Enabling TLS on AKS
eShopOnContainers supports the use of TLS for enabling https on ingress endpoints. You can provide your own TLS certificate or let the system auto-generate one certificate using Let's encrypt.
Auto Generating certificates using Let's Encrypt
Using cert-manager is possible to auto retrieve a TLS certificate generate by Let's Encrypt.
Installing cert-manager on the cluster
You must install cert-manager in the cluster. This is an administrative action, needed to be performed only once.
The script /deploy/k8s/enable-tls.ps1 installs cert-manager on the current cluster. The script uses kubectl to install the cert-manager version 0.11.0 (the minimum required by eShopOnContainers) in the cluster. By default cert-manager is installed on the current kubectl context, but you can use the parameters aksRg and aksName to set a specific AKS to use.
.\enable-tls.ps1 -aksName eshopmesh -aksRg eshop-mesh
Deploying the cert-manager issuer
Once cert-manager is installed on the cluster you have to install the issuer that will be used to generate the certificates. There are two issuers provided:
- Let's Encrypt staging server
- Let's Encrypt production server
Staging server do not generate valid TLS certificates, but allows you to test the whole process is valid. Let's Encrypt has severe ratio calls on its production server to avoid abuses. Let's Encrypt staging server uses the "Fake LE Intermediate X1" CA to sign the certificates.
To deploy the selected issuer (you can deploy both) use helm to install the chart tls-support and pass the file values-staging.yaml or values-prod.yaml. For example, following command (run from /deploy/k8s/helm folder) will install the Let's Encrypt staging issuer:
helm install .\tls-support -f .\tls-support\values-staging.yaml -n tls-staging
Note: You can retrieve the installed issuers using kubectl get issuers command.
Using an ingress controller other than Http Application Routing
If you are using other ingress controller rather than Http Application Routing, you must edit the issuer values file (values-staging.yaml or values-prod.yaml) and set the value of ingressClass accordingly before installing the issuer.
Deploying using deploy-all.ps1
To deploy eShopOnContainers to use Let's Encrypt, just add following parameter to deploy-all.ps1 script:
sslSupport: Set toprodorstagingdepending the issuer you want to use.
You must set a DNS when using TLS (set exteralDns to aks to infer the Http Application Routing DNS).
Deploy with a custom certificate
If deploying with a custom certificate, you don't need to install cert-manager nor any issuer. You must:
- Install the TLS certificate as a Kubernetes secret using
kubectl create secret tls.
Once the secret is installed you can install eShopOnContainers adding following parameters to deploy-all.ps1:
sslSupportset tocustomtlsSecretNamewith the name of the Kubernetes secret that contains the TLS certificate (defaults toeshop-tls-custom).
Notes on TLS support
TLS support can't be enabled on the local Kubernetes provided by Docker Desktop.