AWS ALB Ingress Service - Enable SSL ¶

Step-01: Introduction ¶

We are going to register a new DNS in AWS Route53
We are going to create a SSL certificate
Add Annotations related to SSL Certificate in Ingress manifest
Deploy the manifests and test
Clean-Up
Refer Presentation from slide 110 onwards

Kubernetes Manifests ¶

01

#01-MySQL-externalName-Service.yml
apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  type: ExternalName
  externalName: usermgmtdb.cxojydmxwly6.us-east-1.rds.amazonaws.com

02

#02-UserManagementMicroservice-Deployment-Service.yml
apiVersion: apps/v1
kind: Deployment 
metadata:
  name: usermgmt-microservice
  labels:
    app: usermgmt-restapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: usermgmt-restapp
  template:  
    metadata:
      labels: 
        app: usermgmt-restapp
    spec:
      initContainers:
        - name: init-db
          image: busybox:1.31
          command: ['sh', '-c', 'echo -e "Checking for the availability of MySQL Server deployment"; while ! nc -z mysql 3306; do sleep 1; printf "-"; done; echo -e "  >> MySQL DB Server has started";']      
      containers:
        - name: usermgmt-restapp
          image: stacksimplify/kube-usermanagement-microservice:1.0.0  
          ports: 
            - containerPort: 8095           
          env:
            - name: DB_HOSTNAME
              value: "mysql"            
            - name: DB_PORT
              value: "3306"            
            - name: DB_NAME
              value: "usermgmt"            
            - name: DB_USERNAME
              value: "dbadmin"        # RDS DB Username is dbadmin     
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-db-password
                  key: db-password           
          livenessProbe:
            exec:
              command: 
                - /bin/sh
                - -c 
                - nc -z localhost 8095
            initialDelaySeconds: 60
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /usermgmt/health-status
              port: 8095
            initialDelaySeconds: 60
            periodSeconds: 10

03

#03-Kubernetes-Secrets.yml
apiVersion: v1
kind: Secret
metadata:
  name: mysql-db-password
type: Opaque
data: 
  db-password: ZGJwYXNzd29yZDEx

04

#04-UserManagement-NodePort-Service.yml
apiVersion: v1
kind: Service
metadata:
  name: usermgmt-restapp-nodeport-service
  labels:
    app: usermgmt-restapp
  annotations:
#Important Note:  Need to add health check path annotations in service level if we are planning to use multiple targets in a load balancer  
    alb.ingress.kubernetes.io/healthcheck-path: /usermgmt/health-status    
spec:
  type: NodePort
  selector:
    app: usermgmt-restapp
  ports:
    - port: 8095
      targetPort: 8095

05

#05-Nginx-App1-Deployment-and-NodePortService.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app1-nginx-deployment
  labels:
    app: app1-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app1-nginx
  template:
    metadata:
      labels:
        app: app1-nginx
    spec:
      containers:
        - name: app1-nginx
          image: stacksimplify/kube-nginxapp1:1.0.0
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: app1-nginx-nodeport-service
  labels:
    app: app1-nginx
  annotations:
#Important Note:  Need to add health check path annotations in service level if we are planning to use multiple targets in a load balancer    
    alb.ingress.kubernetes.io/healthcheck-path: /app1/index.html
spec:
  type: NodePort
  selector:
    app: app1-nginx
  ports:
    - port: 80
      targetPort: 80

06

#06-Nginx-App2-Deployment-and-NodePortService.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app2-nginx-deployment
  labels:
    app: app2-nginx 
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app2-nginx
  template:
    metadata:
      labels:
        app: app2-nginx
    spec:
      containers:
        - name: app2-nginx
          image: stacksimplify/kube-nginxapp2:1.0.0
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: app2-nginx-nodeport-service
  labels:
    app: app2-nginx
  annotations:
#Important Note:  Need to add health check path annotations in service level if we are planning to use multiple targets in a load balancer
    alb.ingress.kubernetes.io/healthcheck-path: /app2/index.html
spec:
  type: NodePort
  selector:
    app: app2-nginx
  ports:
    - port: 80
      targetPort: 80

07

#07-ALB-Ingress-SSL.yml
# Annotations Reference:  https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-usermgmt-restapp-service
  labels:
    app: usermgmt-restapp
  annotations:
    # Ingress Core Settings  
    kubernetes.io/ingress.class: "alb"
    alb.ingress.kubernetes.io/scheme: internet-facing
    # Health Check Settings
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTP 
    alb.ingress.kubernetes.io/healthcheck-port: traffic-port
    #Important Note:  Need to add health check path annotations in service level if we are planning to use multiple targets in a load balancer    
    #alb.ingress.kubernetes.io/healthcheck-path: /usermgmt/health-status
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: '15'
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '5'
    alb.ingress.kubernetes.io/success-codes: '200'
    alb.ingress.kubernetes.io/healthy-threshold-count: '2'
    alb.ingress.kubernetes.io/unhealthy-threshold-count: '2'
    ## SSL Settings
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:180789647333:certificate/9f042b5d-86fd-4fad-96d0-c81c5abc71e1
    #alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-1-2017-01 #Optional (Picks default if not used)    
spec:
  rules:
    #- host: ssldemo.kubeoncloud.com    # SSL Setting (Optional only if we are not using certificate-arn annotation)
    - http:
        paths:
          - path: /app1/*
            backend:
              serviceName: app1-nginx-nodeport-service
              servicePort: 80                        
          - path: /app2/*
            backend:
              serviceName: app2-nginx-nodeport-service
              servicePort: 80            
          - path: /*
            backend:
              serviceName: usermgmt-restapp-nodeport-service
              servicePort: 8095              
# Important Note-1: In path based routing order is very important, if we are going to use  "/*", try to use it at the end of all rules.

