updated kubernetes configuration

5 years ago · 2b64e87f86
34 changed files with 314 additions and 126 deletions
--- a/etc/k8s/eshoponabp/charts/administration/templates/administration-ingress.yaml
+++ b/etc/k8s/eshoponabp/charts/administration/templates/administration-ingress.yaml
@ -8,7 +8,12 @@ metadata:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
-    cert-manager.io/cluster-issuer: letsencrypt
+  {{- if eq .Release.Name "es-st" }}
+    cert-manager.io/cluster-issuer: eshop-issuer
+  {{- end }}
+  {{- if eq .Release.Name "es-az" }}
+    cert-manager.io/issuer: letsencrypt
+  {{- end }}
 spec:
  tls:
  - hosts:
--- a/etc/k8s/eshoponabp/charts/administration/values.yaml
+++ b/etc/k8s/eshoponabp/charts/administration/values.yaml
@ -25,8 +25,8 @@ synchedCommunication:
  scope: # "IdentityService"

 ingress:
-  host: # eshop-st-administration
-  tlsSecret: eshop-demo-tls
+  host: eshop-st-administration
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/service-administration
--- a/etc/k8s/eshoponabp/charts/authserver/templates/authserver-ingress.yaml
+++ b/etc/k8s/eshoponabp/charts/authserver/templates/authserver-ingress.yaml
@ -8,14 +8,20 @@ metadata:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
-    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_input_headers "from-ingress: true";
+    # cert-manager.io/cluster-issuer: selfsigned-issuer  
+  # {{- if eq .Release.Name "es-st" }}
+  #   cert-manager.io/cluster-issuer: eshop-issuer
+  # {{- end }}
+  # {{- if eq .Release.Name "es-az" }}
+  #   cert-manager.io/issuer: letsencrypt
+  # {{- end }}  
 spec:
  tls:
  - hosts:
-      - {{ .Values.ingress.host }}
-    secretName: {{ .Values.ingress.tlsSecret }}
+      - "eshop-st-authserver"
+    secretName: "eshop-test-tls"
  rules:
  - host: "{{ .Values.ingress.host }}"
    http:
--- a/etc/k8s/eshoponabp/charts/authserver/values.yaml
+++ b/etc/k8s/eshoponabp/charts/authserver/values.yaml
@ -17,13 +17,12 @@ config:
  stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8

 ingress:
-  host: # eshop-st-authserver
-  tlsSecret: eshop-demo-tls
+  host: eshop-st-authserver
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/app-authserver
  tag: latest
  pullPolicy: IfNotPresent

-env: {}
-    
+env: {}
--- a/etc/k8s/eshoponabp/charts/basket/templates/basket-ingress.yaml
+++ b/etc/k8s/eshoponabp/charts/basket/templates/basket-ingress.yaml
@ -8,7 +8,8 @@ metadata:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
-    cert-manager.io/cluster-issuer: letsencrypt
+    cert-manager.io/issuer: eshop-issuer
+    # cert-manager.io/cluster-issuer: letsencrypt
 spec:
  tls:
  - hosts:
--- a/etc/k8s/eshoponabp/charts/basket/values.yaml
+++ b/etc/k8s/eshoponabp/charts/basket/values.yaml
@ -19,7 +19,7 @@ config:

 ingress:
  host: eshop-st-basket
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/service-basket
--- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml
+++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml
@ -18,22 +18,22 @@ spec:
        ports:
        - name: http
          containerPort: 80
-        - name: https
-          containerPort: 443
        - name: grpc
          containerPort: 81
          protocol: TCP
        env:
+        - name: "ASPNETCORE_URLS"
+          value: "http://+:80;http://+:81" 
+        - name: "DOTNET_ENVIRONMENT"
+          value: "{{ .Values.config.dotnetEnv }}"         
        - name: App__SelfUrl
          value: "{{ .Values.config.selfUrl }}"
        - name: App__CorsOrigins
          value: "{{ .Values.config.corsOrigins }}"
        - name: "ConnectionStrings__CatalogService"
-          value: {{ .Values.config.connectionStrings.catalogService }}  
+          value: "{{ .Values.config.connectionStrings.catalogService }}"
        - name: "ConnectionStrings__AdministrationService"
-          value: {{ .Values.config.connectionStrings.administrationService }}
-        - name: "DOTNET_ENVIRONMENT"
-          value: "{{ .Values.config.dotnetEnv }}"
+          value: "{{ .Values.config.connectionStrings.administrationService }}"        
        - name: "Redis__Configuration"
          value: "{{ .Values.config.redisHost }}"
        - name: "RabbitMQ__Connections__Default__HostName"
--- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-ingress.yaml
+++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-ingress.yaml
@ -8,7 +8,7 @@ metadata:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
-    cert-manager.io/cluster-issuer: letsencrypt
+    # cert-manager.io/cluster-issuer: letsencrypt
 spec:
  tls:
  - hosts:
--- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-service.yaml
+++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-service.yaml
@ -6,13 +6,11 @@ metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}
 spec:
  ports:
-    - name: "80"
+    - name: "http"
      port: 80
-    - name: "443"
-      port: 443
-    - port: {{ .Values.config.grpcPort }}
+    - name: grpc
      targetPort: grpc
      protocol: TCP
-      name: grpc
+      port: {{ .Values.config.grpcPort }}
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}
--- a/etc/k8s/eshoponabp/charts/catalog/values.yaml
+++ b/etc/k8s/eshoponabp/charts/catalog/values.yaml
@ -16,20 +16,21 @@ config:
  stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8
  grpcPort: 81
  kestrel:
-    httpUrl: #
+    httpUrl: http://eshop-st-catalog:80
    httpProtocols: Http1AndHttp2
-    grpcUrl: #
+    grpcUrl: http://eshop-st-catalog:81
    grpcProtocols: Http2

