From 2b64e87f86c89a99fff239053dd9c9ef96379df6 Mon Sep 17 00:00:00 2001 From: Galip Tolga Erdem Date: Sat, 9 Apr 2022 21:51:07 +0300 Subject: [PATCH] updated kubernetes configuration --- .../templates/administration-ingress.yaml | 7 ++- .../charts/administration/values.yaml | 4 +- .../templates/authserver-ingress.yaml | 12 +++-- .../eshoponabp/charts/authserver/values.yaml | 7 ++- .../basket/templates/basket-ingress.yaml | 3 +- etc/k8s/eshoponabp/charts/basket/values.yaml | 2 +- .../catalog/templates/catalog-deployment.yaml | 12 ++--- .../catalog/templates/catalog-ingress.yaml | 2 +- .../catalog/templates/catalog-service.yaml | 8 ++- etc/k8s/eshoponabp/charts/catalog/values.yaml | 11 ++-- .../gateway-web-public-deployment.yaml | 6 +-- .../templates/gateway-web-public-ingress.yaml | 2 +- .../charts/gateway-web-public/values.yaml | 23 ++++----- .../eshoponabp/charts/gateway-web/values.yaml | 2 +- .../identity/templates/identity-ingress.yaml | 2 +- .../eshoponabp/charts/identity/values.yaml | 2 +- .../eshoponabp/charts/ordering/values.yaml | 2 +- etc/k8s/eshoponabp/charts/payment/values.yaml | 2 +- .../templates/public-web-deployment.yaml | 16 +++--- .../eshoponabp/charts/public-web/values.yaml | 6 +-- etc/k8s/eshoponabp/charts/web/values.yaml | 2 +- etc/k8s/eshoponabp/values.yaml | 6 +-- etc/k8s/tls-cert/eshop-demo-tls.conf | 38 ++++++++++++++ etc/k8s/tls-cert/eshop-st-cert.key | 28 +++++++++++ etc/k8s/tls-cert/eshop-st-cert.pem | 50 ++++++++----------- etc/k8s/tls-cert/eshop-st-key.pem | 28 ----------- etc/k8s/tls-cert/eshop-test-tls.crt | 23 +++++++++ etc/k8s/tls-cert/eshop-test-tls.key | 28 +++++++++++ etc/k8s/tls-cert/ingress-tls.yaml | 24 +++++++++ etc/k8s/tls-cert/notes.md | 40 +++++++++++++++ etc/k8s/tls-cert/selfsigned/certificate.yaml | 21 ++++++++ .../tls-cert/selfsigned/cluster-issuer.yaml | 6 +++ etc/k8s/tls-cert/selfsigned/issuer.yaml | 7 +++ etc/k8s/tls-cert/selfsigned/readme.md | 8 +++ 34 files changed, 314 insertions(+), 126 deletions(-) create mode 100644 etc/k8s/tls-cert/eshop-demo-tls.conf create mode 100644 etc/k8s/tls-cert/eshop-st-cert.key delete mode 100644 etc/k8s/tls-cert/eshop-st-key.pem create mode 100644 etc/k8s/tls-cert/eshop-test-tls.crt create mode 100644 etc/k8s/tls-cert/eshop-test-tls.key create mode 100644 etc/k8s/tls-cert/ingress-tls.yaml create mode 100644 etc/k8s/tls-cert/selfsigned/certificate.yaml create mode 100644 etc/k8s/tls-cert/selfsigned/cluster-issuer.yaml create mode 100644 etc/k8s/tls-cert/selfsigned/issuer.yaml create mode 100644 etc/k8s/tls-cert/selfsigned/readme.md diff --git a/etc/k8s/eshoponabp/charts/administration/templates/administration-ingress.yaml b/etc/k8s/eshoponabp/charts/administration/templates/administration-ingress.yaml index e843265f..fad0cb65 100644 --- a/etc/k8s/eshoponabp/charts/administration/templates/administration-ingress.yaml +++ b/etc/k8s/eshoponabp/charts/administration/templates/administration-ingress.yaml @@ -8,7 +8,12 @@ metadata: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: 32k nginx.ingress.kubernetes.io/proxy-buffers-number: "8" - cert-manager.io/cluster-issuer: letsencrypt + {{- if eq .Release.Name "es-st" }} + cert-manager.io/cluster-issuer: eshop-issuer + {{- end }} + {{- if eq .Release.Name "es-az" }} + cert-manager.io/issuer: letsencrypt + {{- end }} spec: tls: - hosts: diff --git a/etc/k8s/eshoponabp/charts/administration/values.yaml b/etc/k8s/eshoponabp/charts/administration/values.yaml index 5b0f6c97..3a6e31d8 100644 --- a/etc/k8s/eshoponabp/charts/administration/values.yaml +++ b/etc/k8s/eshoponabp/charts/administration/values.yaml @@ -25,8 +25,8 @@ synchedCommunication: scope: # "IdentityService" ingress: - host: # eshop-st-administration - tlsSecret: eshop-demo-tls + host: eshop-st-administration + tlsSecret: eshop-staging-tls image: repository: eshoponabp/service-administration diff --git a/etc/k8s/eshoponabp/charts/authserver/templates/authserver-ingress.yaml b/etc/k8s/eshoponabp/charts/authserver/templates/authserver-ingress.yaml index b74c1044..a24245ba 100644 --- a/etc/k8s/eshoponabp/charts/authserver/templates/authserver-ingress.yaml +++ b/etc/k8s/eshoponabp/charts/authserver/templates/authserver-ingress.yaml @@ -8,14 +8,20 @@ metadata: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: 32k nginx.ingress.kubernetes.io/proxy-buffers-number: "8" - cert-manager.io/cluster-issuer: letsencrypt nginx.ingress.kubernetes.io/configuration-snippet: | more_set_input_headers "from-ingress: true"; + # cert-manager.io/cluster-issuer: selfsigned-issuer + # {{- if eq .Release.Name "es-st" }} + # cert-manager.io/cluster-issuer: eshop-issuer + # {{- end }} + # {{- if eq .Release.Name "es-az" }} + # cert-manager.io/issuer: letsencrypt + # {{- end }} spec: tls: - hosts: - - {{ .Values.ingress.host }} - secretName: {{ .Values.ingress.tlsSecret }} + - "eshop-st-authserver" + secretName: "eshop-test-tls" rules: - host: "{{ .Values.ingress.host }}" http: diff --git a/etc/k8s/eshoponabp/charts/authserver/values.yaml b/etc/k8s/eshoponabp/charts/authserver/values.yaml index 95f80979..a1b3edb6 100644 --- a/etc/k8s/eshoponabp/charts/authserver/values.yaml +++ b/etc/k8s/eshoponabp/charts/authserver/values.yaml @@ -17,13 +17,12 @@ config: stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 ingress: - host: # eshop-st-authserver - tlsSecret: eshop-demo-tls + host: eshop-st-authserver + tlsSecret: eshop-staging-tls image: repository: eshoponabp/app-authserver tag: latest pullPolicy: IfNotPresent -env: {} - \ No newline at end of file +env: {} \ No newline at end of file diff --git a/etc/k8s/eshoponabp/charts/basket/templates/basket-ingress.yaml b/etc/k8s/eshoponabp/charts/basket/templates/basket-ingress.yaml index e843265f..7f7ab322 100644 --- a/etc/k8s/eshoponabp/charts/basket/templates/basket-ingress.yaml +++ b/etc/k8s/eshoponabp/charts/basket/templates/basket-ingress.yaml @@ -8,7 +8,8 @@ metadata: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: 32k nginx.ingress.kubernetes.io/proxy-buffers-number: "8" - cert-manager.io/cluster-issuer: letsencrypt + cert-manager.io/issuer: eshop-issuer + # cert-manager.io/cluster-issuer: letsencrypt spec: tls: - hosts: diff --git a/etc/k8s/eshoponabp/charts/basket/values.yaml b/etc/k8s/eshoponabp/charts/basket/values.yaml index 5571e666..f332621a 100644 --- a/etc/k8s/eshoponabp/charts/basket/values.yaml +++ b/etc/k8s/eshoponabp/charts/basket/values.yaml @@ -19,7 +19,7 @@ config: ingress: host: eshop-st-basket - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/service-basket diff --git a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml index 17aef76c..a057014e 100644 --- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-deployment.yaml @@ -18,22 +18,22 @@ spec: ports: - name: http containerPort: 80 - - name: https - containerPort: 443 - name: grpc containerPort: 81 protocol: TCP env: + - name: "ASPNETCORE_URLS" + value: "http://+:80;http://+:81" + - name: "DOTNET_ENVIRONMENT" + value: "{{ .Values.config.dotnetEnv }}" - name: App__SelfUrl value: "{{ .Values.config.selfUrl }}" - name: App__CorsOrigins value: "{{ .Values.config.corsOrigins }}" - name: "ConnectionStrings__CatalogService" - value: {{ .Values.config.connectionStrings.catalogService }} + value: "{{ .Values.config.connectionStrings.catalogService }}" - name: "ConnectionStrings__AdministrationService" - value: {{ .Values.config.connectionStrings.administrationService }} - - name: "DOTNET_ENVIRONMENT" - value: "{{ .Values.config.dotnetEnv }}" + value: "{{ .Values.config.connectionStrings.administrationService }}" - name: "Redis__Configuration" value: "{{ .Values.config.redisHost }}" - name: "RabbitMQ__Connections__Default__HostName" diff --git a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-ingress.yaml b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-ingress.yaml index e843265f..774a82c0 100644 --- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-ingress.yaml +++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-ingress.yaml @@ -8,7 +8,7 @@ metadata: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: 32k nginx.ingress.kubernetes.io/proxy-buffers-number: "8" - cert-manager.io/cluster-issuer: letsencrypt + # cert-manager.io/cluster-issuer: letsencrypt spec: tls: - hosts: diff --git a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-service.yaml b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-service.yaml index 278771cd..28306a83 100644 --- a/etc/k8s/eshoponabp/charts/catalog/templates/catalog-service.yaml +++ b/etc/k8s/eshoponabp/charts/catalog/templates/catalog-service.yaml @@ -6,13 +6,11 @@ metadata: name: {{ .Release.Name }}-{{ .Chart.Name }} spec: ports: - - name: "80" + - name: "http" port: 80 - - name: "443" - port: 443 - - port: {{ .Values.config.grpcPort }} + - name: grpc targetPort: grpc protocol: TCP - name: grpc + port: {{ .Values.config.grpcPort }} selector: app: {{ .Release.Name }}-{{ .Chart.Name }} diff --git a/etc/k8s/eshoponabp/charts/catalog/values.yaml b/etc/k8s/eshoponabp/charts/catalog/values.yaml index d45c8b9e..970e0e02 100644 --- a/etc/k8s/eshoponabp/charts/catalog/values.yaml +++ b/etc/k8s/eshoponabp/charts/catalog/values.yaml @@ -16,20 +16,21 @@ config: stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 grpcPort: 81 kestrel: - httpUrl: # + httpUrl: http://eshop-st-catalog:80 httpProtocols: Http1AndHttp2 - grpcUrl: # + grpcUrl: http://eshop-st-catalog:81 grpcProtocols: Http2 - ingress: host: eshop-st-catalog - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/service-catalog tag: latest pullPolicy: IfNotPresent -env: {} +env: { + # ASPNETCORE_URLS=http://+:80;http://+:81 +} \ No newline at end of file diff --git a/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-deployment.yaml b/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-deployment.yaml index 07cea6b6..5e25b31e 100644 --- a/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-deployment.yaml @@ -27,8 +27,6 @@ spec: env: - name: App__SelfUrl value: "{{ .Values.config.selfUrl }}" - - name: GlobalConfiguration__BaseUrl - value: "{{ .Values.config.globalConfigurationBaseUrl }}" - name: "DOTNET_ENVIRONMENT" value: "{{ .Values.config.dotnetEnv }}" - name: "Redis__Configuration" @@ -44,9 +42,7 @@ spec: - name: "AuthServer__SwaggerClientSecret" value: "{{ .Values.config.authServer.swaggerClientSecret }}" - name: "ElasticSearch__Url" - value: "{{ .Values.config.elasticsearchHost }}" - - name: "StringEncryption__DefaultPassPhrase" - value: "{{ .Values.config.stringEncryptionDefaultPassPhrase }}" + value: "{{ .Values.config.elasticsearchHost }}" {{- if .Values.env }} {{ toYaml .Values.env | indent 8 }} {{- end }} diff --git a/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-ingress.yaml b/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-ingress.yaml index 539025ac..9bcfa428 100644 --- a/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-ingress.yaml +++ b/etc/k8s/eshoponabp/charts/gateway-web-public/templates/gateway-web-public-ingress.yaml @@ -8,7 +8,7 @@ metadata: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: 32k nginx.ingress.kubernetes.io/proxy-buffers-number: "8" - cert-manager.io/cluster-issuer: letsencrypt + cert-manager.io/cluster-issuer: eshop-issuer {{- if eq .Release.Name "es-az" }} nginx.ingress.kubernetes.io/from-to-www-redirect: "true" {{- end }} diff --git a/etc/k8s/eshoponabp/charts/gateway-web-public/values.yaml b/etc/k8s/eshoponabp/charts/gateway-web-public/values.yaml index c57f2199..bb625762 100644 --- a/etc/k8s/eshoponabp/charts/gateway-web-public/values.yaml +++ b/etc/k8s/eshoponabp/charts/gateway-web-public/values.yaml @@ -1,6 +1,5 @@ config: selfUrl: https://eshop-st-gateway-public-web - globalConfigurationBaseUrl: http://eshop-st-gateway-public-web authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" @@ -9,33 +8,31 @@ config: dotnetEnv: Staging redisHost: es-st-redis rabbitmqHost: es-st-rabbitmq - elasticsearchHost: # - stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 + elasticsearchHost: es-st-elasticsearch reRoutes: accountService: - url: http://eshop-st-authserver + url: https://eshop-st-authserver identityService: - url: http://eshop-st-identity + url: https://eshop-st-identity administrationService: - url: http://eshop-st-administration + url: https://eshop-st-administration catalogService: - url: http://eshop-st-catalog + url: https://eshop-st-catalog basketService: - url: http://eshop-st-basket + url: https://eshop-st-basket orderingService: - url: http://eshop-st-ordering + url: https://eshop-st-ordering paymentService: - url: http://eshop-st-payment + url: https://eshop-st-payment ingress: host: eshop-st-gateway-web-public - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/gateway-web-public tag: latest pullPolicy: IfNotPresent -env: {} - \ No newline at end of file +env: {} \ No newline at end of file diff --git a/etc/k8s/eshoponabp/charts/gateway-web/values.yaml b/etc/k8s/eshoponabp/charts/gateway-web/values.yaml index c52bfe5a..4e3ac302 100644 --- a/etc/k8s/eshoponabp/charts/gateway-web/values.yaml +++ b/etc/k8s/eshoponabp/charts/gateway-web/values.yaml @@ -21,7 +21,7 @@ reRoutes: url: http://eshop-st-administration ingress: host: # eshop-st-gateway-web - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/gateway-web diff --git a/etc/k8s/eshoponabp/charts/identity/templates/identity-ingress.yaml b/etc/k8s/eshoponabp/charts/identity/templates/identity-ingress.yaml index e843265f..e8030dea 100644 --- a/etc/k8s/eshoponabp/charts/identity/templates/identity-ingress.yaml +++ b/etc/k8s/eshoponabp/charts/identity/templates/identity-ingress.yaml @@ -8,7 +8,7 @@ metadata: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-buffer-size: 32k nginx.ingress.kubernetes.io/proxy-buffers-number: "8" - cert-manager.io/cluster-issuer: letsencrypt + cert-manager.io/cluster-issuer: selfsigned-issuer spec: tls: - hosts: diff --git a/etc/k8s/eshoponabp/charts/identity/values.yaml b/etc/k8s/eshoponabp/charts/identity/values.yaml index f7f0faa7..842fe3ee 100644 --- a/etc/k8s/eshoponabp/charts/identity/values.yaml +++ b/etc/k8s/eshoponabp/charts/identity/values.yaml @@ -32,7 +32,7 @@ identityServerClients: ingress: host: eshop-st-identity - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/service-identity diff --git a/etc/k8s/eshoponabp/charts/ordering/values.yaml b/etc/k8s/eshoponabp/charts/ordering/values.yaml index 70949147..895834ba 100644 --- a/etc/k8s/eshoponabp/charts/ordering/values.yaml +++ b/etc/k8s/eshoponabp/charts/ordering/values.yaml @@ -17,7 +17,7 @@ config: ingress: host: eshop-st-ordering - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/service-ordering diff --git a/etc/k8s/eshoponabp/charts/payment/values.yaml b/etc/k8s/eshoponabp/charts/payment/values.yaml index a4f316a0..3d5a55d7 100644 --- a/etc/k8s/eshoponabp/charts/payment/values.yaml +++ b/etc/k8s/eshoponabp/charts/payment/values.yaml @@ -17,7 +17,7 @@ config: ingress: host: eshop-st-payment - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/service-payment diff --git a/etc/k8s/eshoponabp/charts/public-web/templates/public-web-deployment.yaml b/etc/k8s/eshoponabp/charts/public-web/templates/public-web-deployment.yaml index 0faddf89..3519d65c 100644 --- a/etc/k8s/eshoponabp/charts/public-web/templates/public-web-deployment.yaml +++ b/etc/k8s/eshoponabp/charts/public-web/templates/public-web-deployment.yaml @@ -22,23 +22,23 @@ spec: containerPort: 443 env: - name: App__SelfUrl - value: {{ .Values.config.selfUrl}} + value: "{{ .Values.config.selfUrl }}" - name: RemoteServices__Default__BaseUrl - value: {{ .Values.config.gatewayUrl}} + value: "{{ .Values.config.gatewayUrl }}" - name: "AuthServer__Authority" - value: {{ .Values.config.authServer.authority }} + value: "{{ .Values.config.authServer.authority }}" - name: "AuthServer__RequireHttpsMetadata" value: "{{ .Values.config.authServer.requireHttpsMetadata }}" - name: "DOTNET_ENVIRONMENT" - value: {{ .Values.config.dotnetEnv }} + value: "{{ .Values.config.dotnetEnv }}" - name: "Redis__Configuration" - value: {{ .Values.config.redisHost }} + value: "{{ .Values.config.redisHost }}" - name: "StringEncryption__DefaultPassPhrase" - value: {{ .Values.config.stringEncryptionDefaultPassPhrase }} + value: "{{ .Values.config.stringEncryptionDefaultPassPhrase }}" - name: "RabbitMQ__Connections__Default__HostName" - value: {{ .Values.config.rabbitmqHost }} + value: "{{ .Values.config.rabbitmqHost }}" - name: "ElasticSearch__Url" - value: {{ .Values.config.elasticsearchHost }} + value: "{{ .Values.config.elasticsearchHost }}" {{- if .Values.env }} {{ toYaml .Values.env | indent 8 }} {{- end }} \ No newline at end of file diff --git a/etc/k8s/eshoponabp/charts/public-web/values.yaml b/etc/k8s/eshoponabp/charts/public-web/values.yaml index 72542a20..ba4f9861 100644 --- a/etc/k8s/eshoponabp/charts/public-web/values.yaml +++ b/etc/k8s/eshoponabp/charts/public-web/values.yaml @@ -1,6 +1,6 @@ config: selfUrl: https://eshop-st-public-web - gatewayUrl: "http://eshop-st-gateway-web-public/" + gatewayUrl: https://eshop-st-gateway-web-public authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" @@ -11,8 +11,8 @@ config: stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 ingress: - host: # eshop-st-public-web - tlsSecret: eshop-demo-tls + host: eshop-st-public-web + tlsSecret: eshop-staging-tls image: repository: eshoponabp/app-publicweb diff --git a/etc/k8s/eshoponabp/charts/web/values.yaml b/etc/k8s/eshoponabp/charts/web/values.yaml index 