Skip to content

Commit 04ca63d

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #192 from ritazh/eg-tls-ing-ctrl
Add sample for ingress controller with TLS
2 parents 55c5ce0 + e039d12 commit 04ca63d

File tree

5 files changed

+252
-0
lines changed

5 files changed

+252
-0
lines changed

‎sample/ingress-controller-tls/README.md

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# Using Secrets Store CSI to Enable NGINX Ingress Controller with TLS
2+
This guide demonstrates steps required to setup Secrets Store CSI driver to enable applications to work with NGINX Ingress Controller with TLS stored in an external Secrets store.
3+
For more information on securing an Ingress with TLS, refer to: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
4+
5+
# Generate a TLS Cert
6+
7+
```bash
8+
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
9+
-out ingress-tls.crt \
10+
-keyout ingress-tls.key \
11+
-subj "/CN=demo.test.com/O=ingress-tls"
12+
```
13+
14+
# Store Cert in External Secrets Store Service
15+
- [Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/certificates/certificate-scenarios#import-a-certificate)
16+
- [HashiCorp Vault](https://www.vaultproject.io/docs/commands#reading-and-writing-data)
17+
18+
# Deploy Secrets-store CSI and the Provider
19+
https://github.com/kubernetes-sigs/secrets-store-csi-driver#usage
20+
21+
# Deploy Ingress Controller
22+
23+
Create a namespace
24+
25+
```bash
26+
kubectl create ns ingress-test
27+
```
28+
29+
Helm install ingress-controller
30+
31+
```bash
32+
helm install stable/nginx-ingress --generate-name \
33+
--namespace ingress-test \
34+
--set controller.replicaCount=2 \
35+
--set controller.nodeSelector."beta\.kubernetes\.io/os"=linux \
36+
--set defaultBackend.nodeSelector."beta\.kubernetes\.io/os"=linux
37+
```
38+
39+
# Deploy a SecretsProviderClass Resource
40+
> NOTE: For this sample, we are using the `azure` provider. For more information, head over to: https://github.com/Azure/secrets-store-csi-driver-provider-azure#usage
41+
42+
```bash
43+
kubectl apply -f sample/ingress-controller-tls/secretproviderclass-azure-tls.yaml -n ingress-test
44+
```
45+
46+
# [OPTIONAL] Create a Secret Required by Provider
47+
48+
```bash
49+
kubectl create secret generic secrets-store-creds --from-literal clientid=xxxx --from-literal clientsecret=xxxx -n ingress-test
50+
```
51+
52+
# Deploy Test Apps with Reference to Secrets Store CSI
53+
54+
> NOTE: These apps reference a Secrets Store CSI volume and a `secretProviderClass` object created earlier. A Kubernetes secret `ingress-tls-csi` will be created by the CSI driver as a result of the app creation.
55+
56+
```yaml
57+
volumes:
58+
- name: secrets-store-inline
59+
csi:
60+
driver: secrets-store.csi.k8s.io
61+
readOnly: true
62+
volumeAttributes:
63+
secretProviderClass: "azure-tls"
64+
nodePublishSecretRef:
65+
name: secrets-store-creds
66+
```
67+
68+
```bash
69+
kubectl apply -f sample/ingress-controller-tls/deployment-app-one.yaml -n ingress-test
70+
kubectl apply -f sample/ingress-controller-tls/deployment-app-two.yaml -n ingress-test
71+
72+
```
73+
74+
# Check for the Kubernetes Secret created by the CSI driver
75+
```bash
76+
kubectl get secret -n ingress-test
77+
78+
NAME TYPE DATA AGE
79+
ingress-tls-csi kubernetes.io/tls 2 1m34s
80+
```
81+
82+
# Deploy an Ingress Resource referencing the Secret created by the CSI driver
83+
84+
> NOTE: The ingress resource references the Kubernetes secret `ingress-tls-csi` created by the CSI driver as a result of the app creation.
85+
86+
```yaml
87+
tls:
88+
- hosts:
89+
- demo.test.com
90+
secretName: ingress-tls-csi
91+
```
92+
93+
```bash
94+
kubectl apply -f sample/ingress-controller-tls/ingress.yaml -n ingress-test
95+
```
96+
97+
# Get the External IP of the Ingress Controller
98+
99+
```bash
100+
kubectl get service -l app=nginx-ingress --namespace ingress-test
101+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
102+
nginx-ingress-1588032400-controller LoadBalancer 10.0.255.157 52.xx.xx.xx 80:31293/TCP,443:31265/TCP 19m
103+
nginx-ingress-1588032400-default-backend ClusterIP 10.0.223.214 <none> 80/TCP 19m
104+
```
105+
106+
# Test Ingress with TLS
107+
Using `curl` to verify ingress configuration using TLS.
108+
Replace the public IP with the external IP of the ingress controller service from the previous step.
109+
110+
```bash
111+
curl -v -k --resolve demo.test.com:443:52.xx.xx.xx https://demo.test.com
112+
113+
# You should see the following in your output
114+
* subject: CN=demo.test.com; O=ingress-tls
115+
* start date: Apr 15 04:23:46 2020 GMT
116+
* expire date: Apr 15 04:23:46 2021 GMT
117+
* issuer: CN=demo.test.com; O=ingress-tls
118+
* SSL certificate verify result: self signed certificate (18), continuing anyway.
119+
```