-
 ingress:
  host: eshop-st-catalog
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/service-catalog
  tag: latest
  pullPolicy: IfNotPresent

-env: {}
+env: {
+  # ASPNETCORE_URLS=http://+:80;http://+:81
+}
    
--- a/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-deployment.yaml
+++ b/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-deployment.yaml
@ -27,8 +27,6 @@ spec:
        env:
        - name: App__SelfUrl
          value: "{{ .Values.config.selfUrl }}"
-        - name: GlobalConfiguration__BaseUrl
-          value: "{{ .Values.config.globalConfigurationBaseUrl }}"
        - name: "DOTNET_ENVIRONMENT"
          value: "{{ .Values.config.dotnetEnv }}"
        - name: "Redis__Configuration"
@ -44,9 +42,7 @@ spec:
        - name: "AuthServer__SwaggerClientSecret"
          value: "{{ .Values.config.authServer.swaggerClientSecret }}"
        - name: "ElasticSearch__Url"
-          value: "{{ .Values.config.elasticsearchHost }}"          
-        - name: "StringEncryption__DefaultPassPhrase"
-          value: "{{ .Values.config.stringEncryptionDefaultPassPhrase }}"
+          value: "{{ .Values.config.elasticsearchHost }}"
          {{- if .Values.env }}
 {{ toYaml .Values.env | indent 8 }}
          {{- end }}
--- a/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-ingress.yaml
+++ b/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-ingress.yaml
@ -8,7 +8,7 @@ metadata:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
-    cert-manager.io/cluster-issuer: letsencrypt
+    cert-manager.io/cluster-issuer: eshop-issuer
 {{- if eq .Release.Name "es-az" }}
    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
 {{- end }}
--- a/etc/k8s/eshoponabp/charts/gateway-web-public/values.yaml
+++ b/etc/k8s/eshoponabp/charts/gateway-web-public/values.yaml
@ -1,6 +1,5 @@
 config:
  selfUrl: https://eshop-st-gateway-public-web
-  globalConfigurationBaseUrl: http://eshop-st-gateway-public-web
  authServer:
    authority: http://eshop-st-authserver
    requireHttpsMetadata: "false"
@ -9,33 +8,31 @@ config:
  dotnetEnv: Staging 
  redisHost: es-st-redis
  rabbitmqHost: es-st-rabbitmq
-  elasticsearchHost: #
-  stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8
+  elasticsearchHost: es-st-elasticsearch

 reRoutes:
  accountService:
-    url: http://eshop-st-authserver
+    url: https://eshop-st-authserver
  identityService:
-    url: http://eshop-st-identity
+    url: https://eshop-st-identity
  administrationService:
-    url: http://eshop-st-administration
+    url: https://eshop-st-administration
  catalogService:
-    url: http://eshop-st-catalog
+    url: https://eshop-st-catalog
  basketService:
-    url: http://eshop-st-basket
+    url: https://eshop-st-basket
  orderingService:
-    url: http://eshop-st-ordering
+    url: https://eshop-st-ordering
  paymentService:
-    url: http://eshop-st-payment  
+    url: https://eshop-st-payment  

 ingress:
  host: eshop-st-gateway-web-public
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/gateway-web-public
  tag: latest
  pullPolicy: IfNotPresent

-env: {}
-    
+env: {}
--- a/etc/k8s/eshoponabp/charts/gateway-web/values.yaml
+++ b/etc/k8s/eshoponabp/charts/gateway-web/values.yaml
@ -21,7 +21,7 @@ reRoutes:
    url: http://eshop-st-administration
 ingress:
  host: # eshop-st-gateway-web
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/gateway-web
--- a/etc/k8s/eshoponabp/charts/identity/templates/identity-ingress.yaml
+++ b/etc/k8s/eshoponabp/charts/identity/templates/identity-ingress.yaml
@ -8,7 +8,7 @@ metadata:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
-    cert-manager.io/cluster-issuer: letsencrypt
+    cert-manager.io/cluster-issuer: selfsigned-issuer
 spec:
  tls:
  - hosts:
--- a/etc/k8s/eshoponabp/charts/identity/values.yaml
+++ b/etc/k8s/eshoponabp/charts/identity/values.yaml
@ -32,7 +32,7 @@ identityServerClients:

 ingress:
  host: eshop-st-identity
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/service-identity
--- a/etc/k8s/eshoponabp/charts/ordering/values.yaml
+++ b/etc/k8s/eshoponabp/charts/ordering/values.yaml
@ -17,7 +17,7 @@ config:

 ingress:
  host: eshop-st-ordering
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/service-ordering
--- a/etc/k8s/eshoponabp/charts/payment/values.yaml
+++ b/etc/k8s/eshoponabp/charts/payment/values.yaml
@ -17,7 +17,7 @@ config:

