Add support for K8S Ingress resources

[kop]

Since Kubernetes release 1.2.0, Ingress resources are supporting TLS. It would be great if this image would be compatible with Ingress.

What needs to be done is to change secret data format to:

"data": {
   "tls.crt": "$CERT",
   "tls.key": "$KEY",
   "dhparam": "$DHPARAM"
 }

And response with 200 HTTP code when root URI (/) is requested (for health checks).

P.S. I will be happy to prepare a PR later today.

[alexcouper]

The only thing stopping me go down this road is I'm not sure how to refresh the ingress controller when the certs are updated. Do you know how that happens?

[kop]

@alexcouper Something tells me that it depends on implementation. There are different types of ingress controllers available: GCE, Nginx.

I think config reloading on certificate change should be part of their job and not this package.

Alternatively, we could create new secret (in format $SECRET_NAME_<timestamp>) when certs are updated and simply patch Ingress resource with a new value. Old secrets should not be a problem, since K8S 1.3 will come with garbage collector of unused Secrets and ConfigMaps.

[alexcouper]

true that would work.

The other thing that had concerned me was not knowing how to route through to letsencrypt pod for some requests (like is done in nginx-ssl-proxy) - but I see now that this is entirely possible using the nginx ingress controller

So in summary, go for it, looking forward to seeing the PR!

[devth]

👍 this would be awesome!

[phutchins]

I've was planning on building something quite similar to this so I used this is a starting point.
Here's what I added/changed...

• Made the changes to get it working with multiple domains and Ingress.
• Added a health check on / so that it returns 200 OK.
• Updated the kubectl version to be in line with docker best practice and make updating easier.
• I made the secret unique per domain and made it customizable

I'd be glad to contribute back some of what I've done if interested...

My plans are to make this more dynamic such that on a service that you want to have SSL, simply add a label and it will dynamically get picked up and handled.

https://github.com/phutchins/kubernetes-ssl-manager

[alexcouper]

@phutchins sounds fantastic. Please do contribute back and I'll happily test and merge.

[txels]

Part of this has been done in #13 (including the new data keys in the secret)