Skip to content

Commit 04867be

Browse files
GuopingJiaGuopingJia
committed
Update Blog “exposing-an-application-using-ingress-and-tls-termination-on-kubernetes-in-hpe-greenlake-for-private-cloud-enterprise”
1 parent 88fd2d9 commit 04867be

File tree

1 file changed

+347
-0
lines changed

1 file changed

+347
-0
lines changed

‎content/blog/exposing-an-application-using-ingress-and-tls-termination-on-kubernetes-in-hpe-greenlake-for-private-cloud-enterprise.md

Lines changed: 347 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,353 @@ Before starting, make sure you have the following:
3636
* The kubectl CLI tool, together with the kubeconfig file for accessing the K8s cluster
3737
* The optional openssl CLI tool, for validating the generated certificates
3838

39+
### Set up load balancer
40+
41+
42+
```shell
43+
$ k get all -n metallb-system
44+
NAME READY STATUS RESTARTS AGE
45+
pod/controller-57b4fdc957-56wv8 1/1 Running 0 22m
46+
pod/speaker-c7sgk 1/1 Running 0 22m
47+
pod/speaker-dtlpm 1/1 Running 0 22m
48+
pod/speaker-gxccz 1/1 Running 0 22m
49+
pod/speaker-pwl87 1/1 Running 0 22m
50+
pod/speaker-rvvkz 1/1 Running 0 22m
51+
pod/speaker-wxd5n 1/1 Running 0 22m
52+
53+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
54+
service/webhook-service ClusterIP 10.102.54.20 <none> 443/TCP 22m
55+
56+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
57+
daemonset.apps/speaker 6 6 6 6 6 kubernetes.io/os=linux 22m
58+
59+
NAME READY UP-TO-DATE AVAILABLE AGE
60+
deployment.apps/controller 1/1 1 1 22m
61+
62+
NAME DESIRED CURRENT READY AGE
63+
replicaset.apps/controller-57b4fdc957 1 1 1 22m
64+
```
65+
66+
```shell
67+
$ k get ipaddresspools -n metallb-system
68+
NAME AUTO ASSIGN AVOID BUGGY IPS ADDRESSES
69+
cfe-pool true false ["10.6.115.251-10.6.115.254"]
70+
```
71+
72+
```shell
73+
$ k get l2advertisements -n metallb-system
74+
NAME IPADDRESSPOOLS IPADDRESSPOOL SELECTORS INTERFACES
75+
cfe-l2advert ["cfe-pool"]
76+
```
77+
78+
### Deploy Ngnix ingress controller
79+
80+
```shell
81+
$ helm upgrade --install ingress-nginx ingress-nginx \
82+
> --repo https://kubernetes.github.io/ingress-nginx \
83+
> --namespace ingress-nginx --create-namespace
84+
Release "ingress-nginx" does not exist. Installing it now.
85+
NAME: ingress-nginx
86+
LAST DEPLOYED: Wed Mar 6 18:30:55 2024
87+
NAMESPACE: ingress-nginx
88+
STATUS: deployed
89+
REVISION: 1
90+
TEST SUITE: None
91+
NOTES:
92+
The ingress-nginx controller has been installed.
93+
It may take a few minutes for the load balancer IP to be available.
94+
You can watch the status by running 'kubectl get service --namespace ingress-nginx ingress-nginx-controller --output wide --watch'
95+
96+
An example Ingress that makes use of the controller:
97+
apiVersion: networking.k8s.io/v1
98+
kind: Ingress
99+
metadata:
100+
name: example
101+
namespace: foo
102+
spec:
103+
ingressClassName: nginx
104+
rules:
105+
- host: www.example.com
106+
http:
107+
paths:
108+
- pathType: Prefix
109+
backend:
110+
service:
111+
name: exampleService
112+
port:
113+
number: 80
114+
path: /
115+
# This section is only required if TLS is to be enabled for the Ingress
116+
tls:
117+
- hosts:
118+
- www.example.com
119+
secretName: example-tls
120+
121+
If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
122+
123+
apiVersion: v1
124+
kind: Secret
125+
metadata:
126+
name: example-tls
127+
namespace: foo
128+
data:
129+
tls.crt: <base64 encoded cert>
130+
tls.key: <base64 encoded key>
131+
type: kubernetes.io/tls
132+
```
133+
134+
135+
```shell
136+
137+
guoping@guoping-vm ~/CFE/POC/ingress-nginx $ k get all -n ingress-nginx
138+
NAME READY STATUS RESTARTS AGE
139+
pod/ingress-nginx-controller-548768956f-8bz2q 1/1 Running 0 15m
140+
