Skip to main content

Automatic HTTPS

Install three add-ons, Ingress, DNS Automation and Certificates, and an app that brings its own Ingress gets a public DNS name and a trusted TLS certificate with no manual step: you only write the hostname on the Ingress. DNS Automation publishes the record, Certificates gets the certificate from Let's Encrypt, and Ingress serves HTTPS with it. This is a setup of three add-ons, not an add-on of its own.

When to use it​

This page is for apps that bring their own Ingress: Helm, Git repository and YAML apps.

  • You deploy a chart or manifests with an Ingress, and want a public name and a trusted certificate. Without these add-ons, you create the DNS record and the certificate by hand, and renew it yourself. With them, both follow the hostname on your Ingress.
  • You deploy an image app or a model. You need Certificates and DNS Automation too, plus Ingress for an image app, but not this page: set the domain on the deploy wizard's Access step, and AstroPulse writes the Ingress and asks for the certificate. See Put an application on your domain.
  • You want HTTPS on an internal or test cluster. Use the self-signed issuer (below); no public DNS is needed.

Before you start​

  • A domain whose DNS zone is in Route 53, Cloud DNS or Azure DNS.
  • DNS Automation's access to that zone: on an EKS cluster AstroPulse created, nothing to do; anywhere else, give it access.
  • An ingress reachable from the internet. Let's Encrypt checks each name over HTTP through it.

In the console​

Open the cluster from the cluster list, select the Add-ons tab, and install each add-on with Install Add-on: pick it, set it in the steps, then on Review select Continue to deploy once the dry run passes, and Deploy (Install add-ons):

  1. DNS Automation. Set Domain filter to your zone, for example example.com.

    Open zoom view

    DNS Automation settings with the DNS provider and the domain filter

    DNS Automation settings with the DNS provider and the domain filterDNS Automation settings with the DNS provider and the domain filter

  2. Certificates. Keep Enable cluster issuer on, set Issuer type to Let's Encrypt, and enter the Email.

    Open zoom view

    Certificates settings with the ClusterIssuer on, its type and the ACME contact email

    Certificates settings with the ClusterIssuer on, its type and the ACME contact emailCertificates settings with the ClusterIssuer on, its type and the ACME contact email

  3. Ingress. Install it with its defaults.

Then give the app an Ingress that names the issuer and the hostname. DNS Automation reads host; Certificates reads the cert-manager.io/cluster-issuer annotation and the tls block:

app-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
  annotations:
    cert-manager.io/cluster-issuer: astro-letsencrypt
spec:
  ingressClassName: nginx
  tls:
    - hosts: [app.example.com]
      secretName: my-app-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app
                port:
                  number: 80

You should see​

Within a few minutes of applying the Ingress, app.example.com resolves to the Ingress load balancer, the Secret my-app-tls holds a Let's Encrypt certificate, and https://app.example.com serves it. Check the issuer the add-on reports with astroctl infra k8s addons get <cluster> cert-manager.

How the three fit together​

  • Certificates with a Let's Encrypt issuer and an email creates the ClusterIssuers astro-letsencrypt and astro-letsencrypt-staging. Without a DNS check, Let's Encrypt checks each name over HTTP (HTTP-01), through the Ingress class nginx.
  • DNS Automation writes the record for each Ingress host under its Domain filter, and removes it when the Ingress goes.
  • Ingress serves HTTPS with the certificate in the tls block's Secret, and redirects HTTP to HTTPS.

Security: on an EKS cluster AstroPulse created, DNS Automation and Certificates write to your zone with roles limited to your domains, and no DNS key is stored. Each certificate's private key stays in its Secret in the app's namespace.

Self-signed certificates​

For an internal or test cluster, set Issuer type to Self-signed on Certificates and name astro-selfsigned in the annotation. It needs no email and no public DNS; clients must trust its certificates themselves.

Other ways in​

  • Nova: ask it, for example "set up automatic HTTPS for example.com on eks-prod". It shows each add-on's change and installs them after you approve.
  • SDK and API: the same operations, in the API reference.

With astroctl​

Terminal
astroctl infra k8s addons template eks-prod external-dns > external-dns.yaml
astroctl infra k8s addons template eks-prod cert-manager > cert-manager.yaml
astroctl infra k8s addons template eks-prod nginx-ingress > nginx-ingress.yaml
astroctl infra k8s addons apply -f external-dns.yaml --dry-run
astroctl infra k8s addons apply -f external-dns.yaml

Edit each template, then dry-run and apply each file the same way.

Settings​

This setup has no settings of its own. Each add-on's are on its page: Ingress, DNS Automation, Certificates.

If it's refused​

Each add-on's refusals are on its page: Ingress, DNS Automation, Certificates.

Next​