Let's Encrypt is a free TLS/SSL service you can use with your Kubernetes cluster and a lot of the work is automated. You can setup Kubernetes Cluster to reach out to Let's Encrypt and confirm you are the owner of the domain name and to issue you a cert.
Let's Encrypt will not take the word of your Kubernetes Cluster, but instead make a request to that domain name you supposedly own and if you truly do own it, you will reply. When you respond to that route, you will automatically get a certificate from Let's Encrypt thats going to save it into a secret and make it available to your application. Typically, its good for 90 days and then it will automatically go through this process again.
The challenge for you is setting up the infrastructure to make this happen.
Step 1. You need to purchase a domain name. You can use many different services out there, but I would recommend domains.google.com.
Step 2. You want to set up your domain name by going to your Kubernetes Cluster dashboard in Services and then finding the Ingress service and thats the IP you will use for your domain name to point to. You are going to click on the DNS of the domain name you purchased, look for Custom resource records and setup to custom records. The first one will ensure a user who goes to mycluster.com gets forwarded to the IP specified, the second one ensures that a user who goes to www.mycluster.com gets forwarded to the same IP specified.
So you add the @
symbol with an A
record and a 1 hour time to life which is how long it takes for the record to take effect and the IP address assigned to your Load balancer. No port, just the IP address.
The second record type is C
name with www
, 1 hour time to life and obviously thats for your www.mycluster.com
and thats pretty much it for that.
Step 3. Is setting up your Kubernetes cluster to obtain a TLS certificate.
Step 4. You will have to complete an issuer and certificate config files
Step 5. Deploy your new changes
Step 6. verify the certificate