Skip to main content

Lab 8.3 - TLS/SSL with Cert-Manager

Lab Objectives​

By the end of this lab, you will be able to:

  • Install cert-manager in the cluster.
  • Configure a ClusterIssuer for Let's Encrypt.
  • Create a TLS certificate for an Ingress.
  • Configure HTTPS with Ingress.
  • Test secure HTTPS access.

Estimated Duration​

60-75 minutes

Prerequisites​

  • kubectl installed and configured.
  • Kubernetes cluster with Ingress Controller.
  • Publicly accessible domain (or use of self-signed certificates for local testing).

Part 1: Installing cert-manager​

cert-manager is a Kubernetes operator that automates TLS certificate management.

Step 1.1: Install cert-manager​

Install cert-manager:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.1/cert-manager.yaml

Wait for cert-manager to be ready:

kubectl wait --for=condition=ready pod -l app.kubernetes.io/instance=cert-manager -n cert-manager --timeout=90s

Verify the installation:

kubectl get pods -n cert-manager

Part 2: Configuring a ClusterIssuer​

A ClusterIssuer defines how cert-manager obtains certificates (Let's Encrypt, self-signed, etc.).

Step 2.1: ClusterIssuer for Let's Encrypt (Production)​

For a public domain, create clusterissuer-letsencrypt.yaml:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: your-email@example.com # Replace with your email
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

Note: For Let's Encrypt, you must have a public domain and an Ingress accessible from the Internet.

Step 2.2: Self-Signed ClusterIssuer (Local Testing)​

For a local cluster, use a self-signed certificate:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}

Apply the self-signed ClusterIssuer:

kubectl apply -f clusterissuer-selfsigned.yaml

Verify:

kubectl get clusterissuer

Part 3: Creating a Certificate​

Step 3.1: Create a Certificate​

Create certificate-example.yaml:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: app-tls-cert
spec:
  secretName: app-tls-secret # Name of the Secret where the certificate will be stored
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
  dnsNames:
  - app.local # Hostname for the certificate

Apply the certificate:

kubectl apply -f certificate-example.yaml

Verify the status:

kubectl get certificate
kubectl describe certificate app-tls-cert

Wait for the certificate to be ready:

kubectl wait --for=condition=ready certificate app-tls-cert --timeout=60s

Verify that the Secret has been created:

kubectl get secret app-tls-secret

Part 4: Configuring the Ingress with TLS​

Step 4.1: Create an Ingress with TLS​

Create ingress-tls.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress-tls
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-issuer # Annotation for cert-manager
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.local
    secretName: app-tls-secret # Reference to the certificate Secret
  rules:
  - host: app.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-app-service
            port:
              number: 80

Note: If you use the cert-manager.io/cluster-issuer annotation, cert-manager will automatically create the certificate. Otherwise, reference the manually created Secret.

Apply the Ingress:

kubectl apply -f ingress-tls.yaml

Part 5: Testing HTTPS Access​

Step 5.1: Configure the Hostname​

Make sure app.local points to the Ingress Controller IP in /etc/hosts.

Step 5.2: Test HTTPS​

Test HTTPS access:

# Ignore self-signed certificate verification
curl -k https://app.local

Or in the browser, accept the self-signed certificate (you will see a security warning, this is normal for a self-signed certificate).

Part 6: Automatic Certificate with Annotation​

You can also let cert-manager create the certificate automatically via the annotation in the Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress-auto-tls
  annotations:
    cert-manager.io/cluster-issuer: selfsigned-issuer
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.local
    secretName: app-tls-secret-auto
  rules:
  - host: app.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-app-service
            port:
              number: 80

Cert-manager will automatically create the certificate and the Secret.

Part 7: Cleanup​

Delete the resources:

kubectl delete ingress app-ingress-tls
kubectl delete certificate app-tls-cert
kubectl delete clusterissuer selfsigned-issuer
kubectl delete secret app-tls-secret

To uninstall cert-manager:

kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.1/cert-manager.yaml

Lab Summary​

In this lab, you installed cert-manager, configured a ClusterIssuer (self-signed for local testing), created a TLS certificate, and configured an Ingress with HTTPS. You learned how to automate TLS certificate management in Kubernetes.

Next Steps​

The last lab in this module will show you how to configure multiple domains and virtual hosts with Ingress.

Lab 8.4: Multi-domains and Virtual Hosts

Lab created: December 2024