<p>I have a local Kubernetes cluster on a single machine, and I successfully deployed a flask web app using apache server, so there shouldn't be any problem with the cluster setup. However, I need to upgrade the website to https, so I used <code>letsencrypt</code> to generate ssl certificates and volume mapped them into the container. I also successfully deployed the app without docker, i.e. directly start the apache server using <code>sudo /usr/sbin/apache2ctl -D FOREGROUND</code>. I can visit my website at <code>https://XXX.XXX.XXX.edu</code> without problem. </p>

<p>However, when I started putting everything into Docker and Kubernetes, and visited <code>https://XXX.XXX.XXX.edu:30001</code>, the browser gave me this error:</p>

<pre><code>This site can’t be reached

XXX.XXX.XXX.edu took too long to respond
</code></pre>

<p>Here is how I deployed:</p>

<p>I first started the service <code>kubectl create -f web-service.yaml</code>:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: web
  labels:
    name: web
    role: "ssl-proxy"
spec:
  type: NodePort
  ports:
    - nodePort: 30001
      name: "https"
      port: 443
      targetPort: 443
      protocol: "TCP"
    - nodePort: 30000
      name: "http"
      port: 80
      targetPort: 80
      protocol: "TCP"
  selector:
    name: web
    role: "ssl-proxy"
</code></pre>

<p>Then I started the pod <code>kubectl create -f web-controller.yaml</code>:</p>

<pre><code>apiVersion: v1
kind: ReplicationController
metadata:
  labels:
    name: web
  name: web-controller
spec:
  replicas: 1
  selector:
    name: web
  template:
    metadata:
      labels:
        name: web
    spec:
      containers:
      - image: XXX/web_app
        command: ['/bin/sh', '-c']
        args: ['sudo a2enmod ssl &amp;&amp; service apache2 restart &amp;&amp; sudo /usr/sbin/apache2ctl -D FOREGROUND &amp;&amp; python fake.py']
        name: web
        ports:
        - containerPort: 443
          name: http-server
        volumeMounts:
          - mountPath: /etc/letsencrypt/live/host
            name: test-volume
            readOnly: false
      volumes:
        - hostPath:
            path: /etc/letsencrypt/archive/XXX.XXX.XXX.edu
          name: test-volume
</code></pre>

<p>The log of the pod looks like:</p>

<pre><code>root@XXX:~# kubectl logs web-controller-ontne
Considering dependency setenvif for ssl:
Module setenvif already enabled
Considering dependency mime for ssl:
Module mime already enabled
Considering dependency socache_shmcb for ssl:
Module socache_shmcb already enabled
Module ssl already enabled
 * Restarting web server apache2
[Mon Jun 27 14:34:48.753153 2016] [so:warn] [pid 30:tid 140046645868416] AH01574: module ssl_module is already loaded, skipping
   ...done.
[Mon Jun 27 14:34:49.820047 2016] [so:warn] [pid 119:tid 139909591328640] AH01574: module ssl_module is already loaded, skipping
httpd (pid 33) already running
root@XXX:~# 
</code></pre>

<p>The pod is running, but I got the following apache error log:</p>

<pre><code>[Mon Jun 27 17:13:50.912683 2016] [ssl:warn] [pid 33:tid 140513871427456] AH01909: RSA certificate configured for 0.0.0.0i:443 does NOT include an ID which matches the server name
</code></pre>

<p>I think the problem is that, I am using NodePort and exposing port 30001, so I have to visit <code>https://XXX.XXX.XXX.edu:30001</code> which does not match <code>XXX.XXX.XXX.edu</code> (just the domain name without the arbitrary port number 30001). </p>

<p>This is my <code>/etc/apache2/sites-available/000-default.conf</code> in the docker container:</p>

<pre><code>&lt;VirtualHost _default_:30001&gt;
    DocumentRoot /usr/local/my_app

    LoadModule ssl_module /usr/lib64/apache2-prefork/mod_ssl.so
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/host/cert1.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/host/privkey1.pem
    SSLCertificateChainFile /etc/letsencrypt/live/host/chain1.pem

    WSGIDaemonProcess python-app user=www-data group=www-data threads=15 maximum-requests=10000 python-path=/usr/local/lib/python2.7/dist-p
ackages
    WSGIScriptAlias / /usr/local/my_app/apache/apache.wsgi
    WSGIProcessGroup python-app

    CustomLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/access.log.%Y%m%d-%H%M%S 5M" combined
    ErrorLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/error.log.%Y%m%d-%H%M%S 5M"
    LogLevel warn

    &lt;Directory /usr/local/my_app&gt;
        Order deny,allow
        Allow from all
        Require all granted
    &lt;/Directory&gt;

&lt;/VirtualHost&gt;
</code></pre>

<p>How to modify it so that apache serves https requests at port 30001 rather than 443? Thank you very much!</p>

<p>I found the answer myself. 2 causes: (1) There is an environment variable specific to my web app that I forgot to set in <code>apache.wsgi</code>; (2) There are several small errors in the original apache configuration file. I post the working <code>/etc/apache2/sites-available/000-default.conf</code> here:</p>

<pre><code>ServerName 0.0.0.0

&lt;VirtualHost _default_:443&gt;
    DocumentRoot /usr/local/my_app

    LoadModule ssl_module /usr/lib64/apache2-prefork/mod_ssl.so
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/host/cert1.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/host/privkey1.pem
    SSLCertificateChainFile /etc/letsencrypt/live/host/chain1.pem

    WSGIDaemonProcess python-app user=www-data group=www-data threads=15 maximum-requests=10000 python-path=/usr/local/lib/python2.7/dist-packages
    WSGIScriptAlias / /usr/local/my_app/apache/apache.wsgi
    WSGIProcessGroup python-app

    CustomLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/access.log.%Y%m%d-%H%M%S 5M" combined
    ErrorLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/error.log.%Y%m%d-%H%M%S 5M"
    LogLevel warn

    &lt;Directory /usr/local/my_app&gt;
        Order deny,allow
        Allow from all
        Require all granted
    &lt;/Directory&gt;
&lt;/VirtualHost&gt;
</code></pre>

<p>Start the pod with commands <code>sudo a2enmod ssl &amp;&amp; sudo /usr/sbin/apache2ctl -D FOREGROUND</code>, and <code>containerPort</code> should be 443. The Kubernetes script for the service is as simple as follows:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: web
  labels:
    name: web
spec:
  type: NodePort
  ports:
    - nodePort: 30001
      port: 443
      targetPort: 443
      protocol: TCP
  selector:
    name: web
</code></pre>

<p>Now I can visit my web site at <code>https://XXX.XXX.XXX.XXX:30001</code>.</p>

<p>Special thanks to the owner of <a href="https://github.com/muneeb-ali/apache-flask" rel="nofollow">this github repo</a> and NorbertvanNobelen. Hope this helps!</p>
