        kubernetes.io/tls-acme: "true"
        kubernetes.io/ingress.class: "gce"
    spec:
      backend:
        serviceName: backend-service
        servicePort: 80
      tls:
      - hosts:
        - example.com
        - api.example.com
        secretName: app-ingress-tls
      rules:
      - host: example.com
        http:
          path:
          - path: /*
            backend:
              serviceName: backend-service
              servicePort: 443
      - host: api.example.com
        http:
          path:
          - path: /*
            backend:
              serviceName: backend-service
              servicePort: 443

remember to replace backend-service with your own service name and exampl.com with your domain.

You can put as more host sections as you need, each host section should be associated with a domain on the tls section.

Use the app-ingress-tls secret to mount as a volume on your service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.