‎sample/ingress-controller-tls/deployment-app-one.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: nginx-one
5+
labels:
6+
app: nginx-one
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: nginx-one
12+
template:
13+
metadata:
14+
labels:
15+
app: nginx-one
16+
spec:
17+
containers:
18+
- image: nginx
19+
name: nginx
20+
volumeMounts:
21+
- name: secrets-store-inline
22+
mountPath: "/mnt/secrets-store"
23+
readOnly: true
24+
volumes:
25+
- name: secrets-store-inline
26+
csi:
27+
driver: secrets-store.csi.k8s.io
28+
readOnly: true
29+
volumeAttributes:
30+
secretProviderClass: "azure-tls"
31+
nodePublishSecretRef:
32+
name: secrets-store-creds
33+
---
34+
apiVersion: v1
35+
kind: Service
36+
metadata:
37+
name: nginx-one
38+
spec:
39+
type: ClusterIP
40+
ports:
41+
- port: 80
42+
selector:
43+
app: nginx-one

‎sample/ingress-controller-tls/deployment-app-two.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: nginx-two
5+
labels:
6+
app: nginx-two
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: nginx-two
12+
template:
13+
metadata:
14+
labels:
15+
app: nginx-two
16+
spec:
17+
containers:
18+
- image: nginx
19+
name: nginx
20+
volumeMounts:
21+
- name: secrets-store-inline
22+
mountPath: "/mnt/secrets-store"
23+
readOnly: true
24+
volumes:
25+
- name: secrets-store-inline
26+
csi:
27+
driver: secrets-store.csi.k8s.io
28+
readOnly: true
29+
volumeAttributes:
30+
secretProviderClass: "azure-tls"
31+
nodePublishSecretRef:
32+
name: secrets-store-creds
33+
---
34+
apiVersion: v1
35+
kind: Service
36+
metadata:
37+
name: nginx-two
38+
spec:
39+
type: ClusterIP
40+
ports:
41+
- port: 80
42+
selector:
43+
app: nginx-two

‎sample/ingress-controller-tls/ingress.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Ingress
3+
metadata:
4+
name: ingress-tls
5+
annotations:
6+
kubernetes.io/ingress.class: nginx
7+
nginx.ingress.kubernetes.io/rewrite-target: /$1
8+
spec:
9+
tls:
10+
- hosts:
11+
- demo.test.com
12+
secretName: ingress-tls-csi
13+
rules:
14+
- host: demo.test.com
15+
http:
16+
paths:
17+
- backend:
18+
serviceName: nginx-one
19+
servicePort: 80
20+
path: /(.*)
21+
- backend:
22+
serviceName: nginx-two
23+
servicePort: 80
24+
path: /two(/|$)(.*)

‎sample/ingress-controller-tls/secretproviderclass-azure-tls.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
2+
kind: SecretProviderClass
3+
metadata:
4+
name: azure-tls
5+
spec:
6+
provider: azure
7+
secretObjects:
8+
- secretName: ingress-tls-csi
9+
type: kubernetes.io/tls
10+
data:
11+
- objectName: ingresscert
12+
key: tls.key
13+
- objectName: ingresscert
14+
key: tls.crt
15+
parameters:
16+
usePodIdentity: "false"
17+
keyvaultName: "azkv" # the name of the KeyVault
18+
objects: |
19+
array:
20+
- |
21+
objectName: ingresscert
22+
objectType: cert
23+
tenantId: "xx-xxxxxxxx-xx"

0 commit comments

Comments
 (0)