 ingress:
  host: eshop-st-payment
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/service-payment
--- a/etc/k8s/eshoponabp/charts/public-web/templates/public-web-deployment.yaml
+++ b/etc/k8s/eshoponabp/charts/public-web/templates/public-web-deployment.yaml
@ -22,23 +22,23 @@ spec:
          containerPort: 443
        env:
        - name: App__SelfUrl
-          value: {{ .Values.config.selfUrl}} 
+          value: "{{ .Values.config.selfUrl }}" 
        - name: RemoteServices__Default__BaseUrl
-          value: {{ .Values.config.gatewayUrl}}
+          value: "{{ .Values.config.gatewayUrl }}"
        - name: "AuthServer__Authority"
-          value: {{ .Values.config.authServer.authority }}
+          value: "{{ .Values.config.authServer.authority }}"
        - name: "AuthServer__RequireHttpsMetadata"
          value: "{{ .Values.config.authServer.requireHttpsMetadata }}"
        - name: "DOTNET_ENVIRONMENT"
-          value: {{ .Values.config.dotnetEnv }}
+          value: "{{ .Values.config.dotnetEnv }}"
        - name: "Redis__Configuration"
-          value: {{ .Values.config.redisHost }}       
+          value: "{{ .Values.config.redisHost }}"     
        - name: "StringEncryption__DefaultPassPhrase"
-          value: {{ .Values.config.stringEncryptionDefaultPassPhrase }}
+          value: "{{ .Values.config.stringEncryptionDefaultPassPhrase }}"
        - name: "RabbitMQ__Connections__Default__HostName"
-          value: {{ .Values.config.rabbitmqHost }}
+          value: "{{ .Values.config.rabbitmqHost }}"
        - name: "ElasticSearch__Url"
-          value: {{ .Values.config.elasticsearchHost }}
+          value: "{{ .Values.config.elasticsearchHost }}"
          {{- if .Values.env }}
 {{ toYaml .Values.env | indent 8 }}
          {{- end }}
--- a/etc/k8s/eshoponabp/charts/public-web/values.yaml
+++ b/etc/k8s/eshoponabp/charts/public-web/values.yaml
@ -1,6 +1,6 @@
 config:
  selfUrl: https://eshop-st-public-web
-  gatewayUrl: "http://eshop-st-gateway-web-public/"
+  gatewayUrl: https://eshop-st-gateway-web-public
  authServer:
    authority: http://eshop-st-authserver
    requireHttpsMetadata: "false"
@ -11,8 +11,8 @@ config:
  stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8

 ingress:
-  host: # eshop-st-public-web
-  tlsSecret: eshop-demo-tls
+  host: eshop-st-public-web
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/app-publicweb
--- a/etc/k8s/eshoponabp/charts/web/values.yaml
+++ b/etc/k8s/eshoponabp/charts/web/values.yaml
@ -7,7 +7,7 @@ config:

 ingress:
  host: eshop-st-web
-  tlsSecret: eshop-demo-tls
+  tlsSecret: eshop-staging-tls

