<p>I am learning the Google Cloud platform, trying to implement my first project and am getting lost in the tutorials. I am stuck at the trying to implement an nginx ingress. My ingress is stuck in CrashLoopBackoff and the logs show the following error.</p>
<p>I know how to do this task with DockerCompose, but not here.</p>
<p>Where do I start?</p>
<pre><code>1#1: cannot load certificate &quot;/etc/letsencrypt/live/blah.com/fullchain.pem&quot;: BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/blah.com/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: [emerg] cannot load certificate &quot;/etc/letsencrypt/live/blah.com/fullchain.pem&quot;: BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/blah.com/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
</code></pre>
<p>I am not yet certain this is helpful, but I have set up the Certificate Authority Service (<a href="https://cloud.google.com/certificate-authority-service/docs/best-practices" rel="nofollow noreferrer">https://cloud.google.com/certificate-authority-service/docs/best-practices</a>).</p>

<p>Instead of using that and following setup of GCP CA setup i would suggest using <a href="https://cert-manager.io/docs/" rel="nofollow noreferrer">cert-manager</a> with the ingress.</p>
<p>Cert-manager will get the <strong>TLS</strong> cert from <strong>let's-encrypt CA</strong> , cert-manager will create the secret into k8s and store verified certificate into a secret.</p>
<p>You can attach secret with the ingress, as per host and use it.</p>
<p><a href="https://cert-manager.io/docs/installation/" rel="nofollow noreferrer">Cert-manager installation</a></p>
<p>YAML example :</p>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: cluster-issuer-name
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: harsh@example.com
    privateKeySecretRef:
      name: secret-name
    solvers:
    - http01:
        ingress:
          class: nginx-class-name
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx-class-name
    cert-manager.io/cluster-issuer: cluster-issuer-name
    nginx.ingress.kubernetes.io/rewrite-target: /
  name: example-ingress
spec:
  rules:
  - host: sub.example.com
    http:
      paths:
      - path: /api
        backend:
          serviceName: service-name
          servicePort: 80
  tls:
  - hosts:
    - sub.example.com
    secretName: secret-name
</code></pre>
<p>You can read this blog for ref : <a href="https://medium.com/@harsh.manvar111/kubernetes-nginx-ingress-and-cert-manager-ssl-setup-c82313703d0d" rel="nofollow noreferrer">https://medium.com/@harsh.manvar111/kubernetes-nginx-ingress-and-cert-manager-ssl-setup-c82313703d0d</a></p>
