Free SSL for Kubernetes with Cert-Manager

[@minhthinhhuynhle9103]

Just to clarify, every EVERY videos from Mr.Dempers are clear and intuitive even for both newbie and intermediate k8s users. I like the way you edit the video, your speech are continuous and delay exactly on time. Your voice are clear, the illustration from images are straightforward. Step by step guiding are totally insane for such low-level users. It worth every second watching your channel even on holiday. Thanks to your project. I jumped to K8s Intermediate level really fast.

[@MarcelDempers]

Thank you for the kind words 🙏🏼

[@noo-sho8500]

I know it's big words, but IMO you are creating the best DevOps channel on YT. Thanks for your hard work!

[@MarcelDempers]

Thank you for the kind words 🙏🏽

[@Chiprohydrate]

You are sir, the reason why I am watching work related videos at holidays. Really interesting, informational and cool edited content. Keep it up!

[@laurent.treguier]

I now have my first app properly deployed with k8s, using cert-manager to rotate certificates, in great part thanks to this video!

[@machtnyx]

And all of a sudden the mist of magic around kubernetes/ingress/docker begins to disappear. Thank you Marcel, please keep going! It's absolutely helpful watching your videos.

[@TheArpitkoberoi]

Struggled with this when i was starting out with k8s. This would be very helpful for beginners.

[@yashizuko]

Well thank you ALOT for this! you dont even know how many hours i was on this subject, now i can have this configuration and make it work in my cluster, many guides just forgets to mention the nginx ingress, thanks for the clear instructions!

[@Madeinchinaagain]

These videos really are fantastic. They bring so much clarity to an otherwise mystical system...

[@ipup9725]

Thanks to you, I finnaly combined the results of 10+h of googling and resolve the certificates issuing

[@denisalustau]

the only place I could find my answer! Thanks a lot! Subscribing now

[@Ankur512512]

Thank you so much dude. Had to complete a Test assignment for an interview and it helped. :)

[@ryanwendel6115]

One of the best tutorial videos I've ever seen. Def subbed. Def going back through your catalog. Might even push a tweet out about it! Thanks, Marcel.

[@adrianpop6521]

way too underrated channel, while all the channels should be like this

[@jaked4736]

I think this is EXACTLY what I needed to see to learn how to cert my cluster. Thank you!

[@waynefl76]

Thank you for taking the time to create such thoroughly informative videos. It is appreciated more than you know!

[@MrSuriyam]

GM sir, through your guided video I am able to learn kubernetes and how secret it is. Thank you 🙏 for the teachings sir you are DHA 🌳 groot.

[@ThatOdooGuy]

You read my mind :). Exactly what I was looking for... Great content and wonderful presentation. Keep it up!

[@Han-ws8he]

Thanks! The only issue I ran into is the permission for binding port 80 & 443 on ec2 instance where kind cluster running. I had to assign setcap for kubectl. It works!

[@medamineblibech5641]

thank so much sure for your explication about cert-manger . I be grateful to you answer me about what the problem in ingress is invalid host header when I deploy my app ?

[@HestonSinurayaJogja]

Thank you for the step by step how-to Marcel. I was able to install a multi-domain certificate into my kubernete cluster. You are my hero sir.

[@ChronicWhale]

Thank you so much for all your tutorials, they're incredibly useful, well made and clear

[@jackjackjackjack]

every video of yours I have watched has been so incredibly helpful. thank you.

[@CRuas-vu9xo]

Hey Marcel, the best video explaining this subject. I've done everything working perfectly then stopped work because got expired. Now I'm trying to find out how to renew.

[@marcchen4574]

thanks, do you have a video with eks + aws load balancer as ingress controller as example?

[@saarang4637]

Thank you so much for this tutorial. You have explained all the concepts so well. I already had everything setup and just required the tls to be setup. It is done now.

[@Palex1990]

Very nice tutorial thank you. I am wondering if I can use it... How to use the cert-manager when you have an external load balancer? I have a three node rancher cluster with an external nginx load balancer? It's not possible since cert-manager does not expose the secrets right?

[@gantushigsaruul2489]

Thank you for your great tutorial. It was very educational and helped me to learn a lot of topics. However I do have a problem with installing and using cert-manager with the GKE autopilot cluster. The cert manager installs but the webhook doesn't work. Tried with Helm too. Not avail. Is there anything to recommend, please?

[@Daniel-yl5fi]

I love all the videos I watched from you. Basically, you make sooo valueable guides! I wish your channel had 1M subs and more views because damn, your content is awesome!

