Exercise: Ingress with TLS in four commands

Host: controlplane · Time: 6 min · Domain: Cluster Setup

Task

• Namespace shop has a Service shop on port 80.
• Expose it as shop.example.com over HTTPS using a certificate you generate.
• HTTP must redirect to HTTPS.

Acceptance criteria

• kubectl get ingress -n shop shows the host and the TLS secret.
• curl --cacert ca.crt --resolve shop.example.com:443:<ingress-ip> https://shop.example.com/ returns 200 with no certificate warning.

Solution

openssl req -x509 -nodes -newkey rsa:2048 -days 365 \
  -keyout /tmp/tls.key -out /tmp/tls.crt -subj "/CN=shop.example.com"
kubectl create secret tls shop-tls --cert=/tmp/tls.crt --key=/tmp/tls.key -n shop
kubectl create ingress shop --class=nginx \
  --rule="shop.example.com/*=shop:80,tls=shop-tls" -n shop
kubectl annotate ingress shop -n shop nginx.ingress.kubernetes.io/ssl-redirect=true

Checks: secretName spelled right, secret in the same namespace, ingressClassName
present, pathType: Prefix in the generated object.