Simplify Lets Encrypt Certificates Management for Kubernetes (opens in new tab)

(github.com)

75 pointsdlsniper9y ago17 comments

17 comments

I've been using this project on GKE for ~2 weeks now in combination with the nginx ingress controller. I have it configured to use the DNS challenge to get new certs so I don't have to expose an extra port as well.

It feels liberating to just get an SSL cert for any subdomain I need and have the whole process abstracted from me.

psg-luna9y ago

Sicne a few days ago, ingress objects are now supported directly with the correct annotations. See https://github.com/PalmStoneGames/kube-cert-manager/blob/mas...

colemickens9y ago

I thought I wanted this for a long time, but `kube-lego` gets me very similar results... without needing to inject credentials for my DNS provider to my cluster.

I'm curious if others have thoughts on this vs kube-lego. (I would agree that I like the approach of this project quite a bit more than kelseyhightower's. This feels more complete, works with far more providers, etc)

psg-luna9y ago

You can use http challenges with kcm as well. Which is what ensures you don't need to inject dns credentials.

colemickens9y ago

Whoa! This is really great! Thank you for this (and to think I was excited to see the Caddy secret backend, this is way better IMO)!

edit: Oh my, and I can use this for the HTTP challenge and still use it with other Ingress controllers. I'd love to buy you a beer/rootbeer or something, I'm so tickled to have this!

1 more reply

endymi0n9y ago

Big kudos to Luna for fusing both of these awesome projects - this was actually on our backlog too and helped a lot!

coleca9y ago

Found this similar project a couple days ago: https://github.com/tazjin/kubernetes-letsencrypt

Doesn't seem quite as configurable but looks a bit simpler to implement.

tazjin9y ago

Please file an issue if you're missing some configuration option! I explicitly don't intend to support other challenge mechanisms than DNS though.

brudgers9y ago

I'm curious what advantages and tradeoffs it has over the project that it is based upon [1] for a person choosing between them.

[1]: https://github.com/kelseyhightower/kube-cert-manager

psg-luna9y ago

Largely, https://github.com/kelseyhightower/kube-cert-manager is incomplete

* it does not support subdomains (only root domains)

* it only supports googlecloud as dns provider

* Bugs and PRs remain unanswered/unmerged

Meanwhile the linked project supports http, SNI and DNS challenges, with around 20 or so DNS providers available. It also supports managing certs for ingress objects directly.

thockingoog9y ago

Does it support multiple SANs on a single cert? I want to streamline things like vanity domain redirections, where every domain I add requires me to refresh the cert.

1 more reply

newman3149y ago

I haven't used this yet but will say that lego (which this uses) is a joy to use.

Motomorgen9y ago

What are the major difference between this and say kube-lego that might entice someone to switch?

psg-luna9y ago

You can manage individual certs with cert objects that aren't used by ingresses.

Motomorgen9y ago

Very cool, thank you!

j / k navigate · click thread line to collapse

17 comments

zalmoxes9y ago

It feels liberating to just get an SSL cert for any subdomain I need and have the whole process abstracted from me.

psg-luna9y ago

Sicne a few days ago, ingress objects are now supported directly with the correct annotations. See https://github.com/PalmStoneGames/kube-cert-manager/blob/mas...

colemickens9y ago

I thought I wanted this for a long time, but `kube-lego` gets me very similar results... without needing to inject credentials for my DNS provider to my cluster.

psg-luna9y ago

You can use http challenges with kcm as well. Which is what ensures you don't need to inject dns credentials.

colemickens9y ago

Whoa! This is really great! Thank you for this (and to think I was excited to see the Caddy secret backend, this is way better IMO)!

edit: Oh my, and I can use this for the HTTP challenge and still use it with other Ingress controllers. I'd love to buy you a beer/rootbeer or something, I'm so tickled to have this!

1 more reply

endymi0n9y ago

Big kudos to Luna for fusing both of these awesome projects - this was actually on our backlog too and helped a lot!

coleca9y ago

Found this similar project a couple days ago: https://github.com/tazjin/kubernetes-letsencrypt

Doesn't seem quite as configurable but looks a bit simpler to implement.

tazjin9y ago

Please file an issue if you're missing some configuration option! I explicitly don't intend to support other challenge mechanisms than DNS though.

brudgers9y ago

I'm curious what advantages and tradeoffs it has over the project that it is based upon [1] for a person choosing between them.

[1]: https://github.com/kelseyhightower/kube-cert-manager

psg-luna9y ago

Largely, https://github.com/kelseyhightower/kube-cert-manager is incomplete

* it does not support subdomains (only root domains)

* it only supports googlecloud as dns provider

* Bugs and PRs remain unanswered/unmerged

Meanwhile the linked project supports http, SNI and DNS challenges, with around 20 or so DNS providers available. It also supports managing certs for ingress objects directly.

thockingoog9y ago

Does it support multiple SANs on a single cert? I want to streamline things like vanity domain redirections, where every domain I add requires me to refresh the cert.

1 more reply

newman3149y ago

I haven't used this yet but will say that lego (which this uses) is a joy to use.

Motomorgen9y ago

What are the major difference between this and say kube-lego that might entice someone to switch?

psg-luna9y ago

You can manage individual certs with cert objects that aren't used by ingresses.

Motomorgen9y ago

Very cool, thank you!

j / k navigate · click thread line to collapse