[@GertvandenBerg]

MetalLB works well for LoadBalacner services on on-site clusters (not sure about in KinD though...) The other method if ingresses are involved is to use the "cert-manager.io/cluster-issuer" or "cert-manager.io/issuer" annotations. With that, cert-manager will create the Certificate object as well.

[@pigrebanto]

Great! how are certs renewed afterwards?

[@Easyjeevan]

This is what I was looking for complete SSL in k8s and there are dozens of places which give some information but not complete and very well explained. You did a great job. This is awesome. It really helped me. As always Thanks and wish you a very happy new year 🥳

[@MarcelDempers]

Thanks for the kind words 💪🏽 Happy new year 🎉🍻

[@ganeshpawar231]

Is it important to have domain name? Or we can also do it by editing /etc/hosts file and set up temp domain? Why because I am doing it on minikube and I have done issuer.yml and it's just showing "Issuing certificate as Secret does not exist" and not creating extra ingresses which will be created after updating ingress.yml with tls: and annotations: Please let me know... Thanks

[@techiepills]

Wow! 😊 Thanks Marcel! Thats the best tutorial out there.

[@NysaSyna]

Can you do a video on how to install wildcard ssl on ks8

[@itsmepakky]

thanks for this video, i have one question, will certmanager will work with NLB in EKS with nginx or kong ingress controller ?

[@ahmadooof]

More than great, you deserve millions of subscribers

[@vincenzocalia6552]

Marcel you are the top one! Your content is always really clear, enjoyable and to the point. At time I get lost with som cli command you use but hey, that makes me a better dev. So once again thank you very much for the effort you put in it. I'm now finally getting into cert management for my cluster on Azure and this was a great deep intro to it.Now I just need to translate it to Terraform lol 😅 A big hug from Italy

[@Roan1669]

Dude!!! You are a freakin legend! Thank you so much for the great content and resources in GIT

[@devt1627]

Do you think you could make a video on how you make your videos? Really love your stuff!

[@this_minizilla]

Amazing video, really clearing up my headache of setting up SSL.

[@gabbah79]

We followed this and it was a breeze thanks to this awesome tutorial! Thanks 🙏🏻

[@sarfarazshaikh]

Great Video and Great Explanation. How can we generate the wildcard certificate using cert-manager and aws route53 using dns challenge method.

[@kannanswaminathan8210]

i have multiple applications running in multiple namespaces. Currently i am coping the secret yaml file to all the namespaces. I also have ingress rules in namespace. How to manage the secret file accross the namespace?

[@Shawn-Mosher]

Thank you! I was just playing around with this on a kind environment when you dropped your video!

[@rockjoly6492]

It is kind of way too easy now to be a programer now. Thank you! :)

[@guents]

Maan if all those kubernetes commands you ran worked for me as well as they do for you, I would be 5 years younger :D... thanks for the content, great explanation!

[@robertsarnapeta5825]

what kind of challenge will be raised by cert-manager and if the challenge fails, then secret wont get created. isnt it.? what are those cases where the challenge will not complete. please explain. Thanks in advance!

[@gopikrishnap07]

if dns01 solver, what are the records needed to create on Cloudflare?

[@ConnorHaythem]

Hi, I tried this in a kubeadm cluster in cloud vms, when i deploy nginx controller, i can access it. but after that when i try to expose a service using a nginx object it returns 302 in a loop

[@LemontJap2k]

Do you have a video about MTLS ?

[@chijinduiwuchukwu230]

Thanks so much for this. If I am using EKS cluster and route 53 manages my DNS, there is no IP address issued when I set the kubernetes service type as load balancer, instead a NLB is created on AWS, and the NLB endpoint shows under the external IP colunm. Can I use this NLB endpoint in place of the IP address and map it to my custom domain name and still have the certificate issued to my domain and have it working properly?

[@MarcelDempers]

Yes you could. You can map your domain to that as a CNAME record and should work

[@chijinduiwuchukwu230]

Oh great. Thanks so much @@MarcelDempers

[@Navinprasad08]

For inside cluster communication, can we use cert-manager? any docs available please?

[@Equality-and-Liberty]

Is this also going to work in a situation where port 80 and 443 is forwarded to my Synology NAS? my Kubernetes cluster is running on a server. In the past, I spun up an Nginx container to secure my environment with a certificate from let's encrypt, but it never worked because the port was forwarded to my NAS.

[@developer-guy]

Best video I have ever seen related to that topic

[@davidmontdajonc6332]

Hi, why do you create an nginx Ingress load balancer and then another load balancer for the application service?

[@MarcelDempers]

These are basic two basic kubernetes concepts with different roles. Ingress is a conceptual mechanism to route traffic based on rules. "I want to route this domain and this path to this internal k8s service. Under the hood its an NGINX proxy that does the work. It cannot get a public IP without a service construct. Service constructs with (type Loadbalancer) interfaces with the cloud and it's main purpose is to give the cluster a public IP and to load balancer traffic from outside to the ingress controller.

[@davidmontdajonc6332]

@@MarcelDempers Ok I get the point, the thing is that when I create the ingress-nginx controller it already creates a physical Load balancer in my cloud provider managed kubernetes service so when I apply the application deployment and service of type Load balancer it creates a second physical LB and I end up with two physical LBs which is quite confusing. How can I use the first created LB to apply my app's deploy and service without creating a new LB? Should I first create this (the app's deploy and svc) of type LB and then apply a simple ingress? Thanks Marcel!

[@MarcelDempers]

@@davidmontdajonc6332 You would create the ingress controller first which would use a service to get a public ip (via a load balancer). Applications that wish to route via ingress should set their service type to ClusterIP as they dont need a load balancer. Then deploy an ingress rule to route a domain and path to the target application service.

[@davidmontdajonc6332]

@@MarcelDempers Thanks! It works as expected now but I need to add some annotations to the ingress controller service configuration like: "service.beta.kubernetes.io/do-loadbalancer-protocol: http" etc. in order to work for websockets. How do I edit that config for the ingress-nginx controller LB? Ok it's: kubectl edit svc -n ingress-nginx ingress-nginx-controller in case someone needs it.

[@sureshkachwa1001]

What if we need a wild card certificate, for different Namespaces different certificate will be created based on the host name and that too with HTTP01 challenge

[@martintovmassian5538]

Helped me a lot even in 2022! Thank you very much!

[@ahmedahmed-my1iq]

is this safe to implement both in prod and no prod?

[@albinantony17]

when I check describe my certificate it seems like>>>>> Issuing certificate as Secret does not exist Do you have any idea showing this? Could you pleae help me on this?

[@SimarMannSingh]

Video Request (If possible): Comparision between K8s, MicroK8s, K3s etc ? What is the difference between docker and containerd, services wise (under the hood)?

[@Tech__Futures]

What the heck man? This video is amazing! I'm glad that I've found you 😊

[@2sourcerer]

Thanks a lot, I got it set up! So this is called TLS termination in Nginx since behind Nginx only port 80 is used?

[@MarcelDempers]

Yes you're right! TLS is offloaded by default unless passthrough is explicitly stated in the ingress annotation

[@Артём-ц5ц9е]

Hello from Belarus, it was interesting to see wildcard certificates. Thanks =)

[@Fayaz-Rehman]

Thanks for revealing the secrets - the best video on youtube - bless you.

[@maddy13571357]

Very nice content, if you have to follow this with aws free tier account, what extra we need to do??

[@goodcitizen4587]

Really cool instructional video. I'm going to check out your example code and give it a try.

[@LemontJap2k]

Great video. Very helpful. If I want my pods to communicate via REST API using https internally, will this be applicable?

[@MarcelDempers]

Have not explored this yet, but I think what you are after is mTLD (mutual TLS) between internal APIs. Might need to explore mTL with cert manager (if possible) or other tools

[@LemontJap2k]

@@MarcelDempers I also watching your ISTIO video. Do you think it would be appropriate to use it?

[@hellboy0666006660]

As usual the best video for the issue on youtube/world/universe. :-) - Keep up with this magnificent videos.

[@mohammedmubeenhussain1143]

Awesome explanation🥰. Thank you

[@hectormanuel8944]

AMAZING CONTENT!!! I will love to see this integrated with Istio

[@diegoemartins]

Great Content, thats exactly im a looking for. But its normal the Acme responde slow down about 30 minutes? -> Waiting on certificate issuance from order..

[@MarcelDempers]

It sounds a bit fishy to me that it takes so long. I know there might be rate limiting on the production endpoint. There is good troubleshooting docs here to debug orders\challenges. cert-manager.io/docs/faq/acme/ If you're still stuck, I'd report an issue on the cert-manager GitHub repo, or chat to the folks in the kubernetes slack channel, they're very friendly and helpful

[@diegoemartins]

@@MarcelDempers yeah, looks like a problem here. after waiting 8hours, nothing change. i trying do more stuffs and report to you thanks

[@diegoemartins]

@@MarcelDempers Strange that. when im apply the certificate.yml the K8s not create a secret, the secrete comes with 'opaque' -> thats normal?

