first commit

ocramh · ocramh · commit c5921c005115 · 2019-04-16T15:06:31.000+01:00
diff --git a/README.md b/README.md
@@ -0,0 +1,98 @@
+# Kubernetes SSL Ingress and Service Deployment Setup on GCP
+
+A simple k8s project that demonstrates how to set up a web service, route traffic to it via a load balancer and configure the load balancer to use SSL certificates.
+
+1 - create container cluster. can also be done via gcp console.
+
+```
+gcloud container clusters create <cluster-name> --zone <zone-name> --machine-type g1-small --num-nodes 1
+```
+
+2 - retrieve cluster credentials if needed.
+
+```
+gcloud container clusters get-credentials <cluster-name>
+```
+
+3 - deploy the application.
+
+```
+kubectl run <deployment-name> --image=gcr.io/google-samples/hello-app:1.0 --port=8080
+```
+
+4 - expose deployment as internal service. This will not make the application public yet.
+
+```
+kubectl expose deployment <deployment-name> --target-port=8080 --type=NodePort
+
+or
+
+kubectl apply -f deployment.yaml
+```
+
+5 - create a service for the pods created by the deployment during step 4.
+
+```
+kubectl apply -f service.yaml
+```
+
+6 - create an SSL certificate and a set of keys.
+
+```
+// key
+openssl genrsa -out test-ingress.key 2048
+
+// signing request
+openssl req -new -key test-ingress.key -out test-ingress.csr \
+    -subj "/CN=k8s.shapes.ai"
+
+// certificate
+openssl x509 -req -days 365 -in test-ingress.csr -signkey test-ingress.key \
+    -out test-ingress.crt
+```
+
+7a - Create a secret for holding certificate and key.
+
+```
+kubectl create secret tls my-secret \
+  --cert test-ingress.crt --key test-ingress.key
+```
+
+7b - create ingress resource to generate a load balancer that will route traffic to the application and deploy it. In the ingress manifest specify to use the certificate generated in the previous step.
+
+```
+kubectl apply -f ingress.yaml
+```
+
+8a - [optional] define a static IP for the application. To use a static IP using Ingress the following conditions must be met:
+
+- A Service with `type:NodePort`
+- An Ingress configured with the service name and static IP annotation
+- Global IP addresses only work with Ingress resource type
+
+```
+gcloud compute addresses create <static-ip-name> --global
+```
+
+8b - [optional] configure the existing Ingress resource to use the reserved IP address. See ingress.yaml > metadata.annotations.
+
+8c - [optional] edit the domain dns A Record to point to the global static IP address.
+
+NOTE: see https://cloud.google.com/load-balancing/docs/ssl-certificates#create-managed-ssl-cert-resource for instructions about how to set up a certificate signed by google.
