Securing Your Kubernetes Website with Let's Encrypt and cert-manager

Securing Your Kubernetes Website with Let's Encrypt and cert-manager

In today's digital world, security is paramount. For websites, this often means implementing HTTPS (HTTPS) to encrypt communication between the server and the user. Let's Encrypt provides a free and automated way to obtain and renew SSL certificates, and cert-manager simplifies this process within your Kubernetes cluster.

This guide will walk you through the steps of securing your Kubernetes-deployed website with Let's Encrypt certificates using cert-manager.

1. Install cert-manager

• Install Helm: If you're using Helm, install it on your Kubernetes cluster.
• Install cert-manager: Use Helm to install cert-manager:

   helm install cert-manager jetstack/cert-manager \
       --namespace cert-manager \
       --create-namespace \
       --set installCRDs=true 

2. Create a ClusterIssuer for Let's Encrypt

• Create a ClusterIssuer resource: This defines how cert-manager will obtain certificates from Let's Encrypt. Here's an example:

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: letsencrypt-prod
   spec:
     acme:
       server: https://acme-v02.api.letsencrypt.org/directory
       email: [e-mail] 
       privateKeySecretRef:
         secretName: letsencrypt-prod
       solvers:
       - http01:
           ingress:
             class: nginx 

• Replace [e-mail] with your email address.

• Ensure the ingress class matches your Ingress controller (e.g., nginx, traefik).

  • Apply the ClusterIssuer:

   kubectl apply -f letsencrypt-issuer.yaml

3. Create an Ingress Resource

• Create an Ingress resource: This defines how traffic should be routed to your application. Here's a basic example:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: my-app-ingress
   spec:
     rules:
     - host: your-domain.com 
       http:
         paths:
         - path: /
           backend:
             serviceName: my-app-service 
             servicePort: 80
     tls:
     - hosts:
       - your-domain.com 
       secretName: your-domain-tls 

• Replace your-domain.com with your actual domain name.
• Replace my-app-service and my-app-service with the actual names of your Service and its port.

• Specify the secretName that cert-manager will create to store the certificate and key.

  • Apply the Ingress:

   kubectl apply -f ingress.yaml

4. Verify Certificate Issuance

• Check the status of the Certificate resource:

   kubectl get certificates 

You should see a Certificate resource being created by cert-manager.

• Check the Ingress status:

   kubectl describe ingress my-app-ingress

The Ingress status should indicate that the TLS configuration is ready.

5. Access Your Website

• Browse to your website: Visit https://your-domain.com in your browser. You should now see a secure connection (indicated by the green padlock in the address bar).

Important Notes:

• DNS Configuration: Ensure that your domain name is properly configured to point to your Kubernetes cluster's LoadBalancer IP or Ingress endpoint.
• Ingress Controller: This example assumes you are using an Ingress controller like Nginx Ingress.
• Security: Always follow security best practices and regularly review and update your certificates.
• Troubleshooting: If you encounter any issues, check the logs of cert-manager, your Ingress controller, and your Kubernetes cluster for error messages.

By following these steps, you can effectively secure your Kubernetes-based website with Let's Encrypt certificates using cert-manager. This will enhance the security and trust of your website for your users.

---

👨‍💻 About Me:

I'm an aspiring software engineer with a knack for Kubernetes, DevOps, Cloud. I thrive on building efficient systems. I love sharing my tech learnings on LinkedIn and Twitter. Follow me for insights on softwares, cutting-edge technology and many more things. 🚀

---