kube-lego deployed on GKE uses both NGINX and GLBC ingress controllers about kube-lego HOT 8 CLOSED

Plan to do that as part of #11. This annotations haven't been around for too long. Should happen within the next week 👍

from kube-lego.

GCE should be supported as of release 0.1.0. Look at the examples

from kube-lego.

What is about a simplification of the kube-lego setup?

One proposal:

• Use a NodePort for the kube-lego service. AFAIK ports.type: NodePort is already necessary of service ports receiving ingress traffic (atleast on GKE)?
• Manually (or automatically?) patch a referenced ingress resource (via env) to redirect /.well-known/acme-challenge to the kube-lego service.

I tried to change the configurations according to this, but the currently problem is, that kube-lego seems to stop after:

time="2016-08-04T00:26:59Z" level=fatal msg="Error while process certificate requests: reachabily test failed for this cert" context=kubelego 

It restarts after a while, but not fast enough for the GKE health-check to recognize the service as healthy. So the ingress controller does not send any traffic to the service. Whats about to keep kube-lego up and running and always receiving traffic on / or /healthz?

from kube-lego.

Okay I've got it working with GKE as a proof of concept.

My steps:

• kube-lego-deployment.yaml: Add a livenessProbe, so GKE can adopt this lifenessProbe for the health check for the backend-service
• kube-lego-svc.yaml: Set ports.type: NodePort
• kube-lego-configmap.yaml: Customize to your needs
• kubectl apply -f kube-lego-configmap.yaml -f kube-lego-deployment.yaml -f kube-lego-svc.yaml
• Change your ingress to redirect /.well-known/acme-challenge/ to the kube-lego service. DO NOT set annotations.kubernetes.io/tls-acme: "true" in the ingress for now! (Reason: [1])
• Wait until the health check for kube-lego is HEALTHY (watch kubectl describe ing)
• Optional: Delete the ingress created by kube-lego (you wont need it, it will bind an additional IP) kubectl delete ingress kube-lego
• Test manually if everything is redirected to your endpoints, especially to kube-lego: curl -i http://example.com/.well-known/acme-challenge/_selftest should be status 200.
• kubectl annotate ing your-ingress-name kubernetes.io/tls-acme="true"
• Inspect the logs of the kube-lego pod and the secrets, hopefully it installed the desired secret and the GKE LoadBalancer installed it for SSL.

My examples as a Gist: https://gist.github.com/MaxDaten/482f6bd71348b1502edc7348318bea17

[1] You should not set annotations.kubernetes.io/tls-acme: "true" before health check for the backend-service is HEALTHY, because kube-lego immediately starts with the selfcheck, but no traffic on /.well-known/acme-challenge is redirected to it, as long the health check fails. This seems to result into a kind of deadlock.

from kube-lego.

@MaxDaten thanks for your input on that. First of all I am not too sure if you are aware that there is a simple setup based on using nginx-ingress on GKE/GCE like this is:

• Disable L7-Loadbalancing in GKE: gcloud container clusters update <cluster-name> --update-addons HttpLoadBalancing=DISABLED
• Run nginx-ingress like described in the examples

I am using this for months without any issue.

For having GCE ingress support, we need to support differentiation between ingress-classes. I plan to implement that for this ticket. This will include a lot of your (steps).

I agree on the deadlock, the reason for that is that kube-lego is currently not disabling ingress resources if they fail a couple of times, this is probably not trivial to implement. (see #13)

from kube-lego.

First of all I am not too sure if you are aware that there is a simple setup based on using nginx-ingress on GKE/GCE like this is:

Yes I'm aware of it, but wasn't aware how to disable the L7-LB, thanks for the hint. But this has the downside (depends on your perspective) to manage the LB on your own and you have to pull it into your cluster, since the L7 resides now on the managed master. Currently I prefer the managed LB. because I'm the one man army here.

from kube-lego.

Thanks alot, I will definitely try it out!

from kube-lego.

Just stopping by to say thank you. I installed it, and it works like a charm =)

from kube-lego.