diff --git a/README.md b/README.md index e1c35fc..5f257c6 100644 --- a/README.md +++ b/README.md @@ -164,16 +164,11 @@ docker-compose -f ./deployments/docker-compose/docker-compose.yaml up -d > ### Kubernetes For Configure TLS in kubernetes cluster we need install `cert-manager` base on [docs](https://cert-manager.io/docs/installation) and run the following commands for apply TLS in our application +Here we use [LetsEncrypt](https://letsencrypt.org/) for encrypt our certificate. ```bash kubectl apply -f ./deployments/kubernetes/booking-cert-manager.yml ``` -> Note: Also, we can run this commands for creating new `tls.key` and `tls.crt` and replace them with old one in `booking-cert-manager.yml` section `secret` -```bash -openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout tls.key -out tls.crt -subj "/CN=booking-microservices.com" -days 365 - -kubectl create secret tls booking-tls --key tls.key --cert tls.crt -``` Run the following command to apply all deployments, pods, services, ingress and configmaps that we need ```bash diff --git a/deployments/kubernetes/booking-cert-manager.yml b/deployments/kubernetes/booking-cert-manager.yml index 96c9142..78ce466 100644 --- a/deployments/kubernetes/booking-cert-manager.yml +++ b/deployments/kubernetes/booking-cert-manager.yml @@ -1,40 +1,16 @@ -# ####################################################### -# Secret -# ####################################################### -apiVersion: v1 -kind: Secret -metadata: - name: booking-tls - namespace: default -type: kubernetes.io/tls -data: - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlGS1RDQ0F4R2dBd0lCQWdJVUZhOWxoMTc2enQxK3pSb013TEpoVWI5YUVHc3dEUVlKS29aSWh2Y05BUUVMDQpCUUF3SkRFaU1DQUdBMVVFQXd3WlltOXZhMmx1WnkxdGFXTnliM05sY25acFkyVnpMbU52YlRBZUZ3MHlNekF5DQpNakV4TVRRM01UQmFGdzB5TkRBeU1qRXhNVFEzTVRCYU1DUXhJakFnQmdOVkJBTU1HV0p2YjJ0cGJtY3RiV2xqDQpjbTl6WlhKMmFXTmxjeTVqYjIwd2dnSWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUNEd0F3Z2dJS0FvSUNBUURVDQpqZ01vWHh0YXZzTVhVb0h2YTBXVWZSeWJKTVVnR1NQbml3ZWF3eW41RmlnVVR4Nmd2NlZ2T3pxU21HWjE4NVA0DQpVSWJXQ3VkOVdqRUNFU0pVSkI0cVpiUmlEWUlNQWQyMzM2Y2k1d0RzbkRGVXpuWHRNOWc1VUZmS3dPd2VPVmN2DQpqc1N0WWY2Szl3ZC8xaXRMb3JIeDV0eEVQblBkVGRGR0ZqOVlVT2t1MmM1VllIMk9LaUk3ampDaDAwc3RaZHo4DQp0NWkvL0t2MjdQRHQ2REc3L3VuMHlnVEcxa21NVU1QcnBSQmVIbFFNWWZ0N09xTTNHSHJEZml1SDdjNVpGNWM2DQphRGdQeWt5dzJSM2dMYkJqeUhiamE5VkZKcytkTUViUE1sa0RLeklWK2dndWdWR3d1UWRvRDUvSnZrem8zcVhUDQpjWkp3R0U3Mk9FRmlKbi9Wd1dPSDBXamxYS2pIQkFqaFNuOW42M05GamhzM1NHS3RkaW9xSEJPaVpDeEI2NjZyDQpNSEdaeTE1a0R5emdEVVNGNU9JK0svbWIza3dHRDhTNXV6ZW1PNmRXeFdRd0w3ek5ScHhNaUg0YjhEOENGQlV1DQpyQ0lDSWt1NWhTRC9MTnZ0K05PVnRDUllUalNMT01kWmFjdEg3MFAxRXdxckpHUzJzSms4RERpMmg1bzJDaG5JDQpXL2t4TU95WnIzYk9EQUJaTGlhTndIWXZFSEJISHdndWVYR0hiaVlVRGg3czlzTWZKUVpyR1pEbmQ3R0h5STdIDQplbWRzYkIwMnN2ekRQckFFOUxRZjRXQi9kcWFOUmxJMmZ0SnIzSEo1YTlnWUJvSkRLWnU2OVI0N0c2MGozbXJrDQp4SHVYR1JDYzh4QW1PcUk0VWNla3RXb0RaR1prTEUxVXdIeFlQRVJ4WndJREFRQUJvMU13VVRBZEJnTlZIUTRFDQpGZ1FVR3lxY1p6U2NSWWJtcDNOZkhGc1k1NHJaUU5Jd0h3WURWUjBqQkJnd0ZvQVVHeXFjWnpTY1JZYm1wM05mDQpIRnNZNTRyWlFOSXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FnRUFiaU9xDQpYUFowcW9yZmZZOW5YUWtpY2RaQjdmTXFEZjV6WjIybFdCRTRmbER6ZDhmZk82TmVIL0Z0N1UzWXdwS3N0dXpoDQozbkhWYlIrVDM1YnVmVXBMeVBibStKL2dJRzlTSHk1TlRrMmVuKzdseHJvYmVzTlZuNjY5Uy9UQW1yd2ZwbEN5DQpWZXB0WVQ0MkpsMy9TZDY0RHdINExIQVVyUGpzZFVoeVl5V2FXbnRUZ3JxeEF5K3RVb1B4anZyWDE0ZVdDNndIDQpjOHQxb3ZNU2ZTczVlYXBzd1JPUUsyVkFyKzE5cDJwRllQVEVMNzVlcENoeG4yZjI4Z1ZubEVWZ21rQW9rNFBSDQpJV2s0aldkei9IU0duT1BJNU5DbW1vZW9nUkFjdTNUOWp4cE9vRkFHWFlFMU9FdEdxV2kxeUpBRUo0NU9WVHNZDQprQk9pRnhsOC8xZUIySmRWWFBDRVRVaFZ6Uy93bGZIOG5vd1pzenk1OHNRNVF3RzllMXduVXcvMFI3M3NTMUVHDQpxY0hraUJFRDB5Z05DTndNT1ZYTW5hbEREbmlYS0JKd3FaMFk1SytMOVlYek9HaU8raEJNMUxFVFRxeXVHdzdJDQpVM1NwcUR3SVZJU2gzRDhNVzc3WFFXZmdQZXk1TE1Fa0x1SHQ4akt5aTVCMDZKOUE3Rm1XWGdzdmlqZnJjbGFBDQp3ZHBDakJWN2pjY216Qkl4WVV3cEtOUHljY1Q5Mk43UDg2VlEzV2NPQ1BqSGJnUDNtMXRTUlQ2UG9nakRibjdNDQp3VmhUeUNvMGN1cTJRV2I0cUtYN3NIUHZDSmJyS3pJY1Y2ZE9iZm1zUjUzMEt0cTZaU0xNbVQ5RzJkSnFzT0FtDQpsNXlMU1ByU2E5Tjl0UU03Q1lSMzB4N3ZnaTNHZ29GVGxrQ1hGV0E9DQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tDQo= - tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