Good practices for handling TLS LetsEncrypt with Kubernetes Service

Question

Considering a Nginx reverse-proxy handling TLS LetsEncrypt certificates "in front" of a backend service, what is the good deployment architecture of this setup on Kubernetes ?

My first thought was do make a container with both Nginx and my server in a container as a Stateful Set. All those stateful sets have access to a volume mounted on /etc/nginx/certificates . All those containers are running a cron and are allowed to renew those certificates.

However, I do not think it's the best approach. This type of architecture is made to be splited, not running completely independant services everwhere.

Maybe I should run an independent proxy service which handle certificates and does the redirection to the backend server deployment ( ingress + job for certificate renewal) ?

If you are using a managed service (such as GCP HTTPS Load Balancer), how do you issue a publicly trusted certificate and renew your it?

Answer 1

You want kube-lego .

kube-lego automatically requests certificates for Kubernetes Ingress resources from Let's Encrypt

It works with GKE+LoadBalancer and with nginx-ingress as well. Usage is trivial; automatic certificate requests (including renewals); uses LetsEncrypt.

The README says -perhaps tongue in the cheek- that you need a non production use case. I have been using it for production and I have found it to be reliable enough.

(Full disclosure: I'm loosely associated with the authors but not paid to advertise the product)