SSL in Kubernetes with Nginx Angular 6

11/24/2018

I have an angular(6) application that is running on Nginx and deployed to Kubernetes. Here are my configs:

Here is my docker file:

FROM node:10-alpine as builder

COPY package.json ./

RUN yarn install && mkdir /myproject && mv ./node_modules ./myproject

WORKDIR /myproject

COPY . .

RUN yarn ng build

FROM nginx:1.15-alpine

COPY ./server.conf /etc/nginx/conf.d/default.conf

## Remove default nginx website
RUN rm -rf /usr/share/nginx/html/*

COPY --from=builder /myproject/dist /usr/share/nginx/html

CMD ["nginx", "-g", "daemon off;"]

And my nginx configs are as following:

server {
    listen 80;
    server_name mywebiste.com www.mywebiste.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name mywebiste.com www.mywebiste.com;

    ssl_certificate /etc/letsencrypt/live/mywebiste.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mywebiste.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    add_header Strict-Transport-Security max-age=15768000;
    root /usr/share/nginx/html/myproject;
    index.html;
    server_name localhost;
    location / {
    try_files $uri $uri/ =404;
  }
}

In this approach I sort of have to generate the certificates in my local machine and then copy it to the kubernetes cluster.

I am not sure if there is a better way to handle the SSL certificates here. I did some research, there is something called In nginx ingress controller, but not sure how to set it up, as I that creates an nginx server too.

-- Software Ninja
angular
google-cloud-platform
kubernetes
nginx

1 Answer

11/24/2018

The most Kubernetes-native way handle this is using cert-manager, which can handle creating the LetsEncrypt certs for you. As you noted, some Ingress controllers also have their own integrations with LetsEncrypt which you can use. If using cert-manager, you would create a Certificate object with the required hostnames, which will issue the cert and put it in a Secret for you, which you can then mount into the pod as a volume. Handling this at the Ingress layer is often easier if you're going to be doing a lot of them though, since then you can set up all your backend services without worrying about TLS as much.

-- coderanger
Source: StackOverflow