Put gcsweb behind ingress and install a TLS cert for it about k8s.io

[ixdy]

The submit-queue has been using kube-lego for a while, and it seems to be working fine, even though it's not for "production use".

It seems like the simplest option, and is probably easily extensible to the rest of the k8s.io services.

[thockin]

ACK

…

On Thu, Dec 21, 2017 at 2:28 PM, Jeff Grafton ***@***.***> wrote: The submit-queue has been using kube-lego for a while, and it seems to be working fine, even though it's not for "production use". It seems like the simplest option, and is probably easily extensible to the rest of the k8s.io services. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#38 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVFK1t1CY5zzl_Cq0wi8x7MApn2Kwks5tCtt9gaJpZM4LHKR7> .

[ixdy]

kube-lego is deprecated; cert-manager is the endorsed replacement.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[thockin]

/lifecycle frozen
/remove-lifecycle stale

[munnerz]

If someone wants to point me to where the definitions for gcsweb live, and if this is still something that needs doing, I'd be happy to open a PR!

[munnerz]

d'oh. just spotted /gcsweb.k8s.io...

Presumably the cluster that's being deployed into is not already running cert-manager, and presumably we want to use GCLB ingress (i.e. ingress-gce) for this? 😄

[thockin]

James, Presumably true, so far. :)

…

On Wed, Dec 5, 2018 at 10:53 AM James Munnelly ***@***.***> wrote: d'oh. just spotted /gcsweb.k8s.io... Presumably the cluster that's being deployed into is not already running cert-manager, and presumably we want to use GCLB ingress (i.e. ingress-gce) for this? — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[ixdy]

cc @hh @justinsb

This is probably a good first step - if we get TLS automation working for gcsweb, then the k8s.io redirector site should be an easy extension from there.

[ixdy]

Neither gcsweb nor the k8s.io redirector is running behind ingress, so that's the 0th step.

After that we can set up TLS automation.

[thockin]

GCSweb should be easy since it has only one hostname. The redirector is the fugly one.

…

On Wed, Feb 6, 2019 at 8:59 AM Jeff Grafton ***@***.***> wrote: Neither gcsweb nor the k8s.io redirector is running behind ingress, so that's the 0th step. After that we can set up TLS automation. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#38 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVKX_ceTUaYAKv1sVUfGURbU7svTgks5vKwoBgaJpZM4LHKR7> .

[ixdy]

We should also put slack.k8s.io behind TLS.

[thockin]

Also true.

…

On Wed, Feb 6, 2019 at 11:52 AM Jeff Grafton ***@***.***> wrote: We should also put slack.k8s.io behind TLS. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[thockin]

#180 - put gcsweb behind ingress

…

On Wed, Feb 6, 2019 at 11:53 AM Tim Hockin ***@***.***> wrote: Also true. On Wed, Feb 6, 2019 at 11:52 AM Jeff Grafton ***@***.***> wrote: > > We should also put slack.k8s.io behind TLS. > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub, or mute the thread.

[thockin]

As far as I can tell the ingress part of gcsweb is done. Simple recipe to follow for slack (when ready).

Now for the TLS part :)

[ixdy]

I played around with cert-manager a bit this evening, got it working on my own deployment: https://gcsweb.ixdyland.net/gcs/kubernetes-jenkins/

Should be pretty easy to deploy this for the "real" gcsweb as well as the k8s.io redirector.

Only issue with putting the k8s.io redirector behind a GCLB Ingress is that I'm not sure we can do http -> https upgrades.

[ixdy]

OK, it's possible to force http -> https upgrades by inspecting the X-Forwarded-Proto header.

Example of its use in gcsweb: kubernetes/test-infra#11176

[ixdy]

not yet deployed

[ixdy]

This is now deployed; gcsweb is running behind an ingress with https, and it auto-upgrades itself from http -> https.