SSL Certificate

[JvB94]

Can maybe someone explain how to set the SSL Certficate along with the Loadbalancer?
Seems like there some several ways but i'm kind of unsure which one i should choice.

[vitobotta]

I converted this into a discussion since it's not an issue with the tool.

I recommend you look into cert-manager for certificates.

[creib]

Also have a look at this tutorial, which helped me a lot: https://github.com/vitobotta/hetzner-k3s/blob/main/wiki/Setting%20up%20a%20cluster.md

[JvB94]

i checked out all that stuff but for using cloudflare it seems like be some diffrent when we want to use the loadbalancer who provided by hetzner.
https://tech.serhatteker.com/post/2021-08/kubernetes-ingress-ssl-dns-cloudflare/

Will be cool if someone can post a small sample when he make it work with cloudflare already

[Dani4kor]

ask myself today same question and succeed

iam using wildcard letsencrypt with cert-manager and ingress-nginx and cloudflare DNS challange + reflector for manage secret across namespaces

as example below you need this steps:

• install cert-manager
• get cloudflare API TOKEN for DNS managment
• setup wildcard DNS A record pointed to hetzner LB(ingress-nginx) ip
• create secret with cloudflare API TOKEN
• create kind: ClusterIssuer
• create kind: Certificate
• add reflector & edit kind: Certificate

create secret

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-key-secret
  namespace: cert-manager
  labels:
    cert-manager.io/cluster-issuer: cloudflare-dns
type: Opaque
stringData:
  api-token: API_TOKEN_CLOUDFALRE

create ClusterIssuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: cloudflare-dns
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: EMAIL_LETSENCRYPT
    privateKeySecretRef:
      name: cloudflare-dns-key
    solvers:
      - dns01:
          cloudflare:
            email: CLOUDFLARE_EMAIL # AKA LOGIN
            apiTokenSecretRef:
              name: cloudflare-api-key-secret
              key: api-token

create certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
  namespace: cert-manager
spec:
  secretName: wildcard-cert-secret
  dnsNames:
    - "*.domain.com"
  issuerRef:
    name: cloudflare-dns
    kind: ClusterIssuer

add reflector

• setup reflector https://github.com/emberstack/kubernetes-reflector
• edit cert-manager kind: Certificate

at end you can add reflector annotations to cert-manager according to cert-manager docs
https://cert-manager.io/docs/tutorials/syncing-secrets-across-namespaces/

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-cert
  namespace: cert-manager
spec:
  secretName: wildcard-cert-secret
  dnsNames:
    - "*.domain.com"
  issuerRef:
    name: cloudflare-dns
    kind: ClusterIssuer
  secretTemplate:
      annotations:
        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
        reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "dev,stage,prod"  
        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" 
        reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "dev,stage,prod"

edit ingress of deployment or whatever

# edit kind: ingress 
...
spec:
  tls:
    - hosts:
        - dns-test.domain.com # access your web app with https://dns-test.domain.com
      secretName: wildcard-cert-secret
 ...

possible issues

• disable proxy_protocol for ingress-nginx in controller and configmap (for realip you can use CF-Connecting-IP as example)
• prolongation DNS can take time 1-5 minute to challange DNS

Q&A

• reflector need to access secret with certificate in different namespaces

hope you find this helpfull

[vitobotta]

@JvB94 At the moment workloads such as ingress nginx require a network load balancer regardless of whether you use Cloudflare or not. In a future release I will make it possible to use the nodes' public IPs if a user wants to avoid creating a load balancer (I still recommend a LB anyway because the IPs of he nodes may change).

What problem are you having with the configuration in the tutorial at https://github.com/vitobotta/hetzner-k3s/blob/main/wiki/Setting%20up%20a%20cluster.md? I have done that setup (ingress nginx+cert manager behind cloudflare) many times without any issues. If you give details, me or others might be able to help.