In this article we are going to cover Kubernetes Nginx Ingress Controller LetsEncrypt [cert-manager, TLS], Install Helm 3 on Kubernetes Cluster, Install Nginx Ingress Controller Kubernetes using Helm, Creating Deployment and service for nginx app.
Creating Nginx Ingress Resources and Exposing the apps, Configure cert manager for Nginx Ingress, Creating Nginx Ingress Let’s Encrypt TLS Certificate, Point Nginx Ingress Let’s Encrypt Certificate in Nginx Ingress, Pointing Domain Name to Nginx Ingress LoadBalancer.
Table of Contents
Prerequisites:
- Kubernetes Cluster with v1.19.0+
Follow below article to Setup Kubernetes on AWS using KOPS and kubeadm method
9 Steps to Setup Kubernetes on AWS using KOPS
How To Setup Kubernetes Cluster Using Kubeadm on Ubuntu 18.04/16.04 LTS
#1: Install Helm 3 on Kubernetes Cluster
Install helm3 on Kubernetes Cluster on Kubernetes Cluster using below command
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh
To check helm3 version
helm version
Output:
version.BuildInfo{Version:"v3.5.3", GitCommit:"041ce5a2c17a58be0fcd5f5e16fb3e7e95fea622", GitTreeState:"dirty", GoVersion:"go1.15.8"}
#2: Install Nginx Ingress Controller Kubernetes using Helm
Add the nginx ingress helm repo in Kubernetes kops cluster, follow this Nginx ingress official page to install latest nginx ingress helm chart
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
Update the helm repo
helm repo update
Install Nginx Ingress Controller Kubernetes KOPS using Helm 3
helm install ingress-nginx ingress-nginx/ingress-nginx
Output:
Output:
NAME: ingress-nginx
LAST DEPLOYED: wed Apr 21 07:10:01 2021
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
The ingress-nginx controller has been installed.
It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status by running 'kubectl --namespace default get services -o wide -w ingress-nginx-controller'
An example Ingress that makes use of the controller:
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
name: example
namespace: foo
spec:
rules:
- host: www.example.com
http:
paths:
- backend:
serviceName: exampleService
servicePort: 80
path: /
# This section is only required if TLS is to be enabled for the Ingress
tls:
- hosts:
- www.example.com
secretName: example-tls
If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
apiVersion: v1
kind: Secret
metadata:
name: example-tls
namespace: foo
data:
tls.crt: <base64 encoded cert>
tls.key: <base64 encoded key>
type: kubernetes.io/tls
To check nginx ingress controller
kubectl get services ingress-nginx-controller
Output:
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx-controller LoadBalancer 100.65.85.238 a8e1355c94fdd438a9d207181b50ea1d-213346636.ap-south-1.elb.amazonaws.com 80:30710/TCP,443:31894/TCP 5m15s
#3. Creating Deployment and service for nginx app
Lets deploy the sample nginx app on nginx ingress controller
Create the nginx app deployment
sudo nano nginx-deploy.yml
paste the below deployment
kind: Deployment
apiVersion: apps/v1
metadata:
name: nginx-app
namespace: default
labels:
app: nginx-app
spec:
replicas: 1
selector:
matchLabels:
app: nginx-app
template:
metadata:
labels:
app: nginx-app
spec:
containers:
- name: nginx
image: "nginx"
Create the nginx app service
sudo nano nginx-svc.yml
paste the below code
apiVersion: v1
kind: Service
metadata:
name: nginx-app
namespace: default
spec:
selector:
app: nginx-app
ports:
- name: http
targetPort: 80
port: 80
deploy the nginx app deployment and service on kubernetes
kubectl create -f nginx-deploy.yml
kubectl create -f nginx-svc.yml
#4. Creating Nginx Ingress Resources and Exposing the apps
Lets create the nginx ingress resource on Kubernetes to expose the apps
sudo nano nginx-ingress.yml
Paste the below nginx app details, here service name should match with service.yml’s
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
namespace: default
annotations:
kubernetes.io/ingress.class: nginx
spec:
rules:
- host: nginxapp.fosstechnix.info
http:
paths:
- backend:
service:
name: nginx-app
port:
number: 80
path: /
pathType: Prefix
deploy the nginx ingress resource on Kubernetes cluster
kubectl create -f nginx-ingress.yml
To check Kubernetes pods using kubectl
kubectl get pods
Output:
kubectl get pods
NAME READY STATUS RESTARTS AGE
ingress-nginx-controller-6f5454cbfb-2jvcf 1/1 Running 0 41m
nginx-app-d6ff45774-hp7s4
To check kubernetes deployments using kubectl
kubectl get deploy
Output:
NAME READY UP-TO-DATE AVAILABLE AGE
ingress-nginx-controller 1/1 1 1 42m
nginx-app 1/1 1 1 41m
To check Kubernetes service using kubectl
kubectl get svc
Output:
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx-controller LoadBalancer 100.64.113.132 afbcd905b614842c29702ddd7481784d-1960968212.ap-south-1.elb.amazonaws.com 80:30375/TCP,443:31354/TCP 43m
ingress-nginx-controller-admission ClusterIP 100.67.218.51 <none> 443/TCP 43m
kubernetes ClusterIP 100.64.0.1 <none> 443/TCP 48m
nginx-app ClusterIP 100.68.218.6 <none> 80/TCP 42m
To check kubernetes ingress using kubectl
kubectl get ingress
Output:
NAME CLASS HOSTS ADDRESS PORTS AGE
nginx-ingress <none> nginxapp.fosstechnix.info afbcd905b614842c29702ddd7481784d-1960968212.ap-south-1.elb.amazonaws.com 80, 443 42m
#5. Pointing Nginx Ingress Loadbalancer in Domain Name provider to Access app using Domain Name
To access your application/domain name using browser you can either access using Loadbalancer URL or you can point Loadbalancer URL by adding CNAME record in Domain Provider.
