I am installing jenkins on GKE.
I want to use ingress (so to avoid the LoadBalancer) but I also want it to have TLS enabled.
Here are the ingress - related values:
ingress:
enabled: false
# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'
apiVersion: "extensions/v1beta1"
labels: {}
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# Set this path to jenkinsUriPrefix above or use annotations to rewrite path
# path: "/jenkins"
# configures the hostname e.g. jenkins.example.com
hostName:
tls:
# - secretName: jenkins.cluster.local
# hosts:
# - jenkins.cluster.localAssuming I already have a CloudDNS (routable to my-network.mydomain.net) and I want jenkins accessible via jenkins.my-network.mydomain.net, how should I configure the above values?
What is the usefulness of the values.ingress.tls.secretName?
In case I enable tls, what will be the issuing authority of the corresponding certificate? Is this handled automatically by GCP?
The ingress that you will setup will need one loadBalancer. This load balancer will be receiving traffic from client and forward it to the ingress controller(gke ingress, nginx etc). So you are really not avoiding loadbalancer completely in this case.
The ingress is used to avoid creation of load balancers exponentially if you are using kubernetes service of type LoadBalancer to serve external clients.In your case the jenkins master service instead of exposing via load balancer directly you can choose an ingress to avoid more than one load balancer creation.
What is the usefulness of the values.ingress.tls.secretName?
It tells the Ingress controller to secure the channel from the client to the load balancer using TLS. You need to make sure the TLS secret you created came from a certificate that contains a Common Name (CN), also known as a Fully Qualified Domain Name (FQDN) for jenkins.cluster.local.
You also need to create a secret with name jenkins.cluster.local
apiVersion: v1
kind: Secret
metadata:
name: jenkins.cluster.local
namespace: default
data:
tls.crt: base64 encoded cert
tls.key: base64 encoded key
type: kubernetes.io/tls
In case I enable tls, what will be the issuing authority of the corresponding certificate? Is this handled automatically by GCP?
It's not automatically handled by GCP. Check Options for providing SSL certificates section from the official docs Out of all 3 options I believe you need to follow Self-managed certificates as Secret resources and provision your own SSL certificate and create a Secret to hold it. You can then refer to the Secret in an Ingress specification to create an HTTP(S) load balancer that uses the certificate. Refer to the instructions for using certificates in Secrets for more information.