0

I have purchased a domain name from google domains.

I setup a project with GCLOUD Kubernetes using Ingress.

Documentation for ingress Ingress Github says to enter key here:

apiVersion: v1
kind: Secret
metadata:
  name: testsecret
  namespace: default
type: Opaque
data:
  tls.crt: base64 encoded cert
  tls.key: base64 encoded key

I found doc for how to configure and get SSL cert for app engine. app engine custom domains.

I'm guessing that app engine SSL config has nothing to do with kubernetes ingress.

Would like to know how to get and maintain ssl cert for my ingress.

  • 1
    So all you want is a cert, not how to apply it? – Spooler Mar 1 '18 at 20:58
1

Ingress can be secured with the secret having TLS private key and the certificate. Then can provide reference to the secret in the ingress. Refer to this documentation for more information.

Here is the example for the TLS Ingress rule to use SSL in NGINX along with information on storing SSL certificate in a secret.

Example:

Create secret:

kubectl create secret tls foo-secret --key /tmp/tls.key --cert /tmp/tls.crt

Reference secret in the ingress:

      spec:
      tls:
      - hosts:
      foo.bar.com
      secretName: foo-secret

You may also wants to check these links/documentation, which can help you.

Link 1 Link 2 Link 3

| improve this answer | |
  • Thank you. What about the cert themselves. Google app appears to offer auto update of certs, like wise so does "lets encrypt". Any what to automate the cert refresh when using ingress ? – grabbag Mar 2 '18 at 1:13
  • There is a feature request in place for automated certificate management. You can "star" this feature request to show your interest in this feature. – N Singh Mar 2 '18 at 1:42
  • I cant find documentation on the timestamp "last_updated" in your "Link 3". Does anyone know what this does? – grabbag Mar 2 '18 at 12:04
  • @grabbag I could not find any documentation on "last_updated" label as well. However, as per the comment describing the label 'last_update' in ingress.yaml file, it is 'Timestamp used in order to force reload of the secret'. It should work just using the 'kubectl apply -f ingress_file.yaml' as well. – N Singh Mar 6 '18 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.