Skip to content

Instantly share code, notes, and snippets.

@darron
Last active Mar 8, 2017
Embed
What would you like to do?
Full Yaml for Kubernetes TLS Ingress with Let's Encrypt Certificates.
apiVersion: v1
kind: Namespace
metadata:
name: kube-lego
---
apiVersion: v1
metadata:
name: kube-lego
namespace: kube-lego
data:
# modify this to specify your address
lego.email: "email@example.com"
# configure letencrypt's production api
lego.url: "https://acme-v01.api.letsencrypt.org/directory"
kind: ConfigMap
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: kube-lego
namespace: kube-lego
spec:
replicas: 1
template:
metadata:
labels:
app: kube-lego
spec:
containers:
- name: kube-lego
image: jetstack/kube-lego:0.1.3
imagePullPolicy: Always
ports:
- containerPort: 8080
env:
- name: LEGO_EMAIL
valueFrom:
configMapKeyRef:
name: kube-lego
key: lego.email
- name: LEGO_URL
valueFrom:
configMapKeyRef:
name: kube-lego
key: lego.url
- name: LEGO_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: LEGO_POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
readinessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 5
timeoutSeconds: 1
apiVersion: v1
kind: Namespace
metadata:
name: nginx-ingress
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: default-http-backend
namespace: nginx-ingress
spec:
replicas: 1
template:
metadata:
labels:
app: default-http-backend
spec:
containers:
- name: default-http-backend
# Any image is permissable as long as:
# 1. It serves a 404 page at /
# 2. It serves 200 on a /healthz endpoint
image: gcr.io/google_containers/defaultbackend:1.0
livenessProbe:
httpGet:
path: /healthz
port: 8080
scheme: HTTP
initialDelaySeconds: 30
timeoutSeconds: 5
ports:
- containerPort: 8080
resources:
limits:
cpu: 10m
memory: 20Mi
requests:
cpu: 10m
memory: 20Mi
---
apiVersion: v1
kind: Service
metadata:
name: default-http-backend
namespace: nginx-ingress
spec:
ports:
- port: 80
targetPort: 8080
protocol: TCP
selector:
app: default-http-backend
---
apiVersion: v1
data:
proxy-connect-timeout: "15"
proxy-read-timeout: "600"
proxy-send-imeout: "600"
hsts-include-subdomains: "false"
body-size: "64m"
server-name-hash-bucket-size: "256"
kind: ConfigMap
metadata:
namespace: nginx-ingress
name: nginx
---
apiVersion: v1
kind: Service
metadata:
name: nginx
namespace: nginx-ingress
annotations:
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "600"
service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
spec:
type: LoadBalancer
ports:
- port: 80
name: http
- port: 443
name: https
selector:
app: nginx
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: nginx
namespace: nginx-ingress
spec:
replicas: 1
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: gcr.io/google_containers/nginx-ingress-controller:0.8.3
name: nginx
imagePullPolicy: Always
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
livenessProbe:
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 30
timeoutSeconds: 5
ports:
- containerPort: 80
- containerPort: 443
args:
- /nginx-ingress-controller
- --default-backend-service=nginx-ingress/default-http-backend
- --nginx-configmap=nginx-ingress/nginx
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: INGRESS_NAME
namespace: INGRESS_NAMESPACE
annotations:
kubernetes.io/tls-acme: "true"
kubernetes.io/ingress.class: "nginx"
spec:
tls:
- hosts:
- INGRESS_DOMAIN_NAME
secretName: INGRESS_SECRET_NAME
rules:
- host: INGRESS_DOMAIN_NAME
http:
paths:
- path: /
backend:
serviceName: SERVICE_NAME
servicePort: SERVICE_PORT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment