https://github.com/cartyc/gke-and-cert-manager
https://github.com/cartyc/gke-and-cert-manager
Last synced: 5 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/cartyc/gke-and-cert-manager
- Owner: cartyc
- License: apache-2.0
- Created: 2021-06-10T14:02:59.000Z (about 5 years ago)
- Default Branch: main
- Last Pushed: 2021-06-10T19:59:31.000Z (about 5 years ago)
- Last Synced: 2025-02-28T13:30:56.494Z (over 1 year ago)
- Size: 8.79 KB
- Stars: 1
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
This is repo is meant to be for Demonstration purposes only.
## Create Kubernetes Cluster
For this demo we'll create a Private GKE cluster to deploy our app and cert-manager too.
First up lets set our environment variables.
```
export PROJECT_ID=$(gcloud config get-value project)
export NETWORK=knet # Name of Network to be Created
export SUBNET=knet-subnet # Name of Subnet to be created
export REGION=northamerica-northeast1-a # Montreal Region. Change to your preffered region.
export MACHINE_TYPE=e2-standard-4
export CLUSTER=cert-manager
```
Now let's create the cluster
```
gcloud beta container clusters create $CLUSTER --enable-binauthz \
--machine-type $MACHINE_TYPE --image-type cos_containerd --num-nodes 3 \
--enable-shielded-nodes --no-enable-basic-auth --enable-ip-alias --shielded-secure-boot \
--workload-pool ${PROJECT_ID}.svc.id.goog --network $NETWORK --create-subnetwork name=${SUBNET} --zone $REGION \
--enable-dataplane-v2 \ # Cilium Container Network
--enable-stackdriver-kubernetes \
--enable-private-nodes \ # Omit this line and the next two if you don't need a private cluster
--master-ipv4-cidr 172.16.0.32/28 \
--enable-master-authorized-networks --master-authorized-networks youreip/32
```
## Create the NAT (Ignore if you aren't using a private cluster)
Creating the NAT will allow outbound internet connections so you will be able to download the required containers.
```
gcloud compute routers create nat-router \
--network $NETWORK \
--region $REGION
gcloud compute routers nats create nat-config \
--router-region $REGION \
--router nat-router \
--nat-all-subnet-ip-ranges \
--auto-allocate-nat-external-ips
```
## Install Cert-Manager
More detailed installation options can be found in the cert-manager [docs](https://cert-manager.io/docs/installation/kubernetes/).
```
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.3.1/cert-manager.yaml
```
## Create a Static IP
```
gcloud compute addresses create cert-manager-demo \
--global \
--ip-version IPV4
```
## Update the Ingress and Apply the Kubernetes Configs
If you choose another name for the static IP you will need to update the `kubernetes.io/ingress.global-static-ip-name` in the ingress (`deploy/ingress.yaml`).
```
name: demo-ingress
namespace: demo-app
annotations:
kubernetes.io/ingress.class: "gce"
cert-manager.io/cluster-issuer: letsencrypt-prod
acme.cert-manager.io/http01-edit-in-place: "true"
kubernetes.io/ingress.global-static-ip-name: "cert-manager-demo" <-- Change me
```
Once that is complete you can go ahead and apply your changes.
```
kubectl apply -f deploy/
```
It should take 5-10 mins for the LB to spin up and get the cert applied. If you haven't already done so you should point your DNS to the generated static IP. To get the IP you can describe the address using gcloud `gcloud compute addresses describe cert-manager-demo --global` or by looking at the ingress resource created in GKE `kubectl get ingress`.