Support https in build ingresses

[mileo]

Some features depends of the use of HTTPS, for example service workers.

[sbidoul]

Interesting. Is that a issue new in 16?

If there is no workaround in the browser, then we'll need to find a way to deploy and maintain a wildcard certificate.

[sbidoul]

Before, it seems nginx did use a default self signed certificate if used forced an https URL.
haproxy does not do that, it would seem.

See also OCA/hr-attendance#80 (comment)

[mileo]

Interesting. Is that a issue new in 16?

If there is no workaround in the browser, then we'll need to find a way to deploy and maintain a wildcard certificate.

It's a issue on OCA/pos#835

But could apply to other features too.

[mileo]

@sbidoul we use rancher+k8s+nginx some example:

mileo@0f0a10b

[sbidoul]

Yeah, but I'm not sure that generating a new letsencrypt certificate for each commit we do in OCA is going to be ok with the letsencrypt usage policies.

[mileo]

Yeah, but I'm not sure that generating a new letsencrypt certificate for each commit we do in OCA is going to be ok with the letsencrypt usage policies.

May be some guys of our team can awnser this one: @kardeco @ananiasfilho

[ananiasfilho]

Let's encrypt have many limitations as certs per IP, certs per domains and others. The best and single way maybe will run with a wildcard ssl certificate.

[sbidoul]

I agree using a wildcard ssl certificate is the best solution. It's a bit of a burden to set up and maintain, though.

So in the meantime I enabled a default self-signed certificate on the OCA runboat instance.

So you can manually change the build URL to https, and manually accept the default certificate.
Not perfect but probably good enough for now.

[pcastelovigo]

I managed to run runboat instances with wildcard lets encrypt certificate

Use standalone certbot with DNS plugin:

https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins

Script it to run with crontab and pass cert and key as secret. Be sure that user with kubectl has read permissions

KUBE_USER="kubernetesuser"
NAMESPACE="yournamespace"
DOMAIN="runboat.example.org"

sudo -u "$KUBE_USER" kubectl create secret tls wildcard-runboat-tls \
    --cert="/etc/letsencrypt/live/$DOMAIN/fullchain.pem" \
    --key="/etc/letsencrypt/live/$DOMAIN/privkey.pem" \
    --namespace="$NAMESPACE" \
    --dry-run=client -o yaml | sudo -u "$KUBE_USER" kubectl apply -f -

Add ingress to kubernetes

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wildcard-runboat-ingress
  namespace: yournamespace
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - "*.runboat.example.org"
    secretName: wildcard-runboat-tls
  rules:
  - host: "*.runboat.example.org"
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: runboat-placeholder-service
            port:
              number: 80

Placeholder is needed as Ingress depends on tls.secretName

apiVersion: v1
kind: Service
metadata:
  name: runboat-placeholder-service
  namespace: yournamespace
spec:
  ports:
  - port: 80
    targetPort: 8080
  selector:
    app: placeholder
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: placeholder
  namespace: yournamespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: placeholder
  template:
    metadata:
      labels:
        app: placeholder
    spec:
      containers:
      - name: placeholder
        image: nginx:stable
        ports:
        - containerPort: 80