Videos/community tutorials/practical examples for beginners

[ToshY]

Hello 👋

I would like to know if there's a video, community tutorials or practical examples for beginners (like me), so we could follow along step-by-step to setup a cluster using this repository and eventually have a working web application deployed.

The problem that I am facing is that I'm fairly new to Kubernetes and while I am able to follow the basic instructions to use Terraform and setup the cluster (and check it's "working" in Lens), that's where it stops and I'm stuck on how to properly configure the cluster further. Like how to further configure Traefik after initial setup, properly configure cert-manager to have working certificates (with CloudFlare), deploy an example application (e.g. nginx), etc.

Are there any more in-depth tutorials or example repositories on how to proceed after setup? Any bit of help is appreciated 🙂

[tygoegmond]

It's hard to provide a video tutorial since every environment is different.

I would suggest to start with creating your own docker image (with your application) and deploying that on the cluster.

Feel free to ask questions if you can't figure something out.

[ToshY]

Hey @tygoegmond

That's understandable and I've actually realised that my issues are more related to Kubernetes, cert-manager, Traefik, and not so much to the cluster setup, as setting the cluster up with the provided documentation works fine 👌

---

For other beginners / future references, one of the issues is that I've found is that cert-manager cannot automatically create certificates when using a (Traefik) IngressRoute in contrast to Ingress (and setting tls).

In order to keep using the IngressRoute to access the Traefik dashboard, I had to create a separate (wildcard) Certificate first and then create a (Traefik) TLSStore in the default namespace, so that it could aslo be automatically used in the traefik namespace where the IngressRoute for the Traefik dashboard was (without the need of specifying the tls explicitely).

To achieve this, I set enable_cert_manager = false in the kube.tf, first deployed the cluster, then deployed cert-manager with Helm instead, and added the following files.

Cert manager

cert-manager/values.yaml

crds:
  enabled: true
  keep: true
replicaCount: 3
extraArgs:
  - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
  - --dns01-recursive-nameservers-only
podDnsPolicy: None
podDnsConfig:
  nameservers:
    - 1.1.1.1
    - 9.9.9.9

Add it with Helm.

helm repo add jetstack https://charts.jetstack.io --force-update
helm install cert-manager jetstack/cert-manager \
        --namespace cert-manager \
        --create-namespace \
        --values=./cert-manager/values.yaml \
        --version v1.17.1

Then apply the following files with kubectl (or kustomize).

certificate-staging.yaml

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-staging-tls
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: "*.example.com"
  dnsNames: ["*.example.com"]

cluster-issuer-staging.yaml

---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-token-secret
              key: cloudflare-token
        selector:
          dnsZones: ['example.com']

cloudflare-token-secret.yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-token-secret
  namespace: cert-manager
type: Opaque
data:
  cloudflare-token: bmV2ZXItZ29ubmEtZ2l2ZS15b3UtdXA= # real cloudflare api token as base64 here

tls-store.yaml

apiVersion: [traefik.io/v1alpha1](http://traefik.io/v1alpha1)
kind: TLSStore
metadata:
  name: default
  namespace: default
spec:
  defaultCertificate:
    secretName: example-com-staging-tls

Traefik dashboard

traefik/ingress-route.yaml

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: dashboard
  namespace: traefik
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`traefik.example.com`)
      kind: Rule
      services:
        - name: api@internal
          kind: TraefikService
      middlewares:
#        - name: basic-auth #optional but recommended to protect the Traefik dashboard; required additional Middleware and Secret
#          namespace: traefik

---

_{Most of the examples above can also be found here: github.com/techno-tim/launchpad}