Traefik via Helm
helm repo add traefik https://helm.traefik.io/traefik
helm install traefik traefik/traefik --namespace traefik --create-namespace --values traefik-values.yaml
Cert-Manager
Cert Manager will be used as it will store certs in a secret, therefore accessible for every pod. In contrast to this, Traefik stores certs on disk, so a volume would be needed in RWX mode (too much effort).
Issuer - CA
An issuer is a CA. This can be done with 2 different kinds.
Issuer
can be used in the namespace they are created in.
Cluster Issuer
can be used throughout the whole cluster, not limited to a specific namespace. i.e. general issuer for all namespaces in cluster.
Test Deployment
k create ns test
kubectl create deploy nginx --image=nginx -n test
k create svc -n test clusterip nginx --tcp=80
k scale --replicas=3 deployment/nginx -n test
Install Traefik & Cert-Manager
helm install traefik traefik/traefik --namespace traefik --create-namespace --values traefik-values.yaml
traefik-dashboard.k8s.schnrbs.work
helm repo add jetstack https://charts.jetstack.io --force-update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --values cert-manager-values.yaml
k apply -f cert-manager-issuer-secret.yaml
k get secret -n cert-manager
k apply -f cert-manager-cluster-issuer.yaml
Switch Test Deployment to https
k apply -f test/nginx-certificate.yaml
k apply -f test/nginx-ingress.yaml
Troubleshooting steps
k get po -n test -o wide
k create svc -n test clusterip nginx
k create svc -n test clusterip nginx --tcp=80
k get svc -n test
dig k.internal.schnrbs.work
dig k8s.internal.schnrbs.work
dig n.k8s.internal.schnrbs.work
k apply -f traefik_lempa/nginx-ingress.yaml
k delete ingress nginx-ingress
k apply -f traefik_lempa/nginx-ingress.yaml
k get svc -n test
k get ingress
k get ingress -n test
k get svc ingressRoute
k get svc ingressRoutes
k get svc ingressroutes.traefik.io
k get ingressroutes.traefik.io --all-namespaces
helm upgrade traefik traefik/traefik --namespace traefik --create-namespace --values traefik_lempa/traefik-values.yaml
cert-manager-values.yaml
echo -n 'P96My4uiHudZtiC2ymjSGQ0174CoRBnI9ztmA0Wh' | base64
k get po
alias k=kubectl
k get po
k apply -f traefik_lempa/cert-manager-issuer-secret.yaml
k get secret
k get secrets
k get clusterissuers.cert-manager.io