 image:
  repository: eshoponabp/app-web
--- a/etc/k8s/eshoponabp/values.yaml
+++ b/etc/k8s/eshoponabp/values.yaml
@ -13,6 +13,7 @@ authserver:
    elasticsearchHost: es-st-elasticsearch
  ingress:
    host: eshop-st-authserver
+    tlsSecret: eshop-staging-tls
  image:
    repository: "eshoponabp/app-authserver"
    tag: latest
@ -32,7 +33,7 @@ web:
 public-web:
  config:
    selfUrl: https://eshop-st-public-web
-    gatewayUrl: "http://eshop-st-gateway-web-public/"
+    gatewayUrl: http://eshop-st-gateway-web-public
    authServer:
      authority: http://eshop-st-authserver
      requireHttpsMetadata: "false"
@ -123,7 +124,6 @@ gateway-web:
    redisHost: es-st-redis
    rabbitmqHost: es-st-rabbitmq
    elasticsearchHost: es-st-elasticsearch
-    stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8
  ingress:
    host: eshop-st-gateway-web
  image:
@ -141,7 +141,6 @@ gateway-web:
 gateway-web-public:
  config:
    selfUrl: https://eshop-st-gateway-web-public
-    globalConfigurationBaseUrl: http://eshop-st-gateway-public-web
    authServer:
      authority: http://eshop-st-authserver
      requireHttpsMetadata: "false"
@ -151,7 +150,6 @@ gateway-web-public:
    redisHost: es-st-redis
    rabbitmqHost: es-st-rabbitmq
    elasticsearchHost: es-st-elasticsearch
-    stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8
  ingress:
    host: eshop-st-gateway-web-public
  image:
--- a/etc/k8s/tls-cert/eshop-demo-tls.conf
+++ b/etc/k8s/tls-cert/eshop-demo-tls.conf
@ -0,0 +1,38 @@
+[req]
+default_bits       = 2048
+default_keyfile    = eshop-st.key
+distinguished_name = req_distinguished_name
+req_extensions     = req_ext
+x509_extensions    = v3_ca
+
+[req_distinguished_name]
+commonName                  = Common Name (e.g. server FQDN or YOUR name)
+commonName_default          = eshoponabp
+commonName_max              = 64
+
+[req_ext]
+subjectAltName = @alt_names
+
+[v3_ca]
+subjectAltName = @alt_names
+basicConstraints = critical, CA:false
+keyUsage = keyCertSign, cRLSign, digitalSignature,keyEncipherment
+
+[alt_names]
+DNS.1   = eshop-st-web
+DNS.2   = eshop-st-public-web
+DNS.3   = eshop-st-authserver
+DNS.4   = eshop-st-identity
+DNS.5   = eshop-st-administration
+DNS.6   = eshop-st-gateway-web
+DNS.7   = eshop-st-gateway-web-public
+DNS.8   = eshop-st-basket
+DNS.9   = eshop-st-catalog
+DNS.10   = eshop-st-ordering
+DNS.11   = eshop-st-payment
+
+# Generate certificate from config
+# Use the command: 
+#   'openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout eshop-st-cert.key -out eshop-st-cert.pem -config eshop-demo-tls.conf'
+# Verify that you have eshop-st-cert.crt and eshop-st-cert.key files under k8s/tls-cert folder
+# Run comand : 'kubectl create secret tls eshop-demo-tls --cert=eshop-st-cert.pem --key=eshop-st-cert.key --namespace=eshop'
--- a/etc/k8s/tls-cert/eshop-st-cert.key
+++ b/etc/k8s/tls-cert/eshop-st-cert.key
@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDSgXYuFacjDRuc
+yj6oqIV1KlBinfbqnH9xEFOQXN6vFI9v5TzOTXstjCVQKhPWDCw3WSw7ydlAodFa
+djeXEjapDGQmAVJk5nmPLv+UCOrZHd6ut8QEMb1cAGtOR71d8CVjWuZx6igGTPTQ
+m2efRip0B0mog4j5vc+q8tr0qu+h13TAkivYGPQTvT46p/GypH5xFjAVw9P6IIYP
+fr+nm2R/fUV3FEmaUBJmNjjoDJzrtGxe8zWD7vRxIYoNeffzRTMCT622Y8j6TEp2
