I am trying to get Drone CI/CD (v0.8.6) running in hosted Kubernetes (1.12) with SSL provisioned by Let’s Encrypt cert-manager.
The standard unencrypted install works fine, I specify a service of LoadBalancer and then DO notices that and creates a LoadBalancer that forwards to the ingress. It works fine with HTTP.
But when I introduce cert-manager, there are 2 problems:
I’m guessing that the helm chart needs to have some additional annotations passed through to the ingress (or manually applied) to make everything sync up in the DO environment – but I am new to cert-manager and don’t have a working environment to use as a reference.
So with all that, here are my questions:
Advice appreciated, thank you!
BTW, currently I took the lazy way and am using non-SSL deployment with a manually applied SSL termination in the Load Balancer and that is working OK, although with that approach I cannot allocate a certificate in a sub-domain and had to create a whole new TLD, but that is a topic for another thread.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Click below to sign up and get $200 of credit to try our products over 60 days!
I have that exact setup working with
ingress-nginx, in addition to
external-dnschart adding the DNS entries automatically. You didn’t mention having nginx as the ingress so if you don’t I suggest you install that.
ingress-nginxwill create the LoadBalancer automatically and forward ports 80 and 443 as TCP to the Droplets (so the TLS termination happens in the cluster). Nginx will also be cheaper than using services since only one LoadBalancer is needed for the whole cluster.
ingress-nginxthrough Helm, set
controller.publishService.enabled: trueso that the Ingress objects will get the IP of the LoadBalancer instead of the Droplet they reside on. I don’t think this matters if you’re not using
external-dns, but at least to me it improves readability.
With this setup the
cert-managerwill add a path for the http01 challenge to the Ingress object automatically.
These are my values for the
hi! for these points:
it works for me however i started with ONE domain and one service and one ssl cert, (server PRIME and domanin www.prime.xyz) then i moved to differents domanins to differents services and different ssl cert (server PRIME and domanin www.prime.xyz and service SECONDARY with domain splash.secondary.xyz ) now i’m trying to have differents domains with multplice ssl cert and i’m not able to make it work actually (server PRIME and domanin www.prime.xyz and service SECONDARY with domain splash.secondary.xyz AND service TROUBLE with domain trouble.secondary.xyz )
i’m using http01
i’m not using drone…