Kubernetes has a lot of support and open-source tools to contribute to the cloud-native project. one of the scopes is the ingress, k8s has a support ingress, you might concern nginx ingress that a very famous ingress in k8s. azure has ingress to work well with an azure cloud environment, that is Application Gateway. The Application Gateway Ingress Controller allows Azure Application Gateway to be used as the ingress for an Azure Kubernetes Service aka AKS cluster.
In this guide, you'll learn how to configure Secure HTTP with Cert-Manager and AGIC. Before getting starting you should have the following requirements.
- AKS Cluster
- Azure Subscriptions
- kubectl installed on your local machine
Step 1 -- Create application gateway
Create public ip to used by application gateway as front end IP.
az network public-ip create -n myPublicIp -g myResourceGroup --allocation-method Static --sku Standard
Create new subnet within AKS vnet.
az network vnet subnet create -g MyResourceGroup --vnet-name MyVnet -n MySubnet --address-prefixes 10.226.0.0/24
Create Application gateway within AKS vnet, with different subnet. this guide you will create application gateway with Tier Standard, which is isn't act as WAF.
az network application-gateway create -n myApplicationGateway -l eastus -g myResourceGroup --sku Standard_v2 --public-ip-address myPublicIp --vnet-name myVnet --subnet mySubnet --priority 100
Step 2 -- Enable add-ons to AKS
after success create app gateway, you need to enable the application gateway with AKS cluster,
appgwId=$(az network application-gateway show -n myApplicationGateway -g myResourceGroup -o tsv --query "id")
az aks enable-addons -n myCluster -g myResourceGroup -a ingress-appgw --appgw-id $appgwId
Step 2 -- Deploy sample app
Create deployment and service app, you will deploy sample HTML 5 game.
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: clumsy-bird
name: clumsy-bird
spec:
selector:
matchLabels:
app: clumsy-bird
replicas: 2
template:
metadata:
labels:
app: clumsy-bird
spec:
containers:
- name: clumsy-bird
image: bayhaqisptr/clumsy-bird:latest
ports:
- containerPort: 8001
---
apiVersion: v1
kind: Service
metadata:
name: clumsy-service
labels:
run: clumsy-service
spec:
type: ClusterIp
ports:
- port: 8001
protocol: TCP
selector:
app: clumsy-bird
Step 3 -- Create Ingress
Create ingress, you might notice the annotations kubernetes.io/ingress.class make sure its use azure/application-gateway to tell AKS to use application gateway as Ingress.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: clumsy-agic
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
tls:
- hosts:
- appgw-test.example.test
secretName: clumsy-tls
rules:
- host: appgw-test.example.test
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: clumsy-service
port:
number: 8001
Step 4 -- Create Issuer (Staging)
Create Issuer staging with Let's Encrypt with cert-manager
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: letsencrypt-staging
spec:
acme:
# The ACME server URL
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: user@example.com
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-staging
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: azure/application-gateway
Step 5 -- Create Issuer (Prod)
Create Issuer staging with Let's Encrypt with cert-manager
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: letsencrypt-prod
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: user@example.com
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: azure/application-gateway
Step 6 -- Ingress TLS
after success create issuer with cert-manager, you can enable https connection to handle acme challenge.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mokita-agic
annotations:
kubernetes.io/ingress.class: azure/application-gateway
cert-manager.io/issuer: letsencrypt-prod-agic
cert-manager.io/acme-challenge-type: http01
acme.cert-manager.io/http01-edit-in-place: "true"
spec:
tls:
- hosts:
- appgw-test-16769.southeastasia.cloudapp.azure.com
secretName: mokita-agic
rules:
- host: appgw-test-16769.southeastasia.cloudapp.azure.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: mokita-service
port:
number: 80
Conclusion
In Cloud Native world has many project available to explore. for example k8s has many ingress support to use, link nginx ingress, ingress nginx, kong, agic, etc.
This guide cover some step to configure let's encrypt with agic ingress
Top comments (0)