+To retrive the ingress proxy name run `gcloud compute target-https-proxies list`.
+
+9 - [optional] clean up.
+
+```
+kubectl delete ingress <ingress-name>
+
+gcloud compute addresses delete <static-ip-name> --global
+
+gcloud container clusters delete <cluster-name>
+```
+
+## Useful links:
+
+- https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
+- https://cloud.google.com/load-balancing/docs/ssl-certificates
+- https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl
diff --git a/deployment.yaml b/deployment.yaml
@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  selector:
+    matchLabels:
+      app: test-app
+  replicas: 3
+  template:
+    metadata:
+      labels:
+        app: test-app
+    spec:
+      containers:
+        - name: hello
+          image: "gcr.io/google-samples/hello-app:2.0"
+          env:
+            - name: "PORT"
+              value: "5001"
diff --git a/ingress.yaml b/ingress.yaml
@@ -0,0 +1,16 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: my-ingress
+  annotations:
+    kubernetes.io/ingress.global-static-ip-name: k8s-test-static-ip
+spec:
+  tls:
+    - secretName: my-first-secret
+  rules:
+    - host: k8s.shapes.ai
+      http:
+        paths:
+          - backend:
+              serviceName: my-service
+              servicePort: first-port
diff --git a/service.yaml b/service.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-service
+spec:
+  type: NodePort
+  selector:
+    app: test-app
+  ports:
+    - name: first-port
+      protocol: TCP
+      port: 6001
+      targetPort: 5001
diff --git a/test-ingress.crt b/test-ingress.crt
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICrDCCAZQCCQCr9S0pWKdR8jANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1r
+OHMuc2hhcGVzLmFpMB4XDTE5MDQwMjEwNDIxM1oXDTIwMDQwMTEwNDIxM1owGDEW
+MBQGA1UEAwwNazhzLnNoYXBlcy5haTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBANdrRdbzCcaLcJE7CcZPR3JeoyJiPAuM1l3U4Dc7fn2637Cz7WdYoMa9
+3fdTGWMj8w8CtyGAIyA9wIyinqbn5O3F7kVw+m1gQkF97HdOuymHI6AycDTs5DH1
+gVOdlgQPYrsxV+fksWvnBCQiTZMY0EHMf2GUJDxJX0F0q2bVkxf8XoCOswcrt98X
+xsllEe/04NBSt9b/GIOTv6FpwJPKXr4uuZ7GFUDic0K4uCjr2cQr8uROWVctQnsN
+PnGXP+9Z18Ls+I0ryHzMyOb+RT1K6HV1pDX+XL2YKEDlHUnpI32owwD+u0GM7nyi
+I5ohAykFyw6Lil6AUOzpTCX/Ao/FzO8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA
+SvrjOOCK4vD/Hf0PvKViaSMG5zke02AiruCpm9Z7m8VSWhqV6wsyaFQKTnHN2cXT
+oatUmzmbc1Sh1qchh4xSWm1FAtoauTsmMmszB+3boY81P+Sla9OFfu37Isq6S9pb
+lIufasEtqdcP92SvsYfN3543QDtCkHAGQUzhWGWMUUwrDykuFoJAhBGMDJ99cpQ3
+Wt5y7ozxQRvhX8g9Kcyc9QpCsPEPfi0qMHu7YGu14KApuxR2ugvI8CEQZj9dRT/6
+tvzjHV17ux/deFcdGaAYDUW3fgELyBjvmfrg6bTkOr7rZKib+hsn36qAQu/KTdEl
+RQ5yP+aGW32xuwv3qIajAA==
+-----END CERTIFICATE-----
diff --git a/test-ingress.csr b/test-ingress.csr