141+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
142+
service/ingress-nginx-controller LoadBalancer 10.108.173.7 10.6.115.251 80:32734/TCP,443:32265/TCP 15m
143+
service/ingress-nginx-controller-admission ClusterIP 10.108.100.150 <none> 443/TCP 15m
144+
145+
NAME READY UP-TO-DATE AVAILABLE AGE
146+
deployment.apps/ingress-nginx-controller 1/1 1 1 15m
147+
148+
NAME DESIRED CURRENT READY AGE
149+
replicaset.apps/ingress-nginx-controller-548768956f 1 1 1 15m
150+
```
151+
The service *ingress-nginx-controller* gets deployed as the service type of *LoadBalancer* with the *EXTERNAL-IP* assigned as *10.6.115.251*.
152+
153+
### Install cert-manager
154+
155+
```shell
156+
$ k get all -n cert-manager
157+
NAME READY STATUS RESTARTS AGE
158+
pod/cert-manager-59fbb6655d-h7sqb 1/1 Running 0 18s
159+
pod/cert-manager-cainjector-69548575fb-7fqd2 1/1 Running 0 18s
160+
pod/cert-manager-webhook-57b78f476d-mp45s 1/1 Running 0 16s
161+
162+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
163+
service/cert-manager ClusterIP 10.107.221.97 <none> 9402/TCP 20s
164+
service/cert-manager-webhook ClusterIP 10.104.243.185 <none> 443/TCP 19s
165+
166+
NAME READY UP-TO-DATE AVAILABLE AGE
167+
deployment.apps/cert-manager 1/1 1 1 18s
168+
deployment.apps/cert-manager-cainjector 1/1 1 1 18s
169+
deployment.apps/cert-manager-webhook 1/1 1 1 17s
170+
171+
NAME DESIRED CURRENT READY AGE
172+
replicaset.apps/cert-manager-59fbb6655d 1 1 1 19s
173+
replicaset.apps/cert-manager-cainjector-69548575fb 1 1 1 19s
174+
replicaset.apps/cert-manager-webhook-57b78f476d 1 1 1 18s
175+
```
176+
177+
178+
179+
```shell
180+
$ k create ns nginx-apps
181+
namespace/nginx-apps created
182+
183+
$ cat issuer-selfsigned.yaml
184+
apiVersion: cert-manager.io/v1
185+
kind: Issuer
186+
metadata:
187+
name: cfe-selfsigned-issuer
188+
spec:
189+
selfSigned: {}
190+
191+
$ k apply -f issuer-selfsigned.yaml -n nginx-apps
192+
issuer.cert-manager.io/cfe-selfsigned-issuer created
193+
194+
$ k get issuer -n nginx-apps
195+
NAME READY AGE
196+
cfe-selfsigned-issuer True 115s
197+
```
198+
199+
200+
```shell
201+
$ cat certificate.yaml
202+
apiVersion: cert-manager.io/v1
203+
kind: Certificate
204+
metadata:
205+
name: cfe-selfsigned-tls
206+
spec:
207+
# name of the tls secret to store
208+
# the automatically generated certificate/key pair
209+
secretName: cfe-tls-key-pair
210+
isCA: true
211+
issuerRef:
212+
name: cfe-selfsigned-issuer
213+
kind: Issuer
214+
commonName: "example.com"
215+
dnsNames:
216+
# one or more fully-qualified domain name
217+
# can be defined here
218+
- green.nginx.example.com
219+
- blue.nginx.example.com
220+
- nginx.example.com
221+
- example.com
222+
```
223+
224+
225+
```shell
226+
$ k apply -f certificate.yaml -n nginx-apps
227+
certificate.cert-manager.io/cfe-selfsigned-tls created
228+
229+
$ k get certificate -n nginx-apps
230+
NAME READY SECRET AGE
231+
cfe-selfsigned-tls True cfe-tls-key-pair 17s
232+
233+
$ k get secrets -n nginx-apps cfe-tls-key-pair
234+
NAME TYPE DATA AGE
235+
cfe-tls-key-pair kubernetes.io/tls 3 2m25s
236+
```
237+
238+
### Install Nginx applications
239+
240+
```shell
241+
$ tree ingress-demo/
242+
ingress-demo/
243+
├── apps
244+
│   ├── nginx-blue.yaml
245+
│   ├── nginx-green.yaml
246+
│   └── nginx-main.yaml
247+
├── ingress-host-based-selfsigned.yaml
248+
├── ingress-path-based-selfsigned.yaml
249+
└── README.md
250+
```
251+
252+
253+
```shell
254+
$ cd ingress-demo/
255+
$ k apply -f apps/nginx-main.yaml -n nginx-apps
256+
service/nginx-main created
257+
deployment.apps/nginx-main created
258+
$ k apply -f apps/nginx-green.yaml -n nginx-apps
259+
service/nginx-green created
260+
deployment.apps/nginx-green created
261+
$ k apply -f apps/nginx-blue.yaml -n nginx-apps
