Skip to content

Instantly share code, notes, and snippets.

@pydevops

pydevops/gke-ingress-manged-tls.md

Last active August 10, 2023 09:20
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save pydevops/c67870b567bb9b4e07b440e0a01c913b to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save pydevops/c67870b567bb9b4e07b440e0a01c913b to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. pydevops revised this gist May 16, 2023. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions gke-ingress-manged-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,6 @@
    # GKE ingress in a nutshell
    * https://medium.com/google-cloud/ingress-in-google-kubernetes-products-f22ded21f4ed

    # Solution #1 (ManagedCertificate CRD in GKE)
    * [GKE with Google-managed SSL certificates](https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs)
    * Use ManagedCertificate CRD to create a object.
  2. pydevops revised this gist Nov 14, 2021. 1 changed file with 8 additions and 0 deletions.
    8 changes: 8 additions & 0 deletions gke-ingress-manged-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -41,6 +41,14 @@ spec:

    `ingress.gcp.kubernetes.io/pre-shared-cert` is used by `ingress-gce`

    # Solution # 3 (k8s secrets)

    * https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl#specifying_certificates_for_your_ingress

    ```bash
    kubectl create secret tls ci-example \
    --cert ci-example.pem --key ci-example-key.pem
    ```

    # SNI with multiple certficates
    * https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl#google-managed-certs_1
  3. pydevops revised this gist Nov 14, 2021. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions gke-ingress-manged-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -40,3 +40,7 @@ spec:
    ```

    `ingress.gcp.kubernetes.io/pre-shared-cert` is used by `ingress-gce`


    # SNI with multiple certficates
    * https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl#google-managed-certs_1
  4. pydevops revised this gist Nov 14, 2021. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions gke-ingress-manged-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +1,9 @@
    # Solution #1 (Use ManagedCertificate CRD)
    # Solution #1 (ManagedCertificate CRD in GKE)
    * [GKE with Google-managed SSL certificates](https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs)
    * Use ManagedCertificate CRD to create a object.
    * Associate the ManagedCertificate object to an Ingress by adding an annotation networking.gke.io/managed-certificates to the Ingress. This annotation is a comma-separated list of ManagedCertificate resources, cert1,cert2,cert3 for example.

    # Solution #2 (Import a tls cert)
    # Solution #2 (Google Cloud SSL Certificate)
    ## Assumption
    Assumes you are using the default L7 GLBC ingress controller. default for GKE cluster.
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)
    @@ -22,7 +22,7 @@ gcloud compute ssl-certificates describe ci-example
    ```
    Please note with a correct configuration the total time for provisioning certificates is likely to take from 30 to 60 minutes.

    ## configure the GKE ingress
    ## configure the GKE ingress with a preshared cert
    * https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress#summary_of_external_ingress_annotations

    ```
  5. pydevops revised this gist Mar 19, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion gke-ingress-manged-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@

    # Solution #2 (Import a tls cert)
    ## Assumption
    Assumes you are using the default L7 GCLB ingress controller. default for GKE cluster.
    Assumes you are using the default L7 GLBC ingress controller. default for GKE cluster.
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)

    ## create a certficate
  6. pydevops renamed this gist Mar 19, 2021. 1 changed file with 0 additions and 0 deletions.
    0 gcp-tls.md → gke-ingress-manged-tls.md
    View file
    File renamed without changes.
  7. pydevops revised this gist Mar 19, 2021. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions gcp-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +1,9 @@
    # Solution #1
    # Solution #1 (Use ManagedCertificate CRD)
    * [GKE with Google-managed SSL certificates](https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs)
    * Use ManagedCertificate CRD to create a object.
    * Associate the ManagedCertificate object to an Ingress by adding an annotation networking.gke.io/managed-certificates to the Ingress. This annotation is a comma-separated list of ManagedCertificate resources, cert1,cert2,cert3 for example.

    # Solution #2
    # Solution #2 (Import a tls cert)
    ## Assumption
    Assumes you are using the default L7 GCLB ingress controller. default for GKE cluster.
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)
  8. pydevops revised this gist Mar 19, 2021. 1 changed file with 8 additions and 6 deletions.
    14 changes: 8 additions & 6 deletions gcp-tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,30 +1,32 @@
    # Solution #1
    * [GKE with Google-managed SSL certificates](https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs)
    * Create a ManagedCertificate object.
    * Use ManagedCertificate CRD to create a object.
    * Associate the ManagedCertificate object to an Ingress by adding an annotation networking.gke.io/managed-certificates to the Ingress. This annotation is a comma-separated list of ManagedCertificate resources, cert1,cert2,cert3 for example.

