K3s is a Certified Kubernetes distribution designed for production workloads in unattended, resource-constrained, remote locations or inside IoT appliances.
It provides a ready to go Kubernetes instance packaged a single binary.
This guide will show you how to easily set up k3s with HTTPS via Let’s Encrypt.
(READMORE)
K3s comes with Traefik out of the box. Traefik itself supports automatic HTTPS via Let’s Encrypt, but setting this up with k3s turned out to be pretty cumbersome. Instead using the excellent cert-manager add-on, it's a breeze!
0: Setup k3s.
This guide assumes you have a working k3s instance and kubectl configured to talk to your k3s instance. If you haven't already just follow the docs and you'll be up and running in minutes.
1. Install Helm
Helm is a package manager for Kubernetes. It consists of a local client and a server component.
Installing Helm is quite straightfoward.
Install the client:
$ brew install kubernetes-helm
Create the service account so Helm can interact with your k3s instance:
$ kubectl create serviceaccount tiller --namespace=kube-system
Grant it admin privileges:
$ kubectl create clusterrolebinding tiller-admin --serviceaccount=kube-system:tiller --clusterrole=cluster-admin
Note: granting admin privileges to Helm might not be a good idea depending on how your cluster is setup. Read here for more details.
Install Helm on k3s:
$ helm init --service-account=tiller
2. Install cert-manager
Alright, so now we have Helm installed let's move on to installing cert-manager.
cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources, amongst which Let’s Encrypt.
Start with installing cert-managers CRDs:
$ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.8/deploy/manifests/00-crds.yaml
Add the cert-manager Helm repo:
$ helm repo add jetstack https://charts.jetstack.io && helm repo update
Install cert-manager:
$ helm install \
--name cert-manager \
--namespace cert-manager \
--version v0.8.1 \
jetstack/cert-manager
This might take a minute or so. Verify the installation by checking all cert-manager pods are running:
$ kubectl get all -n cert-manager
3. Configure cert-manager
With cert-manager installed we need to configure it to use Let’s Encrypt, by creating a certificate issuer:
$ cat <<EOF > letsencrypt-prod-issuer.yaml
apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
name: letsencrypt-prod
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration, update to your own.
email: user@example.com
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
http01: {}
EOF
And apply it:
$ kubectl apply -f letsencrypt-prod-issuer.yaml
By now, cert-manager is ready to provision Let’s Encrypt certificates as we need it.
4. Deploy a service with automatic HTTPS
To try this out let's deploy a simple service. You should have a DNS name pointed to your k3s cluster for this to work. The example below uses bootcamp.k3s.example.org, be sure to update this to your own hostname!
Create the manifest:
$ cat <<EOF > k8s-bootcamp.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: k8s-bootcamp
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: k8s-bootcamp
template:
metadata:
labels:
app: k8s-bootcamp
spec:
containers:
- name: k8s-bootcamp
image: gcr.io/google-samples/kubernetes-bootcamp:v1
---
apiVersion: v1
kind: Service
metadata:
name: k8s-bootcamp
namespace: default
spec:
ports:
- name: http
targetPort: 8080
port: 80
selector:
app: k8s-bootcamp
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: k8s-bootcamp
annotations:
kubernetes.io/ingress.class: "traefik"
certmanager.k8s.io/issuer: "letsencrypt-prod"
certmanager.k8s.io/acme-challenge-type: http01
spec:
tls:
- hosts:
# Change this to your own hostname
- bootcamp.k3s.example.org
secretName: bootcamp-k3s-example-org-tls
rules:
# Change this to your own hostname
- host: bootcamp.k3s.example.org
http:
paths:
- path: /
backend:
serviceName: k8s-bootcamp
servicePort: http
EOF
And apply it:
$ kubectl apply -f k8s-bootcamp.yaml
Wait a minute or so and your endpoint should become available with a Let’s Encrypt certificate! 🎉
Top comments (0)