metallb VS cert-manager

Not to take anything away from OP but MetalLB also provides local load balancing.

Quoting from their docs:

metalLB to manage bare-metal LoadBalancer services - WIP - Only L2 configuration can be set-up via playbook.

MetalLB

Set up MetalLB https://metallb.universe.tf/ either via helm or simple manifest. Pick a range of ips to allocate, and assign via manifest https://metallb.universe.tf/configuration/

metalLB to manage bare-metal LoadBalancer services - WIP - Only L2 configuration can be set-up via playbook.

-- MetalLB

We need at least one root certificate. In turn, it will generate all other certificates. While it's possible to do every manually, I'll rely on cert-manager in Kubernetes. As its name implies, cert-manager is a solution to manage certificates.

Cert Manager

You know cert-manager already exists, right?

For the average developer an Ingress is substantially simpler to understand. For an expert such as yourself there are additional annotations which may be added, to use nginx specfic features. However the big win using the nginx ingress controller is integration with other Kubernetes features like cert manager and External DNS

- name: Deploy cert-manager kubernetes.core.helm: release_name: cert-manager release_namespace: cert-manager create_namespace: true wait: true chart_ref: cert-manager chart_repo_url: https://charts.jetstack.io values: installCRDs: true - name: Deploy trust-manager kubernetes.core.helm: release_name: cert-manager-trust release_namespace: cert-manager create_namespace: true wait: true chart_ref: cert-manager-trust chart_repo_url: https://charts.jetstack.io values: installCRDs: true - name: Create Root Issuer kubernetes.core.k8s: state: present definition: apiVersion: cert-manager.io/v1 kind: Issuer metadata: namespace: cert-manager name: root-issuer spec: # Example uses self-signed # It is advisable to utilize a different kind of Issuer # for production selfSigned: {} - name: Create Root CA Certs kubernetes.core.k8s: state: present definition: apiVersion: cert-manager.io/v1 kind: Certificate metadata: namespace: cert-manager name: root-ca spec: isCA: true # Omitted multiple values. # https://cert-manager.io/docs/usage/certificate/ # for full Certificate spec secretName: root-ca privateLey: algorithm: ECDSA size: 256 issuerRef: name: root-issuer kind: Issuer group: cert-manager.io - name: Create Cluster Issuer kubernetes.core.k8s: state: present definition: apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: cluster-issuer namespace: cert-manager spec: ca: secretName: root-ca - name: Create Root CA Chain bundle kubernetes.core.k8s: state: present definition: apiVersion: trust.cert-manager.io/v1alpha1 kind: Bundle metadata: name: root-bundle namespace: cert-manager spec: sources: - secret: name: root-ca key: ca.crt target: configMap: key: root.ca.crt

Long story short: We use cert-manager to generate TLS certitifates. Works perfectly. The problem is that I need the certificate at the Azure Application Gateway (TLS/SSL termination past the gateway) level, which in turn requires the certificate to be present at the Azure Key Vault.

You can also use cert-manager to automatically obtain and renew certificates.

# deploy cert-manager (MoeLove) ➜ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml # deploy ARC (MoeLove) ➜ helm repo add actions-runner-controller https://actions-runner-controller.github.io/actions-runner-controller (MoeLove) ➜ helm upgrade --install --namespace actions-runner-system --create-namespace\ --set=authSecret.create=true\ --set=authSecret.github_token="REPLACE_YOUR_TOKEN_HERE"\ --wait actions-runner-controller actions-runner-controller/actions-runner-controller # create runner (MoeLove) ➜ cat <

When paired with Cert Manager, and using Vultr for my DNS server, I can issue valid LetsEncrypt certificates with a DNS01 challenge. So I don't need to worry about having an application being open to the internet on port 80 in order to avoid browser warnings.

Link to GitHub Repository