Can I use Google Managed Certificate in Google Kubernetes engine with NGINX INGRESS Controller?

user_8140137 0
Viewed 1243

I have a NGINX Ingress in my GKE. I want make my URL secure. But I unfortunately I am unable to achieve that via cert-manager. I see an option to create Managed Certificates. But I am not sure if there is an annotation that allow me to use google managed certificate in NGINX Ingress. Controller.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-https
  namespace: non-default
  annotations:
    kubernetes.io/ingress.allow-http: "false"
    kubernetes.io/ingress.class: "nginx"
    networking.gke.io/managed-certificates: "managed-certificate"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/issuer: "letsencrypt-production"
spec:
  tls:
    - hosts:
        - example.com
      secretName: selfsigned-cert-tls
  rules:
    - host: example.com
      http:
        paths:
          - path: "/"
            backend:
              serviceName: hello-service
              servicePort: hello-port
          - path: "/kube"
            backend:
              serviceName: hello-kubernetes
              servicePort: 80

When I create a certificate with cert-manager, certificate status is showing "Kubernetes Ingress Controller Fake Certificate"

google-kubernetes-engine cert-manager nginx-ingress
1 Answers

Using cert-manager is easier, but if you cannot use cert-manager for some reason, you can try this solution. It sets up both a GCE ingress and an nginx ingress. The GCE ingress is public, terminates the SSL but forwards to the private nginx ingress to do the routing.

helm3 install -f nginx-values.yaml ingress-nginx ingress-nginx/ingress-nginx

#nginx-values.yaml

controller:
  service:
    type: NodePort
    annotations:
      cloud.google.com/backend-config: '{"default": "backendconfig"}'
  admissionWebhooks:
    enabled: false
defaultBackend:
  enabled: true

And then create a BackendConfig and an Ingress to set up a LoadBalancer that'll talk to the nginx NodePort service.

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: backendconfig
spec:
  timeoutSec: 300
  healthCheck:
    requestPath: /healthz

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    networking.gke.io/managed-certificates: foo,bar
spec:
  backend:
    serviceName: ingress-nginx-controller
    servicePort: 80

And then you can create a ManagedCertificate and an Ingress for foo and bar, and they'll share the same LoadBalancer.

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: foo
spec:
  domains:
    - foo.example.com

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: foo
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - host: foo.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          serviceName: foo
          servicePort: 5000

Remember that every time you create a new ManagedCertificate / Ingress pair, you'll have to modify the gce ingress manifest with the name of the cert in the networking.gke.io/managed-certificates annotation.

user_913650
Related