Setup Ingress Controller With Crusoe Load Balancer and Cert-Manager for SSL on Crusoe Managed Kubernetes

git clone https://github.com/crusoecloud/crusoe-load-balancer-controller-helm-charts.git
helm install crusoe-lb-controller crusoe-load-balancer-controller-helm-charts/charts/crusoe-lb-controller --namespace crusoe-system

-> The Crusoe Load Balancer Controller automates the provisioning and management of Crusoe Cloud load balancers for Kubernetes Service objects of type LoadBalancer.

More information on setting up Crusoe Load Balancers on CMK can be found in KB How-To Create a Crusoe Cloud Load Balancer for a CMK Cluster.

2. Setting up Ingress Controller Deployment

-> Values.yaml file with required configuration

$ cat ingress-nginx-values.yaml

controller:
  replicaCount: 1

  config:
    worker-rlimit-nofile: "65536"
    worker-processes: "auto"
    worker-connections: "16384"

  resources:
    limits:
      memory: 1Gi
      cpu: 1000m
    requests:
      memory: 512Mi
      cpu: 500m

  service:
    type: LoadBalancer

  admissionWebhooks:
    enabled: true

  metrics:
    enabled: false

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install ingress-nginx ingress-nginx/ingress-nginx --namespace ingress-nginx --create-namespace --values ingress-nginx-values.yaml

kubectl get svc -n ingress-nginx

NAME                                 TYPE           CLUSTER-IP       EXTERNAL-IP      PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.233.***.***   <External IP>    80:30407/TCP,443:31693/TCP   4m11s
ingress-nginx-controller-admission   ClusterIP      10.233.***.***   <none>           443/TCP                      4m11s

nslookup xyz.crusoecloudcompute.site

Server:		1.1.1.1
Address:	1.1.1.1#53

Non-authoritative answer:
Name:	xyz.crusoecloudcompute.site
Address: <External IP>

crusoe networking vpc-firewall-rules create \
  --name nginx-ingress-fw-rule \
  --action ALLOW \
  --destination-ports 30407,31693 \
  --destinations 172.27.32.0/20 \
  --protocols tcp \
  --source-ports 1-65535 \
  --sources 0.0.0.0/0 \
  --direction INGRESS \
  --vpc-network-id a7a08e04-32bb-4c0c-a5ce-4c2bf311f66a

nc -zv xyz.crusoecloudcompute.site 443

3. Install Cert-Manager via Helm to automate getting and renewing TLS certificates

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.18.2 --set installCRDs=true

$ cat cluster-issuer-cert-manager.yaml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: xyz@crusoe.ai
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

kubectl apply -f cluster-issuer-cert-manager.yaml

-> Ingress Resource Creation

Example:

$ cat xyz-backend-ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: xyz-backend-ingress
  namespace: xyz-backend
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  rules:
  - host: xyz.crusoecloudcompute.site
    http:
      paths:
      - backend:
          service:
            name: xyz-backend-traefik
            port:
              name: http
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - xyz.crusoecloudcompute.site
    secretName: xyz-backend-tls

-> Here create Ingress resource for the domain xyz.crusoecloudcompute.site with annotation cert-manager.io/cluster-issuer: letsencrypt-prod

• Here we specify that all traffic for the domain (xyz.crusoecloudcompute.site) should be routed to the xyz-backend-traefik service.

• Ensure to add the specific annotation that tells Cert-Manager to get a certificate for this hostname from the ClusterIssuer we created earlier.

• Also, declare the name of the Secret (e.g., xyz-backend-tls) where Cert-Manager should store the issued certificate.

kubectl apply -f xyz-backend-ingress.yaml

kubectl get certificate -A

NAMESPACE       NAME            READY   SECRET            AGE
xyz-backend   xyz-backend-tls   True    xyz-backend-tls   55s

• Cert-Manager discovers new Ingress resource creation.

• Cert-Manager then automatically requests a new certificate from Let's Encrypt.

• Cert-Manager performs the HTTP challenge to prove we own the domain.

• Upon successful validation, Cert-Manager creates the xyz-backend-tls secret with a valid, signed certificate and private key.

• Then the ingress controller automatically reloads its configuration and begins serving HTTPS traffic using the new, trusted certificate.

Next we need to create StorageClass objects, PersistentVolumes(PVs), and PersistentVolumeClaims (PVCs) with the desired configuration. Refer to How-To Use the Crusoe CSI Driver With CMK Clusters for examples.

--

Additionally to setup monitoring, you can follow How-To Install Observability in a Crusoe Managed Kubernetes Cluster

Additional Resources

• Kubernetes - Ingress Controller
• CMK - AddOns
• CertManager - ClusterIssuer