+rlVPjh9Dp7+Wrj6FxopKBt6j3F5S1NKkEgEID8cL1Aufu0Xk/dWPsSAstVPgA/gf
+GIW+7ALHAgMBAAECggEBAL2lmvYL1ecTMRRBdM/3+zxCYedmzwQw9/PBtLczo/9x
+84Por65hSZ8QSrF9Jx/JGbDHqr02rX64CmeIZ6633vzPyA4hVLzIky13NxSEMCho
+66zWrEbnFOUlD4eXxDg0WUq4ozJvtZ1viYPC7kklKqwbwLWLw0TUR5qIbtDMi1Vu
+pyfm2YUtjqx2JPjD2i5juZx3XbgiqncpyRDroY80IqOZ/Kp83eMdst9wyfJaAy0B
+kxZjvU1U2exD/l9RxKKreES2Vrbn+PvF3ttTgz/hE1ScBBfMB9kn+37esGZVByjb
+ER0GFgt0jOx2ok+n2+zm2Z68IjoYDvsNo586tHoXxrECgYEA75UD5Nt9joCpCWVd
+zXBQ8OUJwRU/N74RjBBS/NTT2sZ+q7xYxDx3xPwhyHXI+wwaHClGUE0yx5mrqqON
+p3ELpanYdLWcdA6f/bFuuSNOAi7XSc1wCbNkTh5yxIyqWMvEYXqAj1/5T1VJ6+xU
+pyKUe1588WKpSURrtGRxu0rKizkCgYEA4O5cJQmBeTlx++iVtONZv7HB371rYt45
+0nkBKfBJOjsVd2sB5f6ry5PaRcJyXamF7QYGgm4xo+KvrfHrf+JjebiJR46tsK0n
+y130XjZVi28HPGBUG610zXOH3FgUQiSVbRulG0wzTtFHzdbVHJuTmA65+BZnayhM
+WICqyiw0/f8CgYEAuXLmbbr8iFbNAYnmPwSGksEneL7ijVphqMJmCnEPgBQPrw1+
+xH9t0hu8ZrfNl435k/zbAYOQH/Kyb8Zj+s1FT7mV5FlDvo4nh69VXpeWZZgua2FL
+LScgKFvnSH79yPgJjc7OPqzyhVcmfikUKb9Zodk064AMO7trh1oMswYkm/kCgYA/
+w/MFYOt+hUWGB4qhTC5+RJNUrWtLDPrRaxJkZEUuJ9/PCdvw6sCjJtgjHJu1Z8Ca
+0DF6OmkCL9pj8ogzqedPc3wfeBhPVNdKNOl45+habfBcMmbFrefF8rGaSrH7ikl+
+M+8bjP+ioXu8o+GoiYZO/iXEaf2JiFQUZu2EAQJI2wKBgQCLUuZyV/fx2/90md4W
+6GwyMYrA3Z3pVm3WKdphSX8euTTNjOjtwXwZ0iqfGsm0okHC0+DcI9PAhPh99fCB
+7miZcUvQmqhmL7rcrOTfPRLVZ9flEVqeq6RCW4ICA2G7+0+eFz87FIl9EHfN9IMU
+2mLb5Ph0OuI7W75OBR23qqVk5g==
+-----END PRIVATE KEY-----
--- a/etc/k8s/tls-cert/eshop-st-cert.pem
+++ b/etc/k8s/tls-cert/eshop-st-cert.pem
@ -1,31 +1,23 @@
 -----BEGIN CERTIFICATE-----
-MIIFQzCCA6ugAwIBAgIRANj5oNi+QQIoyV51y/ZIJlYwDQYJKoZIhvcNAQELBQAw
-gZ8xHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTE6MDgGA1UECwwxZ3Nl
-bmd1bkBHb2toYW5zLU1hY0Jvb2stUHJvLmxvY2FsIChHb2toYW4gU2VuZ3VuKTFB
-MD8GA1UEAww4bWtjZXJ0IGdzZW5ndW5AR29raGFucy1NYWNCb29rLVByby5sb2Nh
-bCAoR29raGFuIFNlbmd1bikwHhcNMTkwNjAxMDAwMDAwWhcNMzExMTA0MDgyNjUw
-WjBlMScwJQYDVQQKEx5ta2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxOjA4
-BgNVBAsMMWdzZW5ndW5AR29raGFucy1NYWNCb29rLVByby5sb2NhbCAoR29raGFu
-IFNlbmd1bikwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKu7X3b2Cg
-dpBnz90KboUnpWRcCK96oq97pAEbR9sirN3+3jT0JRBY2TYKLDPW8i50QJFbdYE7
-zky58c+RWPrxVDoeqRC8E1+TLsuW+TdMmOL746k36X1VtKy3rqUG9IS6MXjH/MX8
-H1kgldHvE9mFEpyp3q/8cUPHSBUE+M0CA05wlDm8qgkGXcp43qrNElWg5Y2WWWIp
-WUm8r5obktSAxhA+ZxFX4cJHFmxKymMqSRStDpTFCIW9C3kx5ierPNQS6g5sSMtW
-OuPuh0Uhc0Q0lJBoA7Mj1CGvtO5nld0+6kAK1GMB7Vbigoqd00eqKMYaA3Aa5QZm
-bf84wZjofJx1AgMBAAGjggExMIIBLTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww
-CgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBR6TnYaWT+NPghb
-dQnZ+MAbx9UB2DCB1gYDVR0RBIHOMIHLgghlc2hvcC1zdIIXZXNob3Atc3QtYWRt
-aW5pc3RyYXRpb26CE2VzaG9wLXN0LWF1dGhzZXJ2ZXKCGWVzaG9wLXN0LWdhdGV3
-YXktaW50ZXJuYWyCG2VzaG9wLXN0LWdhdGV3YXktcHVibGljLXdlYoIUZXNob3At
-c3QtZ2F0ZXdheS13ZWKCEWVzaG9wLXN0LWlkZW50aXR5ghNlc2hvcC1zdC1wdWJs
-aWMtd2Vigg1lc2hvcC1zdC1zYWFzggxlc2hvcC1zdC13ZWIwDQYJKoZIhvcNAQEL
-BQADggGBADjQroM3gD7g56S8bxlUbt1sJYfvo0VCIDPH9aHE3WwhGCOn18SRDOpM
-mNw4c0HO+P1+rlCfn2pvN2oQ6v731fQZPpGcE0ljeVrixqfyVvoggGMbOwegvWPh
-dPK/cxLi9wYfQtFw5vy8YxsinowSRCQ3KJGxI4fsyjEQu939WvYSPDdEUPx952LR
-2pG8yRSso7dixDW4rDCoI/QKM/ImnqsNtZSpGa93HLgjkJr/PsOVMogt8dOsDOkC
-vHq9F6TJKTDb7WizMJcE0qfisJgtTC2isvYA3u7kiyfxW26kd1h7s4m3njn+0Sks
-0xGcXiYPZm8y/lVrxcF3/QlgOfWfRmls3D17yX28QwuwvNkUv2aSP/WGOMWEtgPD
-9WYPk1OhOGFxT3IKu8iw6ITTCKXpcBeQ/QiEuFjo/khDGE4NMSkrp16nVebkAWal
-/eufFWZJTzO7kgCmApS2SAhRdsM+JEsioHF/gM2chzV+eP4CCKv3pw5z07eemhx2
-HnEbhDFHEA==
+MIIDxjCCAq6gAwIBAgIUavYi4mtz8TCt6EwG/MDNsnykGPMwDQYJKoZIhvcNAQEL
+BQAwFTETMBEGA1UEAwwKZXNob3BvbmFicDAeFw0yMjA0MDgxOTAwMDFaFw0yMzA0
+MDgxOTAwMDFaMBUxEzARBgNVBAMMCmVzaG9wb25hYnAwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDSgXYuFacjDRucyj6oqIV1KlBinfbqnH9xEFOQXN6v
+FI9v5TzOTXstjCVQKhPWDCw3WSw7ydlAodFadjeXEjapDGQmAVJk5nmPLv+UCOrZ
+Hd6ut8QEMb1cAGtOR71d8CVjWuZx6igGTPTQm2efRip0B0mog4j5vc+q8tr0qu+h
+13TAkivYGPQTvT46p/GypH5xFjAVw9P6IIYPfr+nm2R/fUV3FEmaUBJmNjjoDJzr
+tGxe8zWD7vRxIYoNeffzRTMCT622Y8j6TEp2rlVPjh9Dp7+Wrj6FxopKBt6j3F5S
+1NKkEgEID8cL1Aufu0Xk/dWPsSAstVPgA/gfGIW+7ALHAgMBAAGjggEMMIIBCDCB
+6gYDVR0RBIHiMIHfggxlc2hvcC1zdC13ZWKCE2VzaG9wLXN0LXB1YmxpYy13ZWKC
+E2VzaG9wLXN0LWF1dGhzZXJ2ZXKCEWVzaG9wLXN0LWlkZW50aXR5ghdlc2hvcC1z
+dC1hZG1pbmlzdHJhdGlvboIUZXNob3Atc3QtZ2F0ZXdheS13ZWKCG2VzaG9wLXN0
+LWdhdGV3YXktd2ViLXB1YmxpY4IPZXNob3Atc3QtYmFza2V0ghBlc2hvcC1zdC1j
+YXRhbG9nghFlc2hvcC1zdC1vcmRlcmluZ4IQZXNob3Atc3QtcGF5bWVudDAMBgNV
+HRMBAf8EAjAAMAsGA1UdDwQEAwIBpjANBgkqhkiG9w0BAQsFAAOCAQEAhJK7TgZw
+IVqVbyYHw3M3fH5/tvioZNq0PbYOeWBX/A4ZolE1o5n5wzwk1TcOk7Kg8KdvZPM8
+VZgfx4B/MYaHWmliPx036oB4MJ9zh1D+zPr2kNqUKzY07H1JJDS9BzuBiSnnv7dJ
+nuiJnV5F2Uy2cWltCgZ4xZ7xwnlofxIV4EnB88r+Gqz+LNtm1BFF4p5CzSQHcTrc
+04H7k7gvITRYq086yuButbYT43uBBVJDEmTWUKMYWgh5K1cbyOUkYmaMCYaUnpNq
+tgoZCNrUq3dpv/KsDsxh1bf2W0LsNiu2zExjetqDjoDC4cnCXYOsF7dW0HcnqFCN
+PcxxXhW+kcd6+A==
 -----END CERTIFICATE-----
--- a/etc/k8s/tls-cert/eshop-st-key.pem
+++ b/etc/k8s/tls-cert/eshop-st-key.pem
@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDKu7X3b2CgdpBn
-z90KboUnpWRcCK96oq97pAEbR9sirN3+3jT0JRBY2TYKLDPW8i50QJFbdYE7zky5
-8c+RWPrxVDoeqRC8E1+TLsuW+TdMmOL746k36X1VtKy3rqUG9IS6MXjH/MX8H1kg
-ldHvE9mFEpyp3q/8cUPHSBUE+M0CA05wlDm8qgkGXcp43qrNElWg5Y2WWWIpWUm8
-r5obktSAxhA+ZxFX4cJHFmxKymMqSRStDpTFCIW9C3kx5ierPNQS6g5sSMtWOuPu
-h0Uhc0Q0lJBoA7Mj1CGvtO5nld0+6kAK1GMB7Vbigoqd00eqKMYaA3Aa5QZmbf84
-wZjofJx1AgMBAAECggEBALvJLd9ZInbf/Bi8uLFt+BbmI1UAkpKU2Nk86+16HKg8
-2ZC4APLY1hCGeoDnusjyIUd7e2jtKdzc1cMzEiI++orJiuBVl/OuOkxZ/ykEBU4F
-G9NYaKkqtPbLWWT291O+8KaLJqaQJE/KNcNyIzhB+a1CtSy/4eGChNa1lQq67yJZ
-iTFPNSHT1RTzjv2BAuUASq1gK+bX4F65otVYQBMg3JGsfkAdhWPbzEX0XLVpgbh/
-jtyAHSsiWIkyVjXvA3Zjp+3Gmf3dbd/86Uwd4XowPfcSOP4iyd76FS4iTlthsF5D
-M0psBOgotVl5RHv2ljOy7fUzrudnSQ0HepgdHed4Em0CgYEA7q+j7cbcb43ZW5Rx
-p2pMuuuEeFY+L2Ns8N4t26OoURQCzyACR5H4KgFtrrdqTwQPs7L8SWAjU8SoP2jX
-j+4+TJnK/Grt0YQ2pLpEM8j7kjGWfskHDfQhrL3o4VhdCm/1URWYSn7nzdNnX1Fk
-ZlKjUJWBXGTvthCUVY9Jk30hU4sCgYEA2XBupvyIpmjoNdsEdwxxSebLyIYu2FA/
-sjI5gdzXIOo9DsFfn9HTNbXyEsiQm9StNXS585jRhyht9OF7SYajrJ/E3O086tf4
-2MmDbUdFdvMdPdGxxTU2mXa9Vd6JASnFG+fSsRhABk57iNzcUE4+PNW1ztLmRyLx
-diW9cXjXz/8CgYBxGF43U0utu+uqvgqgRfj3dJL/JfYvJBBBjTTzZndhe3bdR5Bs
-8xhAZw7eg1/m8six3/Q0nE4A6iTCbt38/+kbCKAqvEvVQ61UnkGku+2f1sk1Z/Fk
-xjGSlSWcaO8k++mkMvRHEByr5SiM/Jby+OMTUtPJwLXocbCnXc6CCP9agwKBgEe7
-I4XLAXmEWjaKDisH28e5b7izK3kI4Dp0/yusIvwkyge4G0ep/LdXUoiHyczemFVu
-MHoAC/8+gyepyvYyiIRGILeRO+ttXBaIQ+ck//GBuj/OkYqxR1XRKhzN0PylPvU5
-wPPTQCvUcERyN+v2I+oFxnh4cqc9C9MiGCD68JcZAoGBAIi1RxcWKZUCjSETT1PY