Here We have added CNAME record in GoDaddy with Domain nginxapp.fosstechnix.info

#6: Configure cert manager for Nginx Ingress
once nginx ingress controller setup is done on your Kubernetes cluster, Lets install and configure cert manager using below kubectl command for Kubernetes version 1.16+
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager.yaml
Sample Output:
service/cert-manager created
service/cert-manager-webhook created
deployment.apps/cert-manager-cainjector created
deployment.apps/cert-manager created
deployment.apps/cert-manager-webhook created
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created
for Kubernetes <1.16 version
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager-legacy.yaml
it will install cert manager packages on your k8s cluster
#7: Kubernetes Nginx Ingress Controller LetsEncrypt
To configure Kubernetes Nginx Ingress Controller LetsEncrypt , navigate to cert manager acme ingress page, go to Configure Let’s Encrypt Issuer, copy the let’s encrypt issuer yml and change as shown below.
sudo nano letsencrypt-issuer.yml
apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod namespace: default spec: acme: # The ACME server URL server: https://acme-v02.api.letsencrypt.org/directory # Email address used for ACME registration email: [email protected] # Name of a secret used to store the ACME account private key privateKeySecretRef: name: letsencrypt-prod # Enable the HTTP-01 challenge provider solvers: - http01: ingress: class: nginx
kubectl apply -f letsencrypt-issuer.yml
We have deployed let’s encrypt issuer which issues certificates,
#8: Creating Nginx Ingress Let’s Encrypt TLS Certificate
Now lets create Nginx Ingress Let’s Encrypt TLS certificate for your microservice.
sudo nano letsencrypt-cert.yml
Modify the Nginx Ingress Let’s Encrypt TLS certificate as per your micro service/domain name
apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: nginxapp.fosstechnix.info namespace: default spec: secretName: nginxapp.fosstechnix.info-tls issuerRef: name: letsencrypt-prod kind: ClusterIssuer commonName: nginxapp.fosstechnix.info dnsNames: - nginxapp.fosstechnix.info
kubectl apply -f letsencrypt-cert.yml
once done, it will create a Nginx ingress letsencrypt TLS certificate for domain nginxapp.fosstechnix.info and injects into Kubernetes secrets.
Lets check the certificate is created
kubectl get certificates nginxapp.fosstechnix.info
Output:
kubectl get certificates nginxapp.fosstechnix.info
NAME READY SECRET AGE
nginxapp.fosstechnix.info True nginxapp.fosstechnix.info-tls 32s
Let’s check secrets to check Nginx Ingress letsencrypt TLS
kubectl get secrets nginxapp.fosstechnix.info-tls
Output:
kubectl get secrets nginxapp.fosstechnix.info-tls
NAME TYPE DATA AGE
nginxapp.fosstechnix.info-tls kubernetes.io/tls 2 2m50s
We have covered Kubernetes Nginx Ingress Controller LetsEncrypt [cert-manager, TLS]
#9: Point Nginx Ingress Let’s Encrypt Certificate in Nginx Ingress
Now point/refer the generated Nginx Ingress Let’s Encrypt in your Kubernetes nginx Ingress as shown below.
Add the highlighted lines in nginx ingress resource.
kubectl edit ingress nginx-ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
kubernetes.io/ingress.class: nginx
creationTimestamp: "2021-04-22T03:20:24Z"
generation: 2
name: nginx-ingress
namespace: default
resourceVersion: "5902"
uid: 62300582-7b91-4f56-a229-75f9664f9334
spec:
rules:
- host: nginxapp.fosstechnix.info
http:
paths:
- backend:
service:
name: nginx-app
port:
number: 80
path: /
pathType: Prefix
tls:
- hosts:
- nginxapp.fosstechnix.info
secretName: nginxapp.fosstechnix.info-tls
status:
loadBalancer:
ingress:
- hostname: afbcd905b614842c29702ddd7481784d-1960968212.ap-south-1.elb.amazonaws.com
Here we have referenced secret nginxapp.fosstechnix.info-tls and added annotation cert-manager.io/cluster-issuer: letsencrypt-prod.
Note: secret and certificates should be in same namespace as ingress.
#10: Accessing Nginx Ingress Resources using Let’s Encrypt
Finally we can see your application site https://nginxapp.fosstechnix.info using Lets’s Encrypt SSL (Kubernetes Nginx Ingress Controller LetsEncrypt-cert-manager,TLS).
https://nginxapp.fosstechnix.info
Output:

Conclusion:
We have covered Kubernetes Nginx Ingress Controller LetsEncrypt [cert-manager, TLS], Install Helm 3 on Kubernetes Cluster, Install Nginx Ingress Controller Kubernetes using Helm, Creating Deployment and service for nginx app.
Creating Nginx Ingress Resources and Exposing the apps, Configure cert manager for Nginx Ingress, Creating Nginx Ingress Let’s Encrypt TLS Certificate, Point Nginx Ingress Let’s Encrypt Certificate in Nginx Ingress, Pointing Domain Name to Nginx Ingress LoadBalancer and Kubernetes Nginx Ingress Controller LetsEncrypt.
Related Articles:
Reference: