Securing Your Kubernetes Website with Let's Encrypt and cert-manager

Securing Your Kubernetes Website with Let's Encrypt and cert-manager In today's digital world, security is paramount. For websites, this often means implementing HTTPS (HTTPS) to encrypt communication between the server and the user. Let's Encrypt provides a free and automated way to obtain and renew SSL certificates, and cert-manager simplifies this process within your Kubernetes cluster. This guide will walk you through the steps of securing your Kubernetes-deployed website with Let's Encrypt certificates using cert-manager. 1. Install cert-manager Install Helm: If you're using Helm, install it on your Kubernetes cluster. Install cert-manager: Use Helm to install cert-manager: helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ --set installCRDs=true 2. Create a ClusterIssuer for Let's Encrypt Create a ClusterIssuer resource: This defines how cert-manager will obtain certificates from Let's Encrypt. Here's an example: apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: your_email@example.com privateKeySecretRef: secretName: letsencrypt-prod solvers: - http01: ingress: class: nginx Replace your_email@example.com with your email address. Ensure the ingress class matches your Ingress controller (e.g., nginx, traefik). Apply the ClusterIssuer: kubectl apply -f letsencrypt-issuer.yaml 3. Create an Ingress Resource Create an Ingress resource: This defines how traffic should be routed to your application. Here's a basic example: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: my-app-ingress spec: rules: - host: your-domain.com http: paths: - path: / backend: serviceName: my-app-service servicePort: 80 tls: - hosts: - your-domain.com secretName: your-domain-tls Replace your-domain.com with your actual domain name. Replace my-app-service and my-app-service with the actual names of your Service and its port. Specify the secretName that cert-manager will create to store the certificate and key. Apply the Ingress: kubectl apply -f ingress.yaml 4. Verify Certificate Issuance Check the status of the Certificate resource: kubectl get certificates You should see a Certificate resource being created by cert-manager. Check the Ingress status: kubectl describe ingress my-app-ingress The Ingress status should indicate that the TLS configuration is ready. 5. Access Your Website Browse to your website: Visit https://your-domain.com in your browser. You should now see a secure connection (indicated by the green padlock in the address bar). Important Notes: DNS Configuration: Ensure that your domain name is properly configured to point to your Kubernetes cluster's LoadBalancer IP or Ingress endpoint. Ingress Controller: This example assumes you are using an Ingress controller like Nginx Ingress. Security: Always follow security best practices and regularly review and update your certificates. Troubleshooting: If you encounter any issues, check the logs of cert-manager, your Ingress controller, and your Kubernetes cluster for error messages. By following these steps, you can effectively secure your Kubernetes-based website with Let's Encrypt certificates using cert-manager. This will enhance the security and trust of your website for your users.

Jan 19, 2025 - 22:29

Securing Your Kubernetes Website with Let's Encrypt and cert-manager

In today's digital world, security is paramount. For websites, this often means implementing HTTPS (HTTPS) to encrypt communication between the server and the user. Let's Encrypt provides a free and automated way to obtain and renew SSL certificates, and cert-manager simplifies this process within your Kubernetes cluster.

This guide will walk you through the steps of securing your Kubernetes-deployed website with Let's Encrypt certificates using cert-manager.

1. Install cert-manager

Install Helm: If you're using Helm, install it on your Kubernetes cluster.
Install cert-manager: Use Helm to install cert-manager:

   helm install cert-manager jetstack/cert-manager \
       --namespace cert-manager \
       --create-namespace \
       --set installCRDs=true

2. Create a ClusterIssuer for Let's Encrypt

Create a ClusterIssuer resource: This defines how cert-manager will obtain certificates from Let's Encrypt. Here's an example:

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: letsencrypt-prod
   spec:
     acme:
       server: https://acme-v02.api.letsencrypt.org/directory
       email: your_email@example.com 
       privateKeySecretRef:
         secretName: letsencrypt-prod
       solvers:
       - http01:
           ingress:
             class: nginx

Replace your_email@example.com with your email address.
Ensure the ingress class matches your Ingress controller (e.g., nginx, traefik).
- Apply the ClusterIssuer:

   kubectl apply -f letsencrypt-issuer.yaml

3. Create an Ingress Resource

Create an Ingress resource: This defines how traffic should be routed to your application. Here's a basic example:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: my-app-ingress
   spec:
     rules:
     - host: your-domain.com 
       http:
         paths:
         - path: /
           backend:
             serviceName: my-app-service 
             servicePort: 80
     tls:
     - hosts:
       - your-domain.com 
       secretName: your-domain-tls

Replace your-domain.com with your actual domain name.
Replace my-app-service and my-app-service with the actual names of your Service and its port.
Specify the secretName that cert-manager will create to store the certificate and key.
- Apply the Ingress:

   kubectl apply -f ingress.yaml

4. Verify Certificate Issuance

Check the status of the Certificate resource:

   kubectl get certificates

You should see a Certificate resource being created by cert-manager.

Check the Ingress status:

   kubectl describe ingress my-app-ingress

The Ingress status should indicate that the TLS configuration is ready.

5. Access Your Website

Browse to your website: Visit https://your-domain.com in your browser. You should now see a secure connection (indicated by the green padlock in the address bar).

Important Notes:

DNS Configuration: Ensure that your domain name is properly configured to point to your Kubernetes cluster's LoadBalancer IP or Ingress endpoint.
Ingress Controller: This example assumes you are using an Ingress controller like Nginx Ingress.
Security: Always follow security best practices and regularly review and update your certificates.
Troubleshooting: If you encounter any issues, check the logs of cert-manager, your Ingress controller, and your Kubernetes cluster for error messages.

By following these steps, you can effectively secure your Kubernetes-based website with Let's Encrypt certificates using cert-manager. This will enhance the security and trust of your website for your users.