    # Solution #2
    ## Assumption
    Assumes you are using the default L7 GLBC ingress controller. default for GKE cluster.
    Assumes you are using the default L7 GCLB ingress controller. default for GKE cluster.
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)

    ## create a certficate
    ```
    gcloud beta compute ssl-certificates create ci-example --domains ci.example.com
    gcloud compute ssl-certificates create ci-example --domains ci.example.com
    ```
    ## list a certifcate
    ```
    gcloud beta compute ssl-certificates list
    gcloud compute ssl-certificates list
    ```
    ## checking certificate provisoning status
    ```
    gcloud beta compute ssl-certificates describe ci-example
    gcloud compute ssl-certificates describe ci-example
    ```
    Please note with a correct configuration the total time for provisioning certificates is likely to take from 30 to 60 minutes.

    ## configure the GKE ingress
    * https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress#summary_of_external_ingress_annotations

    ```
    apiVersion: extensions/v1beta1
    apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
    name: ci
  9. pydevops renamed this gist Feb 4, 2021. 1 changed file with 0 additions and 0 deletions.
    0 gcp_tls.md → gcp-tls.md
    View file
    File renamed without changes.
  10. pydevops revised this gist Apr 14, 2019. 1 changed file with 5 additions and 2 deletions.
    7 changes: 5 additions & 2 deletions gcp_tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +1,12 @@
    ## References
    # Solution #1
    * [GKE with Google-managed SSL certificates](https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs)
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)
    * Create a ManagedCertificate object.
    * Associate the ManagedCertificate object to an Ingress by adding an annotation networking.gke.io/managed-certificates to the Ingress. This annotation is a comma-separated list of ManagedCertificate resources, cert1,cert2,cert3 for example.

    # Solution #2
    ## Assumption
    Assumes you are using the default L7 GLBC ingress controller. default for GKE cluster.
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)

    ## create a certficate
    ```
  11. pydevops revised this gist Apr 14, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion gcp_tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    ## References
    * [GKE with Google-managed SSL certificates]https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs
    * [GKE with Google-managed SSL certificates](https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs)
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)

    ## Assumption
  12. pydevops revised this gist Apr 14, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion gcp_tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    ## References
    * [Creating and Using SSL Certificates](https://cloud.google.com/load-balancing/docs/ssl-certificates)
    * [GKE with Google-managed SSL certificates]https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)

    ## Assumption
  13. pydevops revised this gist Oct 19, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion gcp_tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -19,7 +19,7 @@ gcloud beta compute ssl-certificates describe ci-example
    ```
    Please note with a correct configuration the total time for provisioning certificates is likely to take from 30 to 60 minutes.

    ## modify the ingress
    ## configure the GKE ingress
    ```
    apiVersion: extensions/v1beta1
    kind: Ingress
  14. pydevops created this gist Oct 19, 2018.
    37 changes: 37 additions & 0 deletions gcp_tls.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    ## References
    * [Creating and Using SSL Certificates](https://cloud.google.com/load-balancing/docs/ssl-certificates)
    * [ingress-gce](https://github.com/kubernetes/ingress-gce)

    ## Assumption
    Assumes you are using the default L7 GLBC ingress controller. default for GKE cluster.

    ## create a certficate
    ```
    gcloud beta compute ssl-certificates create ci-example --domains ci.example.com
    ```
    ## list a certifcate
    ```
    gcloud beta compute ssl-certificates list
    ```
    ## checking certificate provisoning status
    ```
    gcloud beta compute ssl-certificates describe ci-example
    ```
    Please note with a correct configuration the total time for provisioning certificates is likely to take from 30 to 60 minutes.

    ## modify the ingress
    ```
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
    name: ci
    namespace: ci
    annotations:
    ingress.gcp.kubernetes.io/pre-shared-cert: 'ci-example'
    spec:
    backend:
    serviceName: jenkins-ui
    servicePort: 8080
    ```

    `ingress.gcp.kubernetes.io/pre-shared-cert` is used by `ingress-gce`