-V7j5FIyMzBdUo0RN44eUdeu0CWAOnMG2s26z6fXl7EZp+Em5ee7dYEmSP49X69n9
-T9ueN1LRJaqko45Eo3uPl6rolz5vXcTr2Tooc3yqE3XbRxe2jOeczq06nj06kjuf
-hPPdSqjjOwWPy63DWboSkh+0
-----END PRIVATE KEY-----
--- a/etc/k8s/tls-cert/eshop-test-tls.crt
+++ b/etc/k8s/tls-cert/eshop-test-tls.crt
@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDxjCCAq6gAwIBAgIUWAAiaf6jGeQBXdYnOFUKw+cQIlMwDQYJKoZIhvcNAQEL
+BQAwFTETMBEGA1UEAwwKZXNob3BvbmFicDAeFw0yMjA0MDgyMjM4NDVaFw0yMzA0
+MDgyMjM4NDVaMBUxEzARBgNVBAMMCmVzaG9wb25hYnAwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDaQiJirGIVlbr00M8e1qTWLeIgsMUhLGa8fa/cEMJ7
+uInNm6hkCv1UrxGDKcxBBXs/kt+VYfnjtp+2IBlgv6wbHWftQYEwXxbtvXNIBWIn
+GEee9S2uREDm0OHJF/xLEHPvFE15mFeo3bfJ3GIkuXuKu3RzQBre4q2y+1RfHnav
+YKF/QIg3oWysnmt5G2wBS7bZvHkjvX7N31g80JU3yYuPkiCJi+PHiQbeyn4Obaf+
+TksoOqrwIO6bYE+cR5v2eLn0nLg/ZYvKSAbmmEiNIja3DRidxM9fYWPQgqVsAGs5
+CqdqH3PX9JNSl2FOQQqPSQ9IUwa5lJogNiSWZVacijh1AgMBAAGjggEMMIIBCDCB
+6gYDVR0RBIHiMIHfggxlc2hvcC1zdC13ZWKCE2VzaG9wLXN0LXB1YmxpYy13ZWKC
+E2VzaG9wLXN0LWF1dGhzZXJ2ZXKCEWVzaG9wLXN0LWlkZW50aXR5ghdlc2hvcC1z
+dC1hZG1pbmlzdHJhdGlvboIUZXNob3Atc3QtZ2F0ZXdheS13ZWKCG2VzaG9wLXN0
+LWdhdGV3YXktd2ViLXB1YmxpY4IPZXNob3Atc3QtYmFza2V0ghBlc2hvcC1zdC1j
+YXRhbG9nghFlc2hvcC1zdC1vcmRlcmluZ4IQZXNob3Atc3QtcGF5bWVudDAMBgNV
+HRMBAf8EAjAAMAsGA1UdDwQEAwIBpjANBgkqhkiG9w0BAQsFAAOCAQEA0lsXpx1C
+ItDk2gwKnUiof90y9iYBIZZ+RyxZlJHXYOTrfzOtg1U5zxZtaTBefPJhjI/hibyu
+a2zCUFpc0CBLG8EVzLOv8VJDxiRf93bLP9Eoy40l8MVS8Lt5HVRs8xUiuGvxspwH
+7aXAeP0HlykDjt3njwawPRuijFrk2GzQSCkPVh84e7RKTq4TYb1MpRjZw2Q92/NM
+v0Zboi7wY0RqakyUHdWpgnWP/5ch8f8mInXkOJiQo0h5fbtrB8UdBGC7Qu1uKgsb
+UloHs0w5p0q1AqmtYTJo2FmMP/touls/XhpJ5V0B3X2qh5JISqZiKifkPoJaIKCt
+6ivVqCafin3yEQ==
+-----END CERTIFICATE-----
--- a/etc/k8s/tls-cert/eshop-test-tls.key
+++ b/etc/k8s/tls-cert/eshop-test-tls.key
@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDaQiJirGIVlbr0
+0M8e1qTWLeIgsMUhLGa8fa/cEMJ7uInNm6hkCv1UrxGDKcxBBXs/kt+VYfnjtp+2
+IBlgv6wbHWftQYEwXxbtvXNIBWInGEee9S2uREDm0OHJF/xLEHPvFE15mFeo3bfJ
+3GIkuXuKu3RzQBre4q2y+1RfHnavYKF/QIg3oWysnmt5G2wBS7bZvHkjvX7N31g8
+0JU3yYuPkiCJi+PHiQbeyn4Obaf+TksoOqrwIO6bYE+cR5v2eLn0nLg/ZYvKSAbm
+mEiNIja3DRidxM9fYWPQgqVsAGs5CqdqH3PX9JNSl2FOQQqPSQ9IUwa5lJogNiSW
+ZVacijh1AgMBAAECggEAA3CxbA69iQuQI9W6vgiyFnIos001/jzd7bCpefWFqz+Q
+ZH5EnDcUISaVRxT8lDXK6IifH5Koxq8VO2CsJbs/sjm3bqTurV2CVgL7czIqhuU6
+E8ZXjvyibUDzniDTqDc9LJKMWhNNpmrAP91KarvFt70Wq85h3guCo2SUwt8PDdqX
+nHw0QzBXfkvg9/b90XCXrR/LnIyQ271wONJ1t1updDeo/EZzj/77yFWrvO7zw734
+FqDpfY+VeD9YNQszU40J/CMZa2qKqBXNp68JL2xOSFeHqNKvwKWvP145uGjURblz
+Z12NdoKE3WbzMyv9zO1IdocaL1bFtM+7t3B9KFIbQQKBgQDz9ip8+AOTHp3RywUa
+PvVGSk3U8+PBX3tTXgmoeRbMJ+xffE8uHMDu710izEvbkxQhAgar5dJH8NiragvW
+LVZXCnstJfGI1V3oXnB2Y4BEB1ZTVSV8fuYutm6UhudWebTMg9EndvixK088pjya
+GX0nx4MXOWgBo7vgLNXDNQa40QKBgQDlB0XvpJQEBZurz04iEgjXuXHttGQr4kw8
+0DwC2KA1JnEqZFy4CNGQyyIAKG9xDGCeejbwzBXkamPXpZ4Q7/Opv3wbsxzCnZE3
+MX6XUKqx2CfG7lRWwmLybLvRynHhT6LlWouNil/pHKvdv8LF+pu68S7sK24CaMpu
+QF8aREHuZQKBgQDBnWBjBcJwhB/kXCeUiNrICjhzBYx/73NE2qD3oAJDzHt/3HxK
+sG8+MaHM+C5L+RJEkAMTcbXNeou6ntL+C8U2Fw9i6XYjjpKU1D6U9qrZUqlkQXMa
+tuufrxFbtyTqMHUYypS3qWf9081y6Mu30PrPEzwqtlig1H1KkMqlvfOzwQKBgFLS
+soPbLHvX21fifAruIqyAr6aama8VAyTq2QjedfFCmaIO8UjMR5zpGL6d4M8s/rPQ
+1pV1+GTF5J1TkznkzGUSjjsmJrxqZt1i1Li7vz7ZQGk8PtuxKD8q+zD+2Pf16J6w
+g88Hv295ot1qP3GBE1gjaCiX/Ax7ANmmBb5l+MHRAoGAY6MXc6EUdgcLq0p/FbNk
+OloFD/iUGNsJfSMxMg3vpWP9PhTSToiVDJrsviFWl2+z4CNicptsqfji237Uu4TP
+d8Br0flNjfgyZ6BeRl1Ovgls6hDVgvjl6VWghZw9TfA0pc1ozb5FnUQkTG3+ceBY
+KlHxDmv2VwadB8QbmuHqKjc=
+-----END PRIVATE KEY-----
--- a/etc/k8s/tls-cert/ingress-tls.yaml
+++ b/etc/k8s/tls-cert/ingress-tls.yaml
@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kuard
+  annotations:
+    kubernetes.io/ingress.class: "nginx"    
+    cert-manager.io/issuer: "letsencrypt-staging"
+
+spec:
+  tls:
+  - hosts:
+    - example.example.com
+    secretName: quickstart-example-tls
+  rules:
+  - host: example.example.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: kuard
+            port:
+              number: 80
--- a/etc/k8s/tls-cert/notes.md
+++ b/etc/k8s/tls-cert/notes.md
@ -7,3 +7,43 @@ kubectl create secret tls eshop-demo-tls \
  --cert=eshop-st-cert.pem \
  --key=eshop-st-key.pem
 ```
+
+# Install cert-manager
+
+`kubectl create namespace eshop`
+
+Next, use the **`kubectl apply`** command and the **`yaml`** file available online to install the add-on:
+
+```powershell
+kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.7.0/cert-manager.yaml
+```
+
+Now deploy the issuer:
+
+```powershell
+kubectl apply -f .\selfsigned\issuer.yaml
+```
+
+Now deploy the certificate:
+
+```powershell
+kubectl apply -f .\selfsigned\certificate.yaml
+```
+
+Check the certificate:
+
+```powershell
+kubectl describe certificate -n=eshop
+```
+
+Check the secrets:
+
+```powershell
+kubectl get secrets -n=eshop
+```
+
+You should be seeing `eshop-staging-tls`
+
+To view information about the Secret, use the **`get secret`** command:
+
+`kubectl get secret eshop-staging-tls -n cert-manager`
--- a/etc/k8s/tls-cert/selfsigned/certificate.yaml
+++ b/etc/k8s/tls-cert/selfsigned/certificate.yaml
@ -0,0 +1,21 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: selfsigned-cert
+  namespace: eshop
+spec:
+  dnsNames:
+    - "*.eshop-st-web"
+    - "*.eshop-st-public-web"
+    - "*.eshop-st-authserver"
+    - "*.eshop-st-identity"
+    - "*.eshop-st-administration"
+    - "*.eshop-st-basket"
+    - "*.eshop-st-catalog"
+    - "*.eshop-st-ordering"
+    - "*.eshop-st-payment"
+    - "*.eshop-st-gateway-web"
+    - "*.eshop-st-gateway-web-public"
+  secretName: eshop-single-tls
+  issuerRef:
+    name: eshop-issuer
--- a/etc/k8s/tls-cert/selfsigned/cluster-issuer.yaml
+++ b/etc/k8s/tls-cert/selfsigned/cluster-issuer.yaml
@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:  
+  name: selfsigned-issuer
+spec:  
+  selfSigned: {}
--- a/etc/k8s/tls-cert/selfsigned/issuer.yaml
+++ b/etc/k8s/tls-cert/selfsigned/issuer.yaml
@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: eshop-issuer
+  # namespace: eshop
+spec:
+  selfSigned: {}
--- a/etc/k8s/tls-cert/selfsigned/readme.md
+++ b/etc/k8s/tls-cert/selfsigned/readme.md
@ -0,0 +1,8 @@
+`helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.4.0 --set installCRDs=true`
+`kubectl create ns eshop`
+`kubectl apply -f .\selfsigned\issuer.yaml`
+
+
+```powershell
+kubectl create secret tls eshop-demo-tls --cert=eshop-st-cert.pem --key=eshop-st-cert.key -n ingress-nginx
+```