mattjmcnaughton/personal-k8s

Support and enforce SSL for external services

Closed this issue · 4 comments

mattjmcnaughton commented

Issue
Currently, the only external service I host on Kubernetes (my blog) supports just http connections. I'd like to support, and potentially even force, SSL for all external services I run on Kubernetes.

Implementation
cert-manager appears to be the recommended method for doing this.

Definition of Done

  • https://mattjmcnaughton.com works.
  • NextCloud is exposed on public internet over HTTPs.
  • I have some form of monitoring/alerting on SSL certificate expiration.
  • Blog post.
mattjmcnaughton commented

Also check out https://github.com/kubernetes-incubator/external-dns for managing external DNS and https://kubernetes.github.io/ingress-nginx/ for managing the ingress.

mattjmcnaughton commented

Once we make this change, add authentication to our applications and expose them publicly.

mattjmcnaughton commented

Also, during this migration, we'll ensure that our cluster only ever needs one ELB, and we perform all routing via ingress.