83e4b444..792ef099 100644 --- a/etc/k8s/eshoponabp/charts/web/values.yaml +++ b/etc/k8s/eshoponabp/charts/web/values.yaml @@ -7,7 +7,7 @@ config: ingress: host: eshop-st-web - tlsSecret: eshop-demo-tls + tlsSecret: eshop-staging-tls image: repository: eshoponabp/app-web diff --git a/etc/k8s/eshoponabp/values.yaml b/etc/k8s/eshoponabp/values.yaml index b3c350d8..81bc1014 100644 --- a/etc/k8s/eshoponabp/values.yaml +++ b/etc/k8s/eshoponabp/values.yaml @@ -13,6 +13,7 @@ authserver: elasticsearchHost: es-st-elasticsearch ingress: host: eshop-st-authserver + tlsSecret: eshop-staging-tls image: repository: "eshoponabp/app-authserver" tag: latest @@ -32,7 +33,7 @@ web: public-web: config: selfUrl: https://eshop-st-public-web - gatewayUrl: "http://eshop-st-gateway-web-public/" + gatewayUrl: http://eshop-st-gateway-web-public authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" @@ -123,7 +124,6 @@ gateway-web: redisHost: es-st-redis rabbitmqHost: es-st-rabbitmq elasticsearchHost: es-st-elasticsearch - stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 ingress: host: eshop-st-gateway-web image: @@ -141,7 +141,6 @@ gateway-web: gateway-web-public: config: selfUrl: https://eshop-st-gateway-web-public - globalConfigurationBaseUrl: http://eshop-st-gateway-public-web authServer: authority: http://eshop-st-authserver requireHttpsMetadata: "false" @@ -151,7 +150,6 @@ gateway-web-public: redisHost: es-st-redis rabbitmqHost: es-st-rabbitmq elasticsearchHost: es-st-elasticsearch - stringEncryptionDefaultPassPhrase: gsKnGZ041HLL4IM8 ingress: host: eshop-st-gateway-web-public image: diff --git a/etc/k8s/tls-cert/eshop-demo-tls.conf b/etc/k8s/tls-cert/eshop-demo-tls.conf new file mode 100644 index 00000000..68e574ef --- /dev/null +++ b/etc/k8s/tls-cert/eshop-demo-tls.conf @@ -0,0 +1,38 @@ +[req] +default_bits = 2048 +default_keyfile = eshop-st.key +distinguished_name = req_distinguished_name +req_extensions = req_ext +x509_extensions = v3_ca + +[req_distinguished_name] +commonName = Common Name (e.g. server FQDN or YOUR name) +commonName_default = eshoponabp +commonName_max = 64 + +[req_ext] +subjectAltName = @alt_names + +[v3_ca] +subjectAltName = @alt_names +basicConstraints = critical, CA:false +keyUsage = keyCertSign, cRLSign, digitalSignature,keyEncipherment + +[alt_names] +DNS.1 = eshop-st-web +DNS.2 = eshop-st-public-web +DNS.3 = eshop-st-authserver +DNS.4 = eshop-st-identity +DNS.5 = eshop-st-administration +DNS.6 = eshop-st-gateway-web +DNS.7 = eshop-st-gateway-web-public +DNS.8 = eshop-st-basket +DNS.9 = eshop-st-catalog +DNS.10 = eshop-st-ordering +DNS.11 = eshop-st-payment + +# Generate certificate from config +# Use the command: +# 'openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout eshop-st-cert.key -out eshop-st-cert.pem -config eshop-demo-tls.conf' +# Verify that you have eshop-st-cert.crt and eshop-st-cert.key files under k8s/tls-cert folder +# Run comand : 'kubectl create secret tls eshop-demo-tls --cert=eshop-st-cert.pem --key=eshop-st-cert.key --namespace=eshop' diff --git a/etc/k8s/tls-cert/eshop-st-cert.key b/etc/k8s/tls-cert/eshop-st-cert.key new file mode 100644 index 00000000..fffab06a --- /dev/null +++ b/etc/k8s/tls-cert/eshop-st-cert.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDSgXYuFacjDRuc +yj6oqIV1KlBinfbqnH9xEFOQXN6vFI9v5TzOTXstjCVQKhPWDCw3WSw7ydlAodFa +djeXEjapDGQmAVJk5nmPLv+UCOrZHd6ut8QEMb1cAGtOR71d8CVjWuZx6igGTPTQ +m2efRip0B0mog4j5vc+q8tr0qu+h13TAkivYGPQTvT46p/GypH5xFjAVw9P6IIYP +fr+nm2R/fUV3FEmaUBJmNjjoDJzrtGxe8zWD7vRxIYoNeffzRTMCT622Y8j6TEp2 +rlVPjh9Dp7+Wrj6FxopKBt6j3F5S1NKkEgEID8cL1Aufu0Xk/dWPsSAstVPgA/gf +GIW+7ALHAgMBAAECggEBAL2lmvYL1ecTMRRBdM/3+zxCYedmzwQw9/PBtLczo/9x +84Por65hSZ8QSrF9Jx/JGbDHqr02rX64CmeIZ6633vzPyA4hVLzIky13NxSEMCho +66zWrEbnFOUlD4eXxDg0WUq4ozJvtZ1viYPC7kklKqwbwLWLw0TUR5qIbtDMi1Vu +pyfm2YUtjqx2JPjD2i5juZx3XbgiqncpyRDroY80IqOZ/Kp83eMdst9wyfJaAy0B +kxZjvU1U2exD/l9RxKKreES2Vrbn+PvF3ttTgz/hE1ScBBfMB9kn+37esGZVByjb +ER0GFgt0jOx2ok+n2+zm2Z68IjoYDvsNo586tHoXxrECgYEA75UD5Nt9joCpCWVd +zXBQ8OUJwRU/N74RjBBS/NTT2sZ+q7xYxDx3xPwhyHXI+wwaHClGUE0yx5mrqqON +p3ELpanYdLWcdA6f/bFuuSNOAi7XSc1wCbNkTh5yxIyqWMvEYXqAj1/5T1VJ6+xU +pyKUe1588WKpSURrtGRxu0rKizkCgYEA4O5cJQmBeTlx++iVtONZv7HB371rYt45 +0nkBKfBJOjsVd2sB5f6ry5PaRcJyXamF7QYGgm4xo+KvrfHrf+JjebiJR46tsK0n +y130XjZVi28HPGBUG610zXOH3FgUQiSVbRulG0wzTtFHzdbVHJuTmA65+BZnayhM +WICqyiw0/f8CgYEAuXLmbbr8iFbNAYnmPwSGksEneL7ijVphqMJmCnEPgBQPrw1+ +xH9t0hu8ZrfNl435k/zbAYOQH/Kyb8Zj+s1FT7mV5FlDvo4nh69VXpeWZZgua2FL +LScgKFvnSH79yPgJjc7OPqzyhVcmfikUKb9Zodk064AMO7trh1oMswYkm/kCgYA/ +w/MFYOt+hUWGB4qhTC5+RJNUrWtLDPrRaxJkZEUuJ9/PCdvw6sCjJtgjHJu1Z8Ca +0DF6OmkCL9pj8ogzqedPc3wfeBhPVNdKNOl45+habfBcMmbFrefF8rGaSrH7ikl+ +M+8bjP+ioXu8o+GoiYZO/iXEaf2JiFQUZu2EAQJI2wKBgQCLUuZyV/fx2/90md4W +6GwyMYrA3Z3pVm3WKdphSX8euTTNjOjtwXwZ0iqfGsm0okHC0+DcI9PAhPh99fCB +7miZcUvQmqhmL7rcrOTfPRLVZ9flEVqeq6RCW4ICA2G7+0+eFz87FIl9EHfN9IMU +2mLb5Ph0OuI7W75OBR23qqVk5g== +-----END PRIVATE KEY----- diff --git a/etc/k8s/tls-cert/eshop-st-cert.pem b/etc/k8s/tls-cert/eshop-st-cert.pem index 45649b42..f962d807 100644 --- a/etc/k8s/tls-cert/eshop-st-cert.pem +++ b/etc/k8s/tls-cert/eshop-st-cert.pem @@ -1,31 +1,23 @@ -----BEGIN CERTIFICATE----- -MIIFQzCCA6ugAwIBAgIRANj5oNi+QQIoyV51y/ZIJlYwDQYJKoZIhvcNAQELBQAw -gZ8xHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTE6MDgGA1UECwwxZ3Nl -bmd1bkBHb2toYW5zLU1hY0Jvb2stUHJvLmxvY2FsIChHb2toYW4gU2VuZ3VuKTFB -MD8GA1UEAww4bWtjZXJ0IGdzZW5ndW5AR29raGFucy1NYWNCb29rLVByby5sb2Nh -bCAoR29raGFuIFNlbmd1bikwHhcNMTkwNjAxMDAwMDAwWhcNMzExMTA0MDgyNjUw -WjBlMScwJQYDVQQKEx5ta2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxOjA4 -BgNVBAsMMWdzZW5ndW5AR29raGFucy1NYWNCb29rLVByby5sb2NhbCAoR29raGFu -IFNlbmd1bikwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKu7X3b2Cg -dpBnz90KboUnpWRcCK96oq97pAEbR9sirN3+3jT0JRBY2TYKLDPW8i50QJFbdYE7 -zky58c+RWPrxVDoeqRC8E1+TLsuW+TdMmOL746k36X1VtKy3rqUG9IS6MXjH/MX8 -H1kgldHvE9mFEpyp3q/8cUPHSBUE+M0CA05wlDm8qgkGXcp43qrNElWg5Y2WWWIp -WUm8r5obktSAxhA+ZxFX4cJHFmxKymMqSRStDpTFCIW9C3kx5ierPNQS6g5sSMtW -OuPuh0Uhc0Q0lJBoA7Mj1CGvtO5nld0+6kAK1GMB7Vbigoqd00eqKMYaA3Aa5QZm -bf84wZjofJx1AgMBAAGjggExMIIBLTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww -CgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBR6TnYaWT+NPghb -dQnZ+MAbx9UB2DCB1gYDVR0RBIHOMIHLgghlc2hvcC1zdIIXZXNob3Atc3QtYWRt -aW5pc3RyYXRpb26CE2VzaG9wLXN0LWF1dGhzZXJ2ZXKCGWVzaG9wLXN0LWdhdGV3 -YXktaW50ZXJuYWyCG2VzaG9wLXN0LWdhdGV3YXktcHVibGljLXdlYoIUZXNob3At -c3QtZ2F0ZXdheS13ZWKCEWVzaG9wLXN0LWlkZW50aXR5ghNlc2hvcC1zdC1wdWJs -aWMtd2Vigg1lc2hvcC1zdC1zYWFzggxlc2hvcC1zdC13ZWIwDQYJKoZIhvcNAQEL -BQADggGBADjQroM3gD7g56S8bxlUbt1sJYfvo0VCIDPH9aHE3WwhGCOn18SRDOpM -mNw4c0HO+P1+rlCfn2pvN2oQ6v731fQZPpGcE0ljeVrixqfyVvoggGMbOwegvWPh -dPK/cxLi9wYfQtFw5vy8YxsinowSRCQ3KJGxI4fsyjEQu939WvYSPDdEUPx952LR -2pG8yRSso7dixDW4rDCoI/QKM/ImnqsNtZSpGa93HLgjkJr/PsOVMogt8dOsDOkC -vHq9F6TJKTDb7WizMJcE0qfisJgtTC2isvYA3u7kiyfxW26kd1h7s4m3njn+0Sks -0xGcXiYPZm8y/lVrxcF3/QlgOfWfRmls3D17yX28QwuwvNkUv2aSP/WGOMWEtgPD -9WYPk1OhOGFxT3IKu8iw6ITTCKXpcBeQ/QiEuFjo/khDGE4NMSkrp16nVebkAWal -/eufFWZJTzO7kgCmApS2SAhRdsM+JEsioHF/gM2chzV+eP4CCKv3pw5z07eemhx2 -HnEbhDFHEA== +MIIDxjCCAq6gAwIBAgIUavYi4mtz8TCt6EwG/MDNsnykGPMwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKZXNob3BvbmFicDAeFw0yMjA0MDgxOTAwMDFaFw0yMzA0 +MDgxOTAwMDFaMBUxEzARBgNVBAMMCmVzaG9wb25hYnAwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDSgXYuFacjDRucyj6oqIV1KlBinfbqnH9xEFOQXN6v +FI9v5TzOTXstjCVQKhPWDCw3WSw7ydlAodFadjeXEjapDGQmAVJk5nmPLv+UCOrZ +Hd6ut8QEMb1cAGtOR71d8CVjWuZx6igGTPTQm2efRip0B0mog4j5vc+q8tr0qu+h +13TAkivYGPQTvT46p/GypH5xFjAVw9P6IIYPfr+nm2R/fUV3FEmaUBJmNjjoDJzr +tGxe8zWD7vRxIYoNeffzRTMCT622Y8j6TEp2rlVPjh9Dp7+Wrj6FxopKBt6j3F5S +1NKkEgEID8cL1Aufu0Xk/dWPsSAstVPgA/gfGIW+7ALHAgMBAAGjggEMMIIBCDCB +6gYDVR0RBIHiMIHfggxlc2hvcC1zdC13ZWKCE2VzaG9wLXN0LXB1YmxpYy13ZWKC +E2VzaG9wLXN0LWF1dGhzZXJ2ZXKCEWVzaG9wLXN0LWlkZW50aXR5ghdlc2hvcC1z +dC1hZG1pbmlzdHJhdGlvboIUZXNob3Atc3QtZ2F0ZXdheS13ZWKCG2VzaG9wLXN0 +LWdhdGV3YXktd2ViLXB1YmxpY4IPZXNob3Atc3QtYmFza2V0ghBlc2hvcC1zdC1j +YXRhbG9nghFlc2hvcC1zdC1vcmRlcmluZ4IQZXNob3Atc3QtcGF5bWVudDAMBgNV +HRMBAf8EAjAAMAsGA1UdDwQEAwIBpjANBgkqhkiG9w0BAQsFAAOCAQEAhJK7TgZw +IVqVbyYHw3M3fH5/tvioZNq0PbYOeWBX/A4ZolE1o5n5wzwk1TcOk7Kg8KdvZPM8 +VZgfx4B/MYaHWmliPx036oB4MJ9zh1D+zPr2kNqUKzY07H1JJDS9BzuBiSnnv7dJ +nuiJnV5F2Uy2cWltCgZ4xZ7xwnlofxIV4EnB88r+Gqz+LNtm1BFF4p5CzSQHcTrc +04H7k7gvITRYq086yuButbYT43uBBVJDEmTWUKMYWgh5K1cbyOUkYmaMCYaUnpNq +tgoZCNrUq3dpv/KsDsxh1bf2W0LsNiu2zExjetqDjoDC4cnCXYOsF7dW0HcnqFCN +PcxxXhW+kcd6+A== -----END CERTIFICATE----- diff --git a/etc/k8s/tls-cert/eshop-st-key.pem b/etc/k8s/tls-cert/eshop-st-key.pem deleted file mode 100644 index 146780f7..00000000 --- a/etc/k8s/tls-cert/eshop-st-key.pem +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDKu7X3b2CgdpBn -z90KboUnpWRcCK96oq97pAEbR9sirN3+3jT0JRBY2TYKLDPW8i50QJFbdYE7zky5 -8c+RWPrxVDoeqRC8E1+TLsuW+TdMmOL746k36X1VtKy3rqUG9IS6MXjH/MX8H1kg -ldHvE9mFEpyp3q/8cUPHSBUE+M0CA05wlDm8qgkGXcp43qrNElWg5Y2WWWIpWUm8 -r5obktSAxhA+ZxFX4cJHFmxKymMqSRStDpTFCIW9C3kx5ierPNQS6g5sSMtWOuPu -h0Uhc0Q0lJBoA7Mj1CGvtO5nld0+6kAK1GMB7Vbigoqd00eqKMYaA3Aa5QZmbf84 -wZjofJx1AgMBAAECggEBALvJLd9ZInbf/Bi8uLFt+BbmI1UAkpKU2Nk86+16HKg8 -2ZC4APLY1hCGeoDnusjyIUd7e2jtKdzc1cMzEiI++orJiuBVl/OuOkxZ/ykEBU4F -G9NYaKkqtPbLWWT291O+8KaLJqaQJE/KNcNyIzhB+a1CtSy/4eGChNa1lQq67yJZ -iTFPNSHT1RTzjv2BAuUASq1gK+bX4F65otVYQBMg3JGsfkAdhWPbzEX0XLVpgbh/ -jtyAHSsiWIkyVjXvA3Zjp+3Gmf3dbd/86Uwd4XowPfcSOP4iyd76FS4iTlthsF5D -M0psBOgotVl5RHv2ljOy7fUzrudnSQ0HepgdHed4Em0CgYEA7q+j7cbcb43ZW5Rx -p2pMuuuEeFY+L2Ns8N4t26OoURQCzyACR5H4KgFtrrdqTwQPs7L8SWAjU8SoP2jX -j+4+TJnK/Grt0YQ2pLpEM8j7kjGWfskHDfQhrL3o4VhdCm/1URWYSn7nzdNnX1Fk -ZlKjUJWBXGTvthCUVY9Jk30hU4sCgYEA2XBupvyIpmjoNdsEdwxxSebLyIYu2FA/ -sjI5gdzXIOo9DsFfn9HTNbXyEsiQm9StNXS585jRhyht9OF7SYajrJ/E3O086tf4 -2MmDbUdFdvMdPdGxxTU2mXa9Vd6JASnFG+fSsRhABk57iNzcUE4+PNW1ztLmRyLx -diW9cXjXz/8CgYBxGF43U0utu+uqvgqgRfj3dJL/JfYvJBBBjTTzZndhe3bdR5Bs -8xhAZw7eg1/m8six3/Q0nE4A6iTCbt38/+kbCKAqvEvVQ61UnkGku+2f1sk1Z/Fk -xjGSlSWcaO8k++mkMvRHEByr5SiM/Jby+OMTUtPJwLXocbCnXc6CCP9agwKBgEe7 -I4XLAXmEWjaKDisH28e5b7izK3kI4Dp0/yusIvwkyge4G0ep/LdXUoiHyczemFVu -MHoAC/8+gyepyvYyiIRGILeRO+ttXBaIQ+ck//GBuj/OkYqxR1XRKhzN0PylPvU5 -wPPTQCvUcERyN+v2I+oFxnh4cqc9C9MiGCD68JcZAoGBAIi1RxcWKZUCjSETT1PY -V7j5FIyMzBdUo0RN44eUdeu0CWAOnMG2s26z6fXl7EZp+Em5ee7dYEmSP49X69n9 -T9ueN1LRJaqko45Eo3uPl6rolz5vXcTr2Tooc3yqE3XbRxe2jOeczq06nj06kjuf -hPPdSqjjOwWPy63DWboSkh+0 ------END PRIVATE KEY----- diff --git a/etc/k8s/tls-cert/eshop-test-tls.crt b/etc/k8s/tls-cert/eshop-test-tls.crt new file mode 100644 index 00000000..c3a18d04 --- /dev/null +++ b/etc/k8s/tls-cert/eshop-test-tls.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDxjCCAq6gAwIBAgIUWAAiaf6jGeQBXdYnOFUKw+cQIlMwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKZXNob3BvbmFicDAeFw0yMjA0MDgyMjM4NDVaFw0yMzA0 +MDgyMjM4NDVaMBUxEzARBgNVBAMMCmVzaG9wb25hYnAwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDaQiJirGIVlbr00M8e1qTWLeIgsMUhLGa8fa/cEMJ7 +uInNm6hkCv1UrxGDKcxBBXs/kt+VYfnjtp+2IBlgv6wbHWftQYEwXxbtvXNIBWIn +GEee9S2uREDm0OHJF/xLEHPvFE15mFeo3bfJ3GIkuXuKu3RzQBre4q2y+1RfHnav +YKF/QIg3oWysnmt5G2wBS7bZvHkjvX7N31g80JU3yYuPkiCJi+PHiQbeyn4Obaf+ +TksoOqrwIO6bYE+cR5v2eLn0nLg/ZYvKSAbmmEiNIja3DRidxM9fYWPQgqVsAGs5 +CqdqH3PX9JNSl2FOQQqPSQ9IUwa5lJogNiSWZVacijh1AgMBAAGjggEMMIIBCDCB +6gYDVR0RBIHiMIHfggxlc2hvcC1zdC13ZWKCE2VzaG9wLXN0LXB1YmxpYy13ZWKC +E2VzaG9wLXN0LWF1dGhzZXJ2ZXKCEWVzaG9wLXN0LWlkZW50aXR5ghdlc2hvcC1z +dC1hZG1pbmlzdHJhdGlvboIUZXNob3Atc3QtZ2F0ZXdheS13ZWKCG2VzaG9wLXN0 +LWdhdGV3YXktd2ViLXB1YmxpY4IPZXNob3Atc3QtYmFza2V0ghBlc2hvcC1zdC1j +YXRhbG9nghFlc2hvcC1zdC1vcmRlcmluZ4IQZXNob3Atc3QtcGF5bWVudDAMBgNV +HRMBAf8EAjAAMAsGA1UdDwQEAwIBpjANBgkqhkiG9w0BAQsFAAOCAQEA0lsXpx1C +ItDk2gwKnUiof90y9iYBIZZ+RyxZlJHXYOTrfzOtg1U5zxZtaTBefPJhjI/hibyu +a2zCUFpc0CBLG8EVzLOv8VJDxiRf93bLP9Eoy40l8MVS8Lt5HVRs8xUiuGvxspwH +7aXAeP0HlykDjt3njwawPRuijFrk2GzQSCkPVh84e7RKTq4TYb1MpRjZw2Q92/NM +v0Zboi7wY0RqakyUHdWpgnWP/5ch8f8mInXkOJiQo0h5fbtrB8UdBGC7Qu1uKgsb +UloHs0w5p0q1AqmtYTJo2FmMP/touls/XhpJ5V0B3X2qh5JISqZiKifkPoJaIKCt +6ivVqCafin3yEQ== +-----END CERTIFICATE----- diff --git a/etc/k8s/tls-cert/eshop-test-tls.key b/etc/k8s/tls-cert/eshop-test-tls.key new file mode 100644 index 00000000..3958be9a --- /dev/null +++ b/etc/k8s/tls-cert/eshop-test-tls.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDaQiJirGIVlbr0 +0M8e1qTWLeIgsMUhLGa8fa/cEMJ7uInNm6hkCv1UrxGDKcxBBXs/kt+VYfnjtp+2 +IBlgv6wbHWftQYEwXxbtvXNIBWInGEee9S2uREDm0OHJF/xLEHPvFE15mFeo3bfJ +3GIkuXuKu3RzQBre4q2y+1RfHnavYKF/QIg3oWysnmt5G2wBS7bZvHkjvX7N31g8 +0JU3yYuPkiCJi+PHiQbeyn4Obaf+TksoOqrwIO6bYE+cR5v2eLn0nLg/ZYvKSAbm +mEiNIja3DRidxM9fYWPQgqVsAGs5CqdqH3PX9JNSl2FOQQqPSQ9IUwa5lJogNiSW +ZVacijh1AgMBAAECggEAA3CxbA69iQuQI9W6vgiyFnIos001/jzd7bCpefWFqz+Q +ZH5EnDcUISaVRxT8lDXK6IifH5Koxq8VO2CsJbs/sjm3bqTurV2CVgL7czIqhuU6 +E8ZXjvyibUDzniDTqDc9LJKMWhNNpmrAP91KarvFt70Wq85h3guCo2SUwt8PDdqX +nHw0QzBXfkvg9/b90XCXrR/LnIyQ271wONJ1t1updDeo/EZzj/77yFWrvO7zw734 +FqDpfY+VeD9YNQszU40J/CMZa2qKqBXNp68JL2xOSFeHqNKvwKWvP145uGjURblz +Z12NdoKE3WbzMyv9zO1IdocaL1bFtM+7t3B9KFIbQQKBgQDz9ip8+AOTHp3RywUa +PvVGSk3U8+PBX3tTXgmoeRbMJ+xffE8uHMDu710izEvbkxQhAgar5dJH8NiragvW +LVZXCnstJfGI1V3oXnB2Y4BEB1ZTVSV8fuYutm6UhudWebTMg9EndvixK088pjya +GX0nx4MXOWgBo7vgLNXDNQa40QKBgQDlB0XvpJQEBZurz04iEgjXuXHttGQr4kw8 +0DwC2KA1JnEqZFy4CNGQyyIAKG9xDGCeejbwzBXkamPXpZ4Q7/Opv3wbsxzCnZE3 +MX6XUKqx2CfG7lRWwmLybLvRynHhT6LlWouNil/pHKvdv8LF+pu68S7sK24CaMpu +QF8aREHuZQKBgQDBnWBjBcJwhB/kXCeUiNrICjhzBYx/73NE2qD3oAJDzHt/3HxK +sG8+MaHM+C5L+RJEkAMTcbXNeou6ntL+C8U2Fw9i6XYjjpKU1D6U9qrZUqlkQXMa +tuufrxFbtyTqMHUYypS3qWf9081y6Mu30PrPEzwqtlig1H1KkMqlvfOzwQKBgFLS +soPbLHvX21fifAruIqyAr6aama8VAyTq2QjedfFCmaIO8UjMR5zpGL6d4M8s/rPQ +1pV1+GTF5J1TkznkzGUSjjsmJrxqZt1i1Li7vz7ZQGk8PtuxKD8q+zD+2Pf16J6w +g88Hv295ot1qP3GBE1gjaCiX/Ax7ANmmBb5l+MHRAoGAY6MXc6EUdgcLq0p/FbNk +OloFD/iUGNsJfSMxMg3vpWP9PhTSToiVDJrsviFWl2+z4CNicptsqfji237Uu4TP +d8Br0flNjfgyZ6BeRl1Ovgls6hDVgvjl6VWghZw9TfA0pc1ozb5FnUQkTG3+ceBY +KlHxDmv2VwadB8QbmuHqKjc= +-----END PRIVATE KEY----- diff --git a/etc/k8s/tls-cert/ingress-tls.yaml b/etc/k8s/tls-cert/ingress-tls.yaml new file mode 100644 index 00000000..f888087d --- /dev/null +++ b/etc/k8s/tls-cert/ingress-tls.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: kuard + annotations: + kubernetes.io/ingress.class: "nginx" + cert-manager.io/issuer: "letsencrypt-staging" + +spec: + tls: + - hosts: + - example.example.com + secretName: quickstart-example-tls + rules: + - host: example.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: kuard + port: + number: 80 diff --git a/etc/k8s/tls-cert/notes.md b/etc/k8s/tls-cert/notes.md index d10840d4..9b9fae8e 100644 --- a/etc/k8s/tls-cert/notes.md +++ b/etc/k8s/tls-cert/notes.md @@ -7,3 +7,43 @@ kubectl create secret tls eshop-demo-tls \ --cert=eshop-st-cert.pem \ --key=eshop-st-key.pem ``` + +# Install cert-manager + +`kubectl create namespace eshop` + +Next, use the **`kubectl apply`** command and the **`yaml`** file available online to install the add-on: + +```powershell +kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.7.0/cert-manager.yaml +``` + +Now deploy the issuer: + +```powershell +kubectl apply -f .\selfsigned\issuer.yaml +``` + +Now deploy the certificate: + +```powershell +kubectl apply -f .\selfsigned\certificate.yaml +``` + +Check the certificate: + +```powershell +kubectl describe certificate -n=eshop +``` + +Check the secrets: + +```powershell +kubectl get secrets -n=eshop +``` + +You should be seeing `eshop-staging-tls` + +To view information about the Secret, use the **`get secret`** command: + +`kubectl get secret eshop-staging-tls -n cert-manager` diff --git a/etc/k8s/tls-cert/selfsigned/certificate.yaml b/etc/k8s/tls-cert/selfsigned/certificate.yaml new file mode 100644 index 00000000..ec7b9ab2 --- /dev/null +++ b/etc/k8s/tls-cert/selfsigned/certificate.yaml @@ -0,0 +1,21 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: selfsigned-cert + namespace: eshop +spec: + dnsNames: + - "*.eshop-st-web" + - "*.eshop-st-public-web" + - "*.eshop-st-authserver" + - "*.eshop-st-identity" + - "*.eshop-st-administration" + - "*.eshop-st-basket" + - "*.eshop-st-catalog" + - "*.eshop-st-ordering" + - "*.eshop-st-payment" + - "*.eshop-st-gateway-web" + - "*.eshop-st-gateway-web-public" + secretName: eshop-single-tls + issuerRef: + name: eshop-issuer \ No newline at end of file diff --git a/etc/k8s/tls-cert/selfsigned/cluster-issuer.yaml b/etc/k8s/tls-cert/selfsigned/cluster-issuer.yaml new file mode 100644 index 00000000..c69e8a11 --- /dev/null +++ b/etc/k8s/tls-cert/selfsigned/cluster-issuer.yaml @@ -0,0 +1,6 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-issuer +spec: + selfSigned: {} \ No newline at end of file diff --git a/etc/k8s/tls-cert/selfsigned/issuer.yaml b/etc/k8s/tls-cert/selfsigned/issuer.yaml new file mode 100644 index 00000000..134fa38c --- /dev/null +++ b/etc/k8s/tls-cert/selfsigned/issuer.yaml @@ -0,0 +1,7 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: eshop-issuer + # namespace: eshop +spec: + selfSigned: {} \ No newline at end of file diff --git a/etc/k8s/tls-cert/selfsigned/readme.md b/etc/k8s/tls-cert/selfsigned/readme.md new file mode 100644 index 00000000..198b3bc2 --- /dev/null +++ b/etc/k8s/tls-cert/selfsigned/readme.md @@ -0,0 +1,8 @@ +`helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.4.0 --set installCRDs=true` +`kubectl create ns eshop` +`kubectl apply -f .\selfsigned\issuer.yaml` + + +```powershell +kubectl create secret tls eshop-demo-tls --cert=eshop-st-cert.pem --key=eshop-st-cert.key -n ingress-nginx +``` \ No newline at end of file