{"id":11377,"date":"2022-02-06T16:55:04","date_gmt":"2022-02-06T15:55:04","guid":{"rendered":"https:\/\/www.origo.io\/info\/?page_id=11377"},"modified":"2022-11-28T12:02:57","modified_gmt":"2022-11-28T11:02:57","slug":"automating-dns-and-tls-in-stabile","status":"publish","type":"page","link":"https:\/\/origo.systems\/info\/stabiledocs\/guides\/automating-dns-and-tls-in-stabile\/","title":{"rendered":"Ghost Blog with Automatic DNS and TLS Certificate Provisioning in Kubernetes"},"content":{"rendered":"\n\n\n

The goal of this guide is to install a web application in Kubernetes running in a Origo OS environment, with automatic provisioning of a DNS domain name and automatic provisioning of a TLS certificate, provisioned by the infrastructure entirely from the Kubernetes configuration.<\/p>\n\n\n\n

For provisioning DNS we will use the Kubernetes project External DNS<\/a> in conjunction with the Origo DNS Services<\/a>.
External DNS monitors your Kubernetes loadbalancers and ingresses for domain name annotations, and integrates with your DNS provider to create, update and delete domain names in DNS. For this example we will of course use the the Origo DNS Services<\/a>. You must either be using Origo Cloud or an on-prem Origo OS installation that is linked to Origo Registry, to access the Origo DNS Services. You may import your own domain names into Origo DNS Services, but every user also has access to the default domain “uncloud.co”, so that’s what we’ll be using for this example. External DNS comes with baked-in support for a number of cloud vendors – they call these “providers”. We have built our own provider<\/a>, and hope to have it included in the project sometime in the future. For now, we simply use our own custom External DNS Docker image with our provider included.<\/p>\n\n\n\n

For provisioning TLS certificates we use the Kubernetes project cert-manager<\/a> in conjunction with Let’s Encrypt<\/a>, which of course is the leading provider of free TLS certificates. Cert-manager monitors the ingresses you configure for host names, and provisions TLS certificates from Let’s Encrypt.<\/p>\n\n\n\n

The web application we will install and configure https access to, is the excellent Ghost blog application<\/a>.<\/p>\n\n\n\n

For the rest of this guide you will be typing commands into a ssh terminal on the control plane of your Origo OS Kubernetes cluster. The procedure to install a Kubernetes cluster and ssh into the control plane server is the same<\/a> as for the other guides<\/a>. You should do this before continuing this guide.<\/p>\n\n\n\n

Install Ghost to your Kubernetes cluster<\/h2>\n\n\n\n

First install Ghost using this yaml file.<\/a> The yaml file creates a Kubernetes deployment and a Kubernetes service.
After typing in the command below, the yaml file will be opened in your default editor. Please change “your-domain-name” to whatever domain name you want to create in the uncloud.co zone (i.e. change “your-domain-name.uncloud.co” to “something-else.uncloud.co”), and save the file.<\/p>\n\n\n\n

kubectl apply -f https:\/\/pub.origo.io\/support\/attachments\/download\/126\/ghost4.yaml\nkubectl edit -f https:\/\/pub.origo.io\/support\/attachments\/download\/126\/ghost4.yaml<\/code><\/pre>\n\n\n\n
IMPORTANT:<\/strong> Next you must assign add an internal IP address to your Kubernetes cluster using the stack UI by clicking “add internal IP address”. This internal IP address is not really used for anything, but since the Kubernetes service is of type loadbalancer, it needs an IP address in order not to be stuck waiting for one.<\/p>\n\n\n\n
Install External DNS<\/h2>\n\n\n\n
Install External DNS using the yaml file distributed<\/a> with the Kubernetes stack.<\/p>\n\n\n\n
kubectl apply -f external-dns-stabile-test.yaml<\/code><\/pre>\n\n\n\n
Install the Nginx ingress Controller<\/h2>\n\n\n\n
We need an ingress controller, and use the standard Nginx controller<\/a> for this example.<\/p>\n\n\n\n
kubectl apply -f https:\/\/raw.githubusercontent.com\/kubernetes\/ingress-nginx\/controller-v1.1.1\/deploy\/static\/provider\/cloud\/deploy.yaml<\/code><\/pre>\n\n\n\n
IMPORTANT:<\/strong> You must now assign another IP address to your Kubernetes cluster using the stack UI by clicking “add IP address mapping”. If your Origo OS environment supports it, you may also click “add external IP address”.<\/p>\n\n\n\n
Patch the ingress controller with the external IP address you were just assigned<\/h2>\n\n\n\n
External DNS has no idea that the IP address it is seeing is not actually an external one, wo we have to help it a little.<\/p>\n\n\n\n
kubectl patch svc ingress-nginx-controller -p '{\"spec\":{\"externalIPs\":[\"xx.xx.xx.xx\"]}}' -n ingress-nginx<\/code><\/pre>\n\n\n\n
NOTE:<\/strong> This only needs to be done, if you are using an “ipmapping” in Origo OS.<\/p>\n\n\n\n
Annotate the ingress controller with your domain name<\/h2>\n\n\n\n
The Nginx ingress controller will typically listen on a single IP address and route incoming requests based on host names. If we annotate the ingress controller with our desired domain name, DNS registration should happen automatically. You can verify that the domain name is actually registered using the Origo DNS Service UI<\/a>. To annotate your new ingress, replace “your-domain-name” with your actual domain name, and type this command:<\/p>\n\n\n\n
kubectl -n ingress-nginx annotate service ingress-nginx-controller \"external-dns.alpha.kubernetes.io\/hostname=your-domain-name.uncloud.co\"<\/code><\/pre>\n\n\n\n
Install cert-manager<\/h2>\n\n\n\n
Install cert-manager from the yaml file the developer has made available:<\/p>\n\n\n\n
kubectl apply --validate=false -f https:\/\/github.com\/jetstack\/cert-manager\/releases\/download\/v1.7.1\/cert-manager.yaml<\/code><\/pre>\n\n\n\n
Configure cert-manager for Let’s Encrypt<\/h2>\n\n\n\n
Configure cert-manager by editing and applying this <\/a>yaml<\/a> <\/a>file.<\/a> Please replace “your-email@uncloud.co” with your email address:<\/p>\n\n\n\n
kubectl apply -f https:\/\/pub.origo.io\/support\/attachments\/download\/129\/certmanager-acme.yaml\nkubectl edit -f https:\/\/pub.origo.io\/support\/attachments\/download\/129\/certmanager-acme.yaml<\/code><\/pre>\n\n\n\n
Create the actual ingress<\/h2>\n\n\n\n
Finally create the ingress using this yaml file<\/a>. You must replace the two ocurrences of “your-domain-name.uncloud.co” with the domain name you have chosen.<\/p>\n\n\n\n
kubectl apply -f https:\/\/pub.origo.io\/support\/attachments\/download\/130\/nginx-ghost-ingress.yaml\nkubectl edit -f https:\/\/pub.origo.io\/support\/attachments\/download\/130\/nginx-ghost-ingress.yaml<\/code><\/pre>\n\n\n\n
IMPORTANT:<\/strong> After a few minutes, your Ghost blog should be up and running on the domain name you have chosen and have a valid TLS certificate. You should then head straight to https:\/\/your-domain-name.uncloud.co\/ghost and set up an account. This is because, after installing Ghost, anyone can set up an account, so you should either do this promptly, or delete the Ghost deployment.<\/p>\n\n\n\n
Create more ingresses<\/h2>\n\n\n\n
Now that you have installed and configured External DNS and cert-manager, you can easily create ingresses like the one above, whenever you have a service you want external https access to. DNS registration of domain names and provisioning of TLS certificates will be done automatically.<\/p>\n\n\n\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
The goal of this guide is to install a web application in Kubernetes running in a Origo OS environment, with automatic provisioning of a DNS domain name and automatic provisioning of a TLS certificate, provisioned by the infrastructure entirely from the Kubernetes configuration. For provisioning DNS we will use the<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":7856,"menu_order":25,"comment_status":"open","ping_status":"closed","template":"page-leftsb.php","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-11377","page","type-page","status-publish","hentry"],"acf":[],"featured_image_src":null,"featured_image_src_square":null,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/pages\/11377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/comments?post=11377"}],"version-history":[{"count":132,"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/pages\/11377\/revisions"}],"predecessor-version":[{"id":12778,"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/pages\/11377\/revisions\/12778"}],"up":[{"embeddable":true,"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/pages\/7856"}],"wp:attachment":[{"href":"https:\/\/origo.systems\/info\/wp-json\/wp\/v2\/media?parent=11377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}