262+
service/nginx-blue created
263+
deployment.apps/nginx-blue created
264+
```
265+
266+
267+
```shell
268+
$ k get all -n nginx-apps
269+
NAME READY STATUS RESTARTS AGE
270+
pod/nginx-blue-78647f4c4b-z8wq9 1/1 Running 0 10s
271+
pod/nginx-green-8956bbd9f-zz7hk 1/1 Running 0 22s
272+
pod/nginx-main-64bfd77895-tf7xd 1/1 Running 0 31s
273+
274+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
275+
service/nginx-blue ClusterIP 10.108.51.116 <none> 80/TCP 15s
276+
service/nginx-green ClusterIP 10.106.115.65 <none> 80/TCP 23s
277+
service/nginx-main ClusterIP 10.108.33.44 <none> 80/TCP 32s
278+
279+
NAME READY UP-TO-DATE AVAILABLE AGE
280+
deployment.apps/nginx-blue 1/1 1 1 15s
281+
deployment.apps/nginx-green 1/1 1 1 24s
282+
deployment.apps/nginx-main 1/1 1 1 32s
283+
284+
NAME DESIRED CURRENT READY AGE
285+
replicaset.apps/nginx-blue-78647f4c4b 1 1 1 15s
286+
replicaset.apps/nginx-green-8956bbd9f 1 1 1 24s
287+
replicaset.apps/nginx-main-64bfd77895 1 1 1 32s
288+
```
289+
290+
### Deploy Ingress
291+
292+
```shell
293+
$ cat ingress-host-based-selfsigned.yaml
294+
apiVersion: networking.k8s.io/v1
295+
kind: Ingress
296+
metadata:
297+
name: ingress-host-based-selfsigned
298+
annotations:
299+
ingress.kubernetes.io/ssl-redirect: "true"
300+
#kubernetes.io/ingress.class: "nginx"
301+
cert-manager.io/issuer: "nginx-selfsinged-issuer"
302+
spec:
303+
ingressClassName: nginx
304+
tls:
305+
- hosts:
306+
- nginx.example.com
307+
secretName: cfe-tls-key-pair
308+
rules:
309+
- host: nginx.example.com
310+
http:
311+
paths:
312+
- path: /
313+
pathType: Prefix
314+
backend:
315+
service:
316+
name: nginx-main
317+
port:
318+
number: 80
319+
- host: blue.nginx.example.com
320+
http:
321+
paths:
322+
- path: /
323+
pathType: Prefix
324+
backend:
325+
service:
326+
name: nginx-blue
327+
port:
328+
number: 80
329+
- host: green.nginx.example.com
330+
http:
331+
paths:
332+
- path: /
333+
pathType: Prefix
334+
backend:
335+
service:
336+
name: nginx-green
337+
port:
338+
number: 80
339+
```
340+
341+
342+
```shell
343+
$ k apply -f ingress-host-based-selfsigned.yaml -n nginx-apps
344+
ingress.networking.k8s.io/ingress-host-based-selfsigned created
345+
$ k get ingress -n nginx-apps
346+
NAME CLASS HOSTS ADDRESS PORTS AGE
347+
ingress-host-based-selfsigned nginx nginx.example.com,blue.nginx.example.com,green.nginx.example.com 80, 443 9s
348+
$ k describe ingress -n nginx-apps
349+
Name: ingress-host-based-selfsigned
350+
Labels: <none>
351+
Namespace: nginx-apps
352+
Address:
353+
Ingress Class: nginx
354+
Default backend: <default>
355+
TLS:
356+
cfe-tls-key-pair terminates nginx.example.com
357+
Rules:
358+
Host Path Backends
359+
---- ---- --------
360+
nginx.example.com
361+
/ nginx-main:80 (10.192.4.44:80)
362+
blue.nginx.example.com
363+
/ nginx-blue:80 (10.192.3.78:80)
364+
green.nginx.example.com
365+
/ nginx-green:80 (10.192.4.45:80)
366+
Annotations: cert-manager.io/issuer: nginx-selfsinged-issuer
367+
ingress.kubernetes.io/ssl-redirect: true
368+
Events:
369+
Type Reason Age From Message
370+
---- ------ ---- ---- -------
371+
Normal Sync 20s nginx-ingress-controller Scheduled for sync
372+
Normal CreateCertificate 20s cert-manager-ingress-shim Successfully created Certificate "cfe-tls-key-pair"
373+
```
374+
375+
```shell
376+
$ host nginx.example.com
377+
nginx.example.com has address 10.6.115.251
378+
Host nginx.example.com not found: 3(NXDOMAIN)
379+
$ host green.nginx.example.com
380+
green.nginx.example.com has address 10.6.115.251
381+
Host green.nginx.example.com not found: 3(NXDOMAIN)
382+
$ host blue.nginx.example.com
383+
blue.nginx.example.com has address 10.6.115.251
384+
```
385+
39386
#### Configure Ingress
40387

41388
```shell

0 commit comments

Comments
 (0)