There is an amazing post on software architecture named The Architecture Behind A One-Person Tech Startup which you should check it out. I'm almost using same tech architecture for my projects.
There is one thing however that I want to tweak:
Since Cloudflare proxying all external traffic to my Load Balancer(Ingress controlled Load Balancer) with default browser side SSL ceritificate;
I only need Origin Server TLS certificate for a full SSL tunnel:
As Cloudflare mentioned in End-to-end HTTPS with Cloudflare - Part 3: SSL options, you can provide your self-signed certificate for Full mode or you can provide a Cloudflare Origin CA certificate (or a valid certificate purchased from a CA) to enable Full (strict) mode:
So I don't need Let's Encrypt to grant me SSL certificate for my site. Yes, I am grateful for their free ACME certificates but in our case it's better to not load extra work to Lets' Encrypt while Cloudflare is also a CA.
OK, We saw what we need but how we're going to issue and add an Origin CA ceritificate to our origin server?
The default way is like this: Managing Cloudflare Origin CA certificates. Although it's manual, rquires a lot effort and we need to regenerate and revoke our own certificates. We don't like to use this way for our kubernetes clusters for sure.
The solution comes from Cloudflare team: origin-ca-issuer.
Origin CA Issuer is a cert-manager CertificateRequest controller for Cloudflare’s Origin CA feature. It handles above mentioned default way by itself.
Clone the github repo and apply manifests to install Origin CA Issuer to your cluster:
$ kubectl apply \ -f deploy/crds \ -f deploy/rbac \ -f deploy/manifests
By default the Origin CA Issuer will be deployed in the
Get your Origin CA Key from API Token section of your Cloudflare dashboard and create a secret yaml for it:
$ kubectl create secret generic \ origin-ca-key \ -n default \ --from-literal key=v1.0-FFFFFFF-FFFFFFFF \ --dry-run=client \ -o yaml > origin-ca-key.yaml
default namespace according to your need, then create
issuer.yaml like below:
# issuer.yaml apiVersion: cert-manager.k8s.cloudflare.com/v1 kind: OriginIssuer metadata: name: prod-issuer namespace: default spec: requestType: OriginECC auth: serviceKeyRef: name: origin-ca-key key: key
Apply these manifests to your cluster:
$ kubectl apply \ -f origin-ca-key.yaml \ -f issuer.yaml
OriginIssuer resource will be updated once the Origin CA Issuer is ready.
After that create your Ingress resource like below:
# example-ingress.yaml apiVersion: networking/v1 kind: Ingress metadata: annotations: kubernetes.io/ingress.class: nginx # ssl certificate cert-manager.io/issuer: prod-issuer cert-manager.io/issuer-kind: OriginIssuer cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com # dns record external-dns.alpha.kubernetes.io/hostname: example.com external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" name: example-ingress namespace: default spec: rules: - host: example.com http: paths: - pathType: Prefix path: / backend: service: name: example-svc port: number: 80 tls: # specifying a host in the TLS section will tell cert-manager what # DNS SANs should be on the created certificate. - hosts: - example.com # cert-manager will create this secret secretName: example-tls
Apply it as well:
$ kubectl apply -f example-ingress.yaml
Now you got:
- DNS record for example.com proxied by Cloudflare
- SSL certificate for your origin server signed by Cloudflare
- Full (strict) mode enabled
- Orange Cloud enabled
and you're ready to go.
- I wish origin-ca-issuer had a
Helm Reposo we can install it via
helm install, and they had ClusterOriginIssuer
instead of namespace scopedOriginIssuer`. Fortunately there are related issues on the repo and they are already working on them.
- How much I tried I couldn't make origin-ca-issuer work by
ingress-traefik. If someone achieves that I'll be happy to learn.