Let’s Encrypt and Rancher 2.0 with cert-manager

1 - Preparing the enviroment

kubectl is running (https://kubernetes.io/docs/tasks/tools/install-kubectl/)
Download the kubeconfig file (Rancher > Global > Clusters > [Cluster] > Download Kubeconfig File)
Put this into ~/.kube/config:

2 - Install cert-manager on Rancher

Install cert-manager on project level.

Rancher > [Cluster] > [Project] > Apps > Launch
Find cert-manager and [view details]
Set false the option Create Default Cluster Issuer
Set cluster as Available Roles
Then Launch

3 - Install ingress-nginx

# ingress
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml

# load balancer
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/cloud-generic.yaml

4 - Apply the issuer

The issuer is the the layer of comunication between rancher and the letsencrypt.

The content of the file is in: 1-create-prod-issuer.yaml

Change your e-mail on line 9
Run:

kubectl create -f 1-create-prod-issuer.yaml

To view the result, just run: kubectl describe Issuer letsencrypt-staging

5 - Create the ingress

This example uses two hosts: apisslteste.brasilsabido.com.br and apisslteste2.brasilsabido.com.br.

The file to run is 2-create-ingress.yaml.

On line 4, set your ingress name (any name);
On line 12, set the domains list for the ingress;
On lines 18 and 26, is used theese domains;
On lines 22 and 30, set your service name.
Run:

kubectl create -f 2-create-ingress.yaml

5.1 - Creating ingress by rancher interface

Configure the ingress
In ssl/tls, add certificate, then set your host
use the follow annotations:

kubernetes.io/ingress.class=nginx
certmanager.k8s.io/cluster-issuer=letsencrypt-prod
kubernetes.io/tls-acme="true"

Save
An anoing bug is that sometimes the value yaml for spec > tls > hosts > secretName is not filled. This means, that is necessary go [View/Edit Yaml] and add the secret name:

#[...]
  tls:
  - hosts:
    - geoapi.brasilsabido.com.br
    # ADD_THE_NEXT_LINE
    secretName: letsencrypt-prod
status:
  loadBalancer:
#[...]

References

Troubleshooting

If the message customresourcedefinitions.apiextensions.k8s.io "certificates.certmanager.k8s.io" already exists, is necessary delete the customresourcedefinition.

kubectl get customresourcedefinition | certmanager
kubectl delete customresourcedefinition challenges.certmanager.k8s.io

verissimor/letsencrypt-rancher-cert-manager-config