Implement Let's Encrypt Certificates for Secure Ingress

[runatyr1]

Implement Let's Encrypt Certificates for Secure Ingress

Objective

Replace self-signed certificates with automated Let's Encrypt certificate management for secure external access to services.

Requirements

• Cert-manager installation
• Let's Encrypt staging and production environments
• DNS configuration for domain validation
• Automatic certificate renewal

Specifications

• Use cert-manager v1.14.x
• Configure with HTTP01 challenge
• Set up both staging and production ClusterIssuers
• 90-day certificate validity with automatic renewal

Acceptance Criteria

• 1. Cert-manager successfully installed and running
• 2. ClusterIssuer configured and ready for Let's Encrypt
• 3. Test certificate successfully issued from staging environment
• 4. Production certificate successfully issued and active
• 5. Ingress updated and serving traffic with new certificate
• 6. Certificate auto-renewal verified

Notes

• Initial testing should use Let's Encrypt staging environment
• Domain must be accessible from internet for HTTP01 challenge
• Consider rate limits for production environment

[runatyr1]

• cert manager installed
• the domain validation is failing:

cert-manager cert-manager-cc9b45b7f-gccj2 cert-manager-controller E0113 00:46:20.649798 1 sync.go:208] "propagation check failed" err="failed to perform self check GET request 'http://pietro.top/.well-known/acme-challenge/MCoKRRnWyj8QwIhKc_wxXMCpjBQ9WqORfFLCoKhiZs8': Get "http://pietro.top/.well-known/acme-challenge/MCoKRRnWyj8QwIhKc_wxXMCpjBQ9WqORfFLCoKhiZs8\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)" logger="cert-manager.controller" resource_name="example-tls-1-2718851300-1058058059" resource_namespace="default" resource_kind="Challenge" resource_version="v1" dnsName="pietro.top" type="HTTP-01"
cert-man

• domain resolves

• the cause could be:
  -- ufw firewall rules
  -- ingress redirection annotations

• did not fix: disabling the redirection annotations

• test ufw allow rules added

[runatyr1]

Found the root cause: Currently the ingress controller is only available via NodePort: 30080, to make it available on port 80 as the

k describe challenges.acme.cert-manager.io example-tls-1-2718851300-1058058059

dial tcp :80: connect: connection refused

and tested using curl http://pietro.top:30080/.well-known/acme-challenge/MCoKRRnWy

Solution: add a load balancer, in this case i'll add a virtual one using klipper: #35