tDQpNSUlKUkFJQkFEQU5CZ2txaGtpRzl3MEJBUUVGQUFTQ0NTNHdnZ2txQWdFQUFvSUNBUURVamdNb1h4dGF2c01YDQpVb0h2YTBXVWZSeWJKTVVnR1NQbml3ZWF3eW41RmlnVVR4Nmd2NlZ2T3pxU21HWjE4NVA0VUliV0N1ZDlXakVDDQpFU0pVSkI0cVpiUmlEWUlNQWQyMzM2Y2k1d0RzbkRGVXpuWHRNOWc1VUZmS3dPd2VPVmN2anNTdFlmNks5d2QvDQoxaXRMb3JIeDV0eEVQblBkVGRGR0ZqOVlVT2t1MmM1VllIMk9LaUk3ampDaDAwc3RaZHo4dDVpLy9LdjI3UER0DQo2REc3L3VuMHlnVEcxa21NVU1QcnBSQmVIbFFNWWZ0N09xTTNHSHJEZml1SDdjNVpGNWM2YURnUHlreXcyUjNnDQpMYkJqeUhiamE5VkZKcytkTUViUE1sa0RLeklWK2dndWdWR3d1UWRvRDUvSnZrem8zcVhUY1pKd0dFNzJPRUZpDQpKbi9Wd1dPSDBXamxYS2pIQkFqaFNuOW42M05GamhzM1NHS3RkaW9xSEJPaVpDeEI2NjZyTUhHWnkxNWtEeXpnDQpEVVNGNU9JK0svbWIza3dHRDhTNXV6ZW1PNmRXeFdRd0w3ek5ScHhNaUg0YjhEOENGQlV1ckNJQ0lrdTVoU0QvDQpMTnZ0K05PVnRDUllUalNMT01kWmFjdEg3MFAxRXdxckpHUzJzSms4RERpMmg1bzJDaG5JVy9reE1PeVpyM2JPDQpEQUJaTGlhTndIWXZFSEJISHdndWVYR0hiaVlVRGg3czlzTWZKUVpyR1pEbmQ3R0h5STdIZW1kc2JCMDJzdnpEDQpQckFFOUxRZjRXQi9kcWFOUmxJMmZ0SnIzSEo1YTlnWUJvSkRLWnU2OVI0N0c2MGozbXJreEh1WEdSQ2M4eEFtDQpPcUk0VWNla3RXb0RaR1prTEUxVXdIeFlQRVJ4WndJREFRQUJBb0lDQVFDUEQ1NVVkOTdqYnUzRUxzWkJyTVBDDQpNNHNqYU5ZOHltNytFdmRsVk9KVlFuSnJhTzFHYUhjaXJJeTV5bFY4SWh0LzBFTlFvVG81aHBEaHdVS0h1MStLDQpUYlhoSVJKY25venFpMS9rLy9JQlR3ZHMreUVvSy9MbWNJc0dibDc5NEw0cnhqM2VMTXkwSDV3dWtLbkhXSlBJDQpLd2dwN3BieFpzVHFGV05CUUFRU2dvcDdzRndSYVk1czQwRWNTaWlaUDZ4RGRCY2RjU1VWSjFqcDU1UkI0a3I1DQpkVmROdFVEL2JnVFAvK05LVmNOZ0tqcW5NRXBXZE9WNzJ0blZ2VnRiWDZOcnJtVzlTdjNmTWVNSDFmaVkwSDRrDQpoNW1kMTRkNVZ0cng3Z00zUE1XVFFSeHNvS0dvL29CYnE5aHlZdUZGQTBZOVVIMnRjTThFcmN4a0VXR05MNEthDQoxcjdvOTR5QWlHemRYd2xLbjdoSFBMWHlhc0lyYmF1T3FrSUE1ZUNnRkplQm9McUkrU1UyakJEZ3NPZlVOaHpWDQpNTmIxQzNoNGl3OUp2TER6MXMzaDJPbGxCY080WnBSamF0ODBQY1E4Sm5SK2l4VWUvYWdiS3ZRR056cEVobkovDQpOdWt2V2NWdXJrZUNRY1lQc01rWlMvUGlHK0U1NElSUVlvRHBoakZIUHd1cW12bWZKMTNUMjN2NXAvelVBNXVUDQoxQVFkMWRWL1JrQmtBcG9RWm51c1g3Q1ZCcWpUaGRWREVVem91OVRrK09nR016WkZRd0NjYVNWQllWVlg5OXkwDQpUTVpReFN6MlllUS9hZmZ2M2FDZ3dkZHhyZERFQzNDYm9BUks1bW91ZEhxaUVhSExROEswR3pValdzTDhTVnhGDQpOZ2JHNnFLcW5XWUJyeFIrWkFsOUlRS0NBUUVBK1puaE8zOWNNUnJhdk1EYzdNYjlkdFFoSFBYeFpnR2xaVGZTDQpWMHhrV3RPZEFqZjNHVlJ2RERqRE1oMk9hQUZiakFDSVBYdGoyaWxWV2MxSWIwQmxTbTVnVEdHeERrMVIvVTg3DQo2QUVGa3ZxME8rTWtSZjhQS21LQWpCa1RYY1VhbVo1NjFwQWRaaldSeDVBNi9IbW5lWGxxbzM3VDBhaTg5alRUDQpGMXpKeWZ4SXNwVGZ2YVJDUFQrSndMNWx6TmRFUmpUd0MzZDZRSWhRM2Q2MWhYMFFvVFhjeFpXRmNvMjNCemFwDQpMei9uYjNqOG81TFNnQ2JCNUdDQzd6SGtUYlN2SHNjdnVOOWFySDkwNE5CZ3g4aWJ6b3B6WHdaaFhzK3pxZWp1DQpkSVgxWHhONUFUSVEwak1hK0I3WnI1Tmp3TnU0T1JtdjQwZUpzNlhFOHgza0FXNjdMd0tDQVFFQTJnRC93RHRmDQpsU2l6c0g0cnExK1pFZE96K3AvQ2Fjdk1CK2lxdTczdEJROG8xR1ViVlJ3Q0h0TjkzeHQ0RUEyMGk2NjFobU5LDQoxL2kxNWljeERiVG44akg4SStOd0F2clRVSzJ3eGVkRXNxK3ZWZWtUaWoya0NLOVVJMGh1eFBFSTlkMVdKNnk4DQp1eDhibFFyNTMyUEpYT2FLMlpUOEE0eERBMk8wOThNOFQydUdlTEtlM1phc0ppRjJLTXJuMyt6TlRmWW91ODJVDQpacDdwN2MrbDh0bmRIUC80MUxjQno2dklPQUhDb3lKYTZmeEY0YWhMRThiU3VUaFBGVS8rRGpIZm1nb0xiMTgrDQpyZDJSR09ZU0R5dWZPT1lKN3NBY1hKVGFRK2hjVVpuRHFOcktLZkdBTlhGYzVUSGVEYTlkamRHMkNLaURhVXNHDQpFWEE4SGxvMWRFZS9TUUtDQVFFQXJoYkQzNG12Tlppelk5OW90OFQ2MkR5UWMvQ2VWRFZsdExsQWZoOE1COFY4DQp4eVZkdFU4TXZRdUNLWnd2elI3VlNVcTl1NVFxU3VsMVhGTXY2RmlUelZ3NjBrdDVBSzZ4TnVwaXNDaTJTSk9QDQp6ZzFaS1hFQ2xOOXJKVXdBRS9ENzRwV0V1ODU4a3VOZU1FREt3M25lYzMxYUFYcmVKbWQ0bElpM2lwM3ZLSEJNDQpEREtGODNGenVlQnRKZ0FtWkw3b0ljZWVmWUR4eGJ6T0dsSFJiYStUUDcyZnBEZnJnY0NTSGZmai9NNm5qenBsDQppM2xHVkplenVLUVA3dUZ2aVRzeXdWYlFWRE9FdkxlUlA1UlhURUVCV3dkNS9KY29wc1piVzNEWmtIQTJlZi9NDQo4Q2FKVVBMUUpxcnR6ZVlSTjF5SW0xcnRNS3Fld3F3bU9DTnErZ3pQaFFLQ0FRRUFySUJ4M3hpY0w1ai9acjdQDQpxMUYvKzkwNjR5d2JXRC9NK00wZ25HSlM5TmZrQlB6a1BkcGx5eUtxelNvZFBRYTdRSFJFYTB5U1lvY0kyRTlXDQp2M1BRdlpMVDQwb0t6akRQbVYxM0xZSXNsLy93aTloY2Y5ejZ1V3lTOVVCUmRrRU1TQkNXSmRySGxJR3UvNmFwDQp4aHhkcjhjMVE2cGlLQ1NLdWxuaFR0UU1Hd1FJYWVWZFZCWHZybFIzL1J0aGs0ejdmNTh5NkRocUh6SE1CVU4wDQpHdEJONks2YnBTWVNwdE5WSVF3emlZYWJ6ZDZ6SlRaWUFoUW5saXg2VjNEdXBTak51RVFPZkZndmJzQ09HZGVqDQpucUZ6NGtBVXgvajMrRUpJMjhjM2xkSklRb3F0d2JhNUxwQy9ZeFNza3NPYkVhZEpsVnhTYjdUUDNtaWpDWmwwDQpCc2puRVFLQ0FRQTZDSG5LZTNWNEF5WkRJV1N5UE0xZ2Q4VWVyQWY3V2paLzJ1RU0yWC9Nc1JvN2pHeHh4U0JMDQpUOE5vemtuZ05GbXV2SENnOURpdXRxZ0N0eHV5TXZ6MmJ2MnhXdWxPMm9ZL0NVdUQvVzV6aU44NzlnenBPSStPDQo5T0d4NklUV2xqZ0FKQmt4U1RaYXpYd0NVK05qNDlkY2ZicWhEZGtTQWZ6RW1COGpCRzEzaXprcVZEQTdYU0lBDQoxWDNUdEpkSGwzUmYwNFpoUUN1aCthWEdlRjdHOHQ0QTFhZW1iWWIyUStjM1BPK0s2ZlZZU3doTC9PeEdFdmUzDQpEc2x1aUZ2ZnM1cFIwb3B0ZWR6Y1RQdHhQM29tK0JiSThvUnVHVUdMdkNKbS9GYlNOL0c1TGFZS1U4YlkydHlhDQo1L05QTjR1OTZCcStRYUFsS0hKc24xL01XRWRaTS9ocg0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQ0K ---- -# ####################################################### -# Issuer Cert-Manager -# ####################################################### apiVersion: cert-manager.io/v1 -kind: Issuer +kind: ClusterIssuer metadata: - name: booking-microservices-issuer - namespace: default + name: letsencrypt-staging spec: - ca: - secretName: booking-tls ---- -# ####################################################### -# Certificate Cert-Manager -# ####################################################### -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: booking-microservices-cert - namespace: default -spec: - secretName: booking-tls-cert - issuerRef: - name: booking-microservices-issuer - kind: Issuer - dnsNames: - - booking-microservices.com \ No newline at end of file + acme: + # Staging API + server: https://acme-staging-v02.api.letsencrypt.org/directory + # server: https://acme-v02.api.letsencrypt.org/directory + email: test@email.com + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx \ No newline at end of file diff --git a/deployments/kubernetes/booking-microservices.yml b/deployments/kubernetes/booking-microservices.yml index 685b2f9..de4e79f 100644 --- a/deployments/kubernetes/booking-microservices.yml +++ b/deployments/kubernetes/booking-microservices.yml @@ -762,6 +762,7 @@ metadata: name: booking-microservies annotations: nginx.ingress.kubernetes.io/rewrite-target: /$1 + cert-manager.io/cluster-issuer: "letsencrypt-staging" nginx.ingress.kubernetes.io/use-regex: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" nginx.ingress.kubernetes.io/proxy-buffers: "4 256k" @@ -775,7 +776,7 @@ spec: tls: - hosts: - booking-microservices.com - secretName: booking-tls-cert + secretName: letsencrypt-staging rules: - host: booking-microservices.com http: