fkf9/ungleich-k8s
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ungleich-k8s/apps/nginx-certbot
History
Nico Schottelius f26e4eedb8 Need to add commonLabels so that the selector of service matches 
Without it, the selector will match also ALL OTHER tls1-nginx labels!
2021-06-19 18:09:31 +02:00
..
base configmapref -> name needs to be indented 2021-06-19 17:49:07 +02:00
overlays/ungleich Need to add commonLabels so that the selector of service matches 2021-06-19 18:09:31 +02:00
README.md [nginx/certbot] finish! 2021-06-18 23:42:15 +02:00

README.md

nginx service for getting letsencrypt certificates

Get real letsencrypt certificates in IPv6 based clusters.

Architecture

  • nginx/port 80 serves only the root for letsencrypt
  • nginx/port 443 crashes until the cert is there
  • A job (certbot) gets the cert

Missing bits

  • cronjob for renewal
  • Automatic restart of nginx
  • Fixing the service <-> pod mapping problem (goes to both http/https pods)

Brain storming

certbot --standalone / init container

  • Could in theory be used as an init container
  • nginx / port 80+443 could take over afterwards

Conclusion: does not work, as initcontainers are not targetted by services

certbot --standalone / job

Similar pattern as before -> works, because ports of jobs are caught by the service!