{"action":"created","issue":{"url":"https://api.github.com/repos/containous/traefik/issues/2542","repository_url":"https://api.github.com/repos/containous/traefik","labels_url":"https://api.github.com/repos/containous/traefik/issues/2542/labels{/name}","comments_url":"https://api.github.com/repos/containous/traefik/issues/2542/comments","events_url":"https://api.github.com/repos/containous/traefik/issues/2542/events","html_url":"https://github.com/containous/traefik/issues/2542","id":280256884,"node_id":"MDU6SXNzdWUyODAyNTY4ODQ=","number":2542,"title":"Proposal: Native Kubernetes LetsEncrypt Implementation","user":{"login":"dtomcej","id":6989327,"node_id":"MDQ6VXNlcjY5ODkzMjc=","avatar_url":"https://avatars3.githubusercontent.com/u/6989327?v=4","gravatar_id":"","url":"https://api.github.com/users/dtomcej","html_url":"https://github.com/dtomcej","followers_url":"https://api.github.com/users/dtomcej/followers","following_url":"https://api.github.com/users/dtomcej/following{/other_user}","gists_url":"https://api.github.com/users/dtomcej/gists{/gist_id}","starred_url":"https://api.github.com/users/dtomcej/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dtomcej/subscriptions","organizations_url":"https://api.github.com/users/dtomcej/orgs","repos_url":"https://api.github.com/users/dtomcej/repos","events_url":"https://api.github.com/users/dtomcej/events{/privacy}","received_events_url":"https://api.github.com/users/dtomcej/received_events","type":"User","site_admin":false},"labels":[{"id":587491203,"node_id":"MDU6TGFiZWw1ODc0OTEyMDM=","url":"https://api.github.com/repos/containous/traefik/labels/area/acme","name":"area/acme","color":"bfdadc","default":false},{"id":410567211,"node_id":"MDU6TGFiZWw0MTA1NjcyMTE=","url":"https://api.github.com/repos/containous/traefik/labels/area/provider/k8s","name":"area/provider/k8s","color":"d4c5f9","default":false},{"id":273637091,"node_id":"MDU6TGFiZWwyNzM2MzcwOTE=","url":"https://api.github.com/repos/containous/traefik/labels/kind/proposal","name":"kind/proposal","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":32,"created_at":"2017-12-07T19:51:18Z","updated_at":"2019-01-02T22:04:40Z","closed_at":null,"author_association":"MEMBER","body":"# Proposal\r\n\r\nThis proposal is to discuss the possibility of implementing native Kubernetes LetsEncrypt/ACME support into Traefik.\r\n\r\n## Background\r\n\r\nAt its simplest, Traefik stores LetsEncrypt (LE) data in a json file. Currenly, to provide High Availablity (HA) support for LE, Traefik requires a Key-Value Store (KV) to store the challenge certificates, private keys, and completed certificates. When running in a managed cluster (such as Kubernetes), running an additional KV store incurs a lot of overhead, and doesn't leverage the Kubernetes cluster features. Having ACME data stored in a KV store does not promote re-use, or ease of use.\r\n\r\n## Suggestion\r\n\r\nI propose that Traefik support native Kubernetes storage of LE certs in the Kubernetes API. This should reduce overhead, make it easier for users to properly leverage HA, and allow re-use of the requested certificates. This will also disconnect traefik from the filesystem, which is ideal in a Kubernetes environment.\r\n\r\n## Implementation\r\n\r\nIdeally, we would use native Kubernetes objects to store LE state, and LE data.\r\nI propose that we store the following:\r\n\r\n### Configmap:\r\n* The FQDN/SAN information for the certificates\r\n* The certificate renewal date?\r\n* The public portion of the completed certificate (pubkey)\r\n*  The public portion of the challenge certificate\r\n* Links to the secret containing the correspoinding private keys\r\n* Any other pertinent public data tied to the certificate\r\n\r\n### Secret:\r\n* The private key for the challenge certificate\r\n* The private key for the LE certificate\r\n\r\nThis would allow HA/dynamic introduction of custom (Non-LE) certificates if they follow that template as well.\r\n\r\n### Required changes\r\n\r\n#### ACME\r\n\r\nThe ACME client would need a flag (perhaps `--acme.storage.kubernetes`) to let the client know that it needs to store the cert data using the Kubernetes API.\r\n\r\n#### Kubernetes Provider\r\n\r\nThe Kubernetes provider needs to be updated to handle API updates for configmaps/secrets/and others to handle cluster updates, and certs added from other nodes. We may need to force a cluster update after generating a challenge cert, so that it can be served immediately from another node. The Kubernetes provider would also need to be able to expose the information needed for the ACME client to work properly.\r\n\r\nNote that we might want to allow for an alternate Kubernetes account to access the API, since we will have Traefik creating and destroying data through the API. Some users may want to have more RBAC control over traefik in this case.\r\n"},"comment":{"url":"https://api.github.com/repos/containous/traefik/issues/comments/450999723","html_url":"https://github.com/containous/traefik/issues/2542#issuecomment-450999723","issue_url":"https://api.github.com/repos/containous/traefik/issues/2542","id":450999723,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDk5OTcyMw==","user":{"login":"george-angel","id":1801067,"node_id":"MDQ6VXNlcjE4MDEwNjc=","avatar_url":"https://avatars0.githubusercontent.com/u/1801067?v=4","gravatar_id":"","url":"https://api.github.com/users/george-angel","html_url":"https://github.com/george-angel","followers_url":"https://api.github.com/users/george-angel/followers","following_url":"https://api.github.com/users/george-angel/following{/other_user}","gists_url":"https://api.github.com/users/george-angel/gists{/gist_id}","starred_url":"https://api.github.com/users/george-angel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/george-angel/subscriptions","organizations_url":"https://api.github.com/users/george-angel/orgs","repos_url":"https://api.github.com/users/george-angel/repos","events_url":"https://api.github.com/users/george-angel/events{/privacy}","received_events_url":"https://api.github.com/users/george-angel/received_events","type":"User","site_admin":false},"created_at":"2019-01-02T22:04:40Z","updated_at":"2019-01-02T22:04:40Z","author_association":"NONE","body":"@ReillyProcentive thank you, let me consider that and get back to you. For some reason I was under impression this does not work for us."}}
{"actor":{"display_login":"george-angel"}}