Step-02: Pre-requisite - Register a Domain in Route53 (if not exists) ¶

Goto Services -> Route53 -> Registered Domains
Click on Register Domain
Provide desired domain: somedomain.com and click on check (In my case its going to be kubeoncloud.com)
Click on Add to cart and click on Continue
Provide your Contact Details and click on Continue
Enable Automatic Renewal
Accept Terms and Conditions
Click on Complete Order

Step-03: Create a SSL Certificate in Certificate Manager ¶

Pre-requisite: You should have a registered domain in Route53
Go to Services -> Certificate Manager -> Create a Certificate
Click on Request a Certificate
Choose the type of certificate for ACM to provide: Request a public certificate
Add domain names: *.yourdomain.com (in my case it is going to be *.kubeoncloud.com)
Select a Validation Method: DNS Validation
Click on Confirm & Request
Validation
Click on Create record in Route 53
Wait for 5 to 10 minutes and check the Validation Status

Best Selling AWS EKS Kubernetes Course on Udemy ¶

Absolute practical scenarios required for real-time implementations
18 AWS Services covered in combination with AWS EKS
31 Kubernetes Concepts covered in combination with AWS EKS & AWS Services
Step by Step Documentation on Github and Website
18 Docker Images available on Docker Hub for implementing practical scenarios

Start Learning Now!

07-ALB-Ingress-SSL.yml

# SSL Setting - 1
    ## SSL Settings
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:411686525067:certificate/8adf7812-a1af-4eae-af1b-ea425a238a67
    #alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-1-2017-01 #Optional (Picks default if not used)    
# SSL Setting - 2
spec:
  rules:
    #- host: kubedemo.stacksimplify.com    # SSL Setting (Optional only if we are not using certificate-arn annotation)

Step-05: Deploy all manifests and test ¶

Deploy
```
kubectl apply -f kube-manifests/
```
Verify
- Load Balancer - Listeneres (Verify both 80 & 443)
- Load Balancer - Rules (Verify both 80 & 443 listeners)
- Target Groups - Group Details (Verify Health check path)
- Target Groups - Targets (Verify all 3 targets are healthy)
- Verify ingress controller from kubectl
```
kubectl get ingress 
```

Step-06: Add DNS in Route53 ¶

Go to Services -> Route 53
Go to Hosted Zones
Click on yourdomain.com (in my case stacksimplify.com)
Create a Record Set
Name: ssldemo.kubeoncloud.com
Alias: yes
Alias Target: Copy our ALB DNS Name here (Sample: 55dc0e80-default-ingressus-ea9e-551932098.us-east-1.elb.amazonaws.com)
Click on Create

Step-07: Access Application using newly registered DNS Name ¶

Access Application

Important Note: Instead of kubeoncloud.com you need to replace with your registered Route53 domain (Refer pre-requisite Step-02)

# HTTP URLs
http://ssldemo.kubeoncloud.com/app1/index.html
http://ssldemo.kubeoncloud.com/app2/index.html
http://ssldemo.kubeoncloud.com/usermgmt/health-status

# HTTPS URLs
https://ssldemo.kubeoncloud.com/app1/index.html
https://ssldemo.kubeoncloud.com/app2/index.html
https://ssldemo.kubeoncloud.com/usermgmt/health-status

AWS ALB Ingress Service - Enable SSL ¶

Step-01: Introduction ¶

Kubernetes Manifests ¶

Step-02: Pre-requisite - Register a Domain in Route53 (if not exists) ¶

Step-03: Create a SSL Certificate in Certificate Manager ¶

Best Selling AWS EKS Kubernetes Course on Udemy ¶

Step-05: Deploy all manifests and test ¶

Step-06: Add DNS in Route53 ¶

Step-07: Access Application using newly registered DNS Name ¶

How ALB Ingress Controller Works? ¶

AWS ALB Ingress Installation ¶

AWS ALB Ingress Implementation Basics ¶

Free Courses ¶

AWS ALB Ingress Service - Enable SSL ¶

Step-01: Introduction ¶

Kubernetes Manifests ¶

Step-02: Pre-requisite - Register a Domain in Route53 (if not exists) ¶

Step-03: Create a SSL Certificate in Certificate Manager ¶

Best Selling AWS EKS Kubernetes Course on Udemy ¶

Step-04: Add annotations related to SSL ¶

Step-05: Deploy all manifests and test ¶

Step-06: Add DNS in Route53 ¶

Step-07: Access Application using newly registered DNS Name ¶

How ALB Ingress Controller Works? ¶

AWS ALB Ingress Installation ¶

AWS ALB Ingress Implementation Basics ¶

Free Courses ¶