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICXTCCAUUCAQAwGDEWMBQGA1UEAwwNazhzLnNoYXBlcy5haTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBANdrRdbzCcaLcJE7CcZPR3JeoyJiPAuM1l3U
+4Dc7fn2637Cz7WdYoMa93fdTGWMj8w8CtyGAIyA9wIyinqbn5O3F7kVw+m1gQkF9
+7HdOuymHI6AycDTs5DH1gVOdlgQPYrsxV+fksWvnBCQiTZMY0EHMf2GUJDxJX0F0
+q2bVkxf8XoCOswcrt98XxsllEe/04NBSt9b/GIOTv6FpwJPKXr4uuZ7GFUDic0K4
+uCjr2cQr8uROWVctQnsNPnGXP+9Z18Ls+I0ryHzMyOb+RT1K6HV1pDX+XL2YKEDl
+HUnpI32owwD+u0GM7nyiI5ohAykFyw6Lil6AUOzpTCX/Ao/FzO8CAwEAAaAAMA0G
+CSqGSIb3DQEBCwUAA4IBAQAwJoNkrW8T/myKpKiqm6kTlegOnUfuZHNmzPtKkpn/
+ZziNY/CJMCa4clq64aUz9q4G8e9ixow8frQie9ikTtjGqrGawO/DnTQt9fJ6wJ+c
+xpU2Qrxp1gyi7Yk46+9top54aMIvcsBdkz4k3SEjhefR1xWIIinGMhO/P7H/BPL/
+ZderUuXCIWR4avwrfrn27r7lIMUJcLDoTmwQW7g2R20s5nh1WoJt63gt+P/ud4pv
+ooSl6leb9e6elP1H2o/268b/flDee8UJri2K6qhP3dXAhksNQEDXvOsTWFLu2Rlf
+OCWRd2VBeTQeF2rclog4QQYptFQi6wAFxC/0SSUKMzPN
+-----END CERTIFICATE REQUEST-----
diff --git a/test-ingress.key b/test-ingress.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpgIBAAKCAQEA12tF1vMJxotwkTsJxk9Hcl6jImI8C4zWXdTgNzt+fbrfsLPt
+Z1igxr3d91MZYyPzDwK3IYAjID3AjKKepufk7cXuRXD6bWBCQX3sd067KYcjoDJw
+NOzkMfWBU52WBA9iuzFX5+Sxa+cEJCJNkxjQQcx/YZQkPElfQXSrZtWTF/xegI6z
+Byu33xfGyWUR7/Tg0FK31v8Yg5O/oWnAk8pevi65nsYVQOJzQri4KOvZxCvy5E5Z
+Vy1Cew0+cZc/71nXwuz4jSvIfMzI5v5FPUrodXWkNf5cvZgoQOUdSekjfajDAP67
+QYzufKIjmiEDKQXLDouKXoBQ7OlMJf8Cj8XM7wIDAQABAoIBAQC+MQH6Y53v49DB
+CMT6h6hm+9NAWkb1U6U4Nui3Gxn02/b/RfyG0CMzFRNSd9XkSCsix5z0QPPCVYMZ
+J8K3Teo7XBOgz7zqsKAOvqT2OVbZtWzo1V9n+vcGfOFv96QpdYQQDeK05J8Yy2BG
+ntqq0q+cSHb2qhrL92PYoK9sHYi/FP0z1p3EKyrgkJRuRSbBbkM7r8LCIguMe9j4
+5g0wp7xWaYsfbkz2WS+RQB3hFNbaAEly7u7n+UalKRQyj0iqr5x/pRXStsptMTIs
+nBamEXWaiEe7pduits1DhDCZDioFDaKQ0D63CeMUgaVS42Y3JuTvrxo1tkwOgHEr
++PewA0cBAoGBAPUt2ApuRdVCgPO2pnQH/jqJR3NHSd7WDmlnUITw8TLEnivA2yLM
+vInI9D9TIoP/JsAQOG8wMB1FfKl3BJpqWoFRIvWKcP/3EK4/ZXeywmejt8tSGaBn
+v6CLIyB+ucvfNtqlsUBicUOP1vwmnMtV523wQz6nrYOeVebwTmyy9dbBAoGBAODt
+L11YTsExCU3GB1thJB6nlk31hpFdkTSLtH2k04omeNeExTAtz0H1yplgBozbhrWt
+P0qmzDx2JvepEf/mUEMYhp90m+D4pRdzy7ij1LxV1ahh3VLdqWJ5N8DmjOcsguqa
+Ky0GO+3mCfHez9euiI5OKYeNzIU9ddVfjVV7/r+vAoGBAIhGuf1aO7CErX5JOI3n
+33QT18YIitO0MQB/L28lKTups6zoHiVinS0MqE4GXHn3uUcp/OQ4aZXriJX9FG7r
+zHByc7b9A0ASyI/Bpxl4H7xRcJgvgxT4dbe7foPSTF04LZosXLBHx2LhMYKnx6Dx
+l5gw4n+R3cz5lg+t5Dlg42pBAoGBAJ+Et3W9HkV3UIDe8/LDxwkSk8+AVMqdkFCy
+z/PXxMsSk9tNZ0fPBVFjTydNaffV7QjF8MAx4WDz7pjwSDqzjbK4HynRWofH79Xd
+Its1HbfgLCI6HewaFnonO/pLyBxffg2B/yL0a+ZBokXuXns5ZdF+74cacrUALKSC
+GstIoBgzAoGBAIr7LON95hjWdUjkeDX81WBoT9xT7SD+xXrrvHdhnGikAZiDRYRO
+I4fb7zrFflJ2x6verZgQ5T94HTOnNEbu7E3/UTwh9x1FslPSAa+z0lc4e8xZcSWE
+Rtf5xkeUD+Q9woE3pWUsKlabPgCu9fzK4VwWL9pJWW4FyAqzqloil6xb
+-----END RSA PRIVATE KEY-----
