Repository navigation
Add support for K8S Ingress resources #3
Description
Since Kubernetes release 1.2.0, Ingress resources are supporting TLS. It would be great if this image would be compatible with Ingress.
What needs to be done is to change secret data format to:
"data": {
"tls.crt": "$CERT",
"tls.key": "$KEY",
"dhparam": "$DHPARAM"
}
And response with 200 HTTP code when root URI (/) is requested (for health checks).
P.S. I will be happy to prepare a PR later today.
Reacted by Trevor Hartman, Daniel Bachler, \[._.]/, Jasmine Hegman and Markus Padourek
Activity
alexcouper commentedon Apr 29, 2016
kop commentedon Apr 29, 2016
@alexcouper Something tells me that it depends on implementation. There are different types of ingress controllers available: GCE, Nginx.
I think config reloading on certificate change should be part of their job and not this package.
Alternatively, we could create new secret (in format
$SECRET_NAME_<timestamp>) when certs are updated and simply patch Ingress resource with a new value. Old secrets should not be a problem, since K8S 1.3 will come with garbage collector of unused Secrets and ConfigMaps.alexcouper commentedon Apr 29, 2016
true that would work.
The other thing that had concerned me was not knowing how to route through to letsencrypt pod for some requests (like is done in nginx-ssl-proxy) - but I see now that this is entirely possible using the nginx ingress controller
So in summary, go for it, looking forward to seeing the PR!
devth commentedon Jun 1, 2016
👍 this would be awesome!
phutchins commentedon Jul 8, 2016
I've was planning on building something quite similar to this so I used this is a starting point.
Here's what I added/changed...
I'd be glad to contribute back some of what I've done if interested...
My plans are to make this more dynamic such that on a service that you want to have SSL, simply add a label and it will dynamically get picked up and handled.
https://github.com/phutchins/kubernetes-ssl-manager
alexcouper commentedon Jul 11, 2016
@phutchins sounds fantastic. Please do contribute back and I'll happily test and merge.
txels commentedon Oct 13, 2016
Part of this has been done in #13 (including the new data keys in the secret)