Setting up Ingress

Follow these steps in order to expose SuprSend services.

Set up Nginx Ingress Controller

New Namespace

First create a new namespace to install the Nginx Ingress Controller.

kubectl create namespace ingress-nginx

Install the official Helm chart

Add the repo.

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

Then install the chart.

helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --version 4.12.1 \
  --set controller.publishService.enabled=true

Verify it’s deployed and running:

kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

You should see a LoadBalancer type service named ingress-nginx-controller.

Get the Ingress Controller’s hostname

This will be your ingress endpoint.

kubectl get svc ingress-nginx-controller -n ingress-nginx \
  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

Keep this hostname handy - you’ll need it for DNS or certificate validation.

Set up DNS (Important)

For each of those hostnames required by SuprSend, setup an A or CNAME record (based on the load balancer type) in your DNS zone. Each of those records should point at the load balancer host name mentioned above.

This is a pre-requisite step before configuring Cert Manager. Cert Manager will not setup/renew SSL certificates unless the DNS records point at the load balancer address.

Set up Cert Manager

New Namespace

kubectl create namespace cert-manager

Install the chart

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v1.17.1 \
  --set installCRDs=true

Check if all pods are up:

kubectl get pods -n cert-manager

Create the Let’s Encrypt ClusterIssuer

Create a file named cluster-issuer.yaml:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <your-email@example.com> # replace it with your work email address
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            class: nginx

Apply it:

kubectl apply -f cluster-issuer.yaml

Verify if it is created:

kubectl get clusterissuer letsencrypt-prod -o yaml

Configuring Ingress for each service

Then for service that needs ingress in SuprSend chart, pass the following values under ingress in Values.yaml of SuprSend chart:

<service-name>:
  ingress:
    annotations:
        nginx.ingress.kubernetes.io/rewrite-target: "/"
        cert-manager.io/cluster-issuer: "letsencrypt-prod"
    ingressClassName: "nginx" 
    host: <hostname of the service>
    tlsSecretKey: <unique key for each service>

annotations are required for Cert Manager to automatically generate a new SSL cert for the host name provided.
ingressClassName is “nginx” since we used Nginx as our Ingress controller.
host must be the domain used to expose the service.
tlsSecretKey is the name of Kubernetes secret where SSL cert’s SSL cert and Private key will be stored by Cert Manager. This should be unique for each ingress service.

Upgrade/Install the SuprSend chart now with updated values.yaml. Chart will configure Ingress for each service with above values. And for each of the services & ingress and host names, Cert Manager will begin to create certificates, fulfil HTTP challenges and make the certificates ready for use in Service ingresses automatically. Cert Manager will also renew the certificates automatically when expiry date arrives, provided the DNS records created earlier in your DNS zone are still present. After installing/upgrading the chart, use the following command to verify if SSL certificates are provisioned & ready.

kubectl get certificate -A

Check Ingresses using this command:

kubectl get ingress -n <namespace of chart installation>

Getting Started

Installation

Post-Installation

CLI & Automation

Updates and Versioning

Set up Nginx Ingress Controller

New Namespace

Install the official Helm chart

Get the Ingress Controller’s hostname

Set up DNS (Important)

Set up Cert Manager

New Namespace

Install the chart

Create the Let’s Encrypt ClusterIssuer

Configuring Ingress for each service

​Set up Nginx Ingress Controller

​New Namespace

​Install the official Helm chart

​Get the Ingress Controller’s hostname

​Set up DNS (Important)

​Set up Cert Manager

​New Namespace

​Install the chart

​Create the Let’s Encrypt ClusterIssuer

​Configuring Ingress for each service

Set up Nginx Ingress Controller

New Namespace

Install the official Helm chart

Get the Ingress Controller’s hostname

Set up DNS (Important)

Set up Cert Manager

New Namespace

Install the chart

Create the Let’s Encrypt ClusterIssuer

Configuring Ingress for each service