[@diegoemartins]

@@MarcelDempers everything its fine, when im troubleshooting kubectl get challenges im receive a response that my other ingress causing a conflict,(im using a baremetal) an metalLb, when i remove that ingress, works like a charm! thanks man!

[@danialatash9815]

Amazing!!! It was great, I learned something! Thanks

[@felipeozoski]

I absolutely love your videos man!!! Thank you so much

[@richardokonicha]

This is too good kind sir 🤲🏾

[@alburton4337]

A.burton-Boston one the better videos , I like and subscribed ... excellent work.

[@johnmontoya7183]

I'm trying to setup let's Encrypt for my linode Kubernetes cluster but I'm able to get the certificate to issue. Can you help?

[@johnmontoya7183]

Never mind, I was able to find my error and wiith the content of this amazing video I'm created a successful SSL using let's encrpyt. Looking forward to more vidoes DevOps Guy

[@moosegoose1282]

Best explanation. Can u also do a tutorial of all things combined? Nginx, load balancing and ssl

[@stygis]

Nobody talks about http2, seems like after ingress and ssl implementation there is no way to keep http2 connection.

[@thezquad]

I have a spring boot application on google cloud kubernetes that I need to setup letsencrypt for with automatic (

[@MarcelDempers]

Correct! Make sure that your Spring boot app reloads the certificate because cert-manager will only place the cert in a k8s secret. Your app might need a restart to consume it or add code to pick it up once rotated. If you use an ingress in front of your app, many ingress controllers will auto detect and load the new cert in a secret.

[@thezquad]

@@MarcelDempers One more question. I have a load balancer infront a few pods, can I not setup ssl using the loadbalancer? Do I need an ingress controller explicitly for this to work? I am confused as to the interaction between the load balancer and ingres

[@MarcelDempers]

@@thezquad Ingress controllers makes this task much easier, especially when you want to introduce new domains, more services, more certificates etc. Ingresses scale easy in terms of engineering overhead\maintenance. And the ingress controller can share a load balancer amongst many services

[@thezquad]

@@MarcelDempers Aight I will follow your instructions exactly and see how it goes.

[@thezquad]

Hope you dont mind the question, 2 questions: 1. What changes do I need to make to support ssl on wild card names eg. api.domain.com or www.domain.com. This method works fine with 1 host but when I changed certificate.yaml spec > dnsNames to include - domain.com, - www.domain.com, - api.domain.com as in cert-manager.io/docs/usage/certificate/ but I get an error: Fields on existing CertificateRequest resource not up to date: [spec.dnsNames]. I also update ingress.yaml spec.tls.hosts and corresponding spec.rules.host* to match the aforementioned dns names. 2. Do we need to keep the deployments running continuously (certificate-manager, acme pods, etc), on gcc its gets expensive :)

[@david2358]

I should have subscribed to this channel earlier. Awesome Content - Just Subscribed !!🔥

[@Stefan29dec]

a big red hart from Romania ❤

[@SanjeevKumar-nq8td]

MetalLB can give the LoadBalancer a external IP.

[@cicddpd1859]

You should create END-TO-END tutorial of setting up HA SSL VAULT with Consul :D

[@cicddpd1859]

on k8s of course

[@aliefseventri9793]

you are really amazing, instructions are really clear!

[@rne1223]

You have save my bacon once again sir. Thank you.

[@radedev]

You're the beast. Thank you for this.

[@drhojun]

Thank you. I like the style of explanation.

[@dontdisturb100]

So clear explanation. appreciated.

[@sachin2312]

Great video Marcel !! Thanks for info

[@bhaaratsharma6023]

Simply brilliant.

[@suaeb175]

You saved my day. thank you so much 🎉❤

[@zoop2174]

Thank you this helped me so much!

[@kzvonov]

Works like a charm, thanks!

[@codrutalexandru]

These tutorials are great. Thank you!

[@ricardohincapie1537]

your videos are awesome. Thanks so much!

[@OneClickLabs]

Thanks a lot, that’s a really useful video.

[@salborough2]

such an excellent video thanks Marcel :)

[@superaca]

another great video Marcel !! Thanks

[@laakolina]

Wish I had found this tutorial early.

[@yoyartube]

I'm going to try this!