<p>I am trying to figure out how I best install SSL on my k8s cluster hosted on Jelastic. I found some nice hints <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">here</a> on how to get cert-manager working on a k8s cluster in general (irrespective of the host provider).</p>

<p>My concern is now that I am not 100% sure whether or not I need letsencrypt or if I could go with the default SSL installation. Looking at the bottom (last paragraph) of <a href="https://github.com/jelastic-jps/lets-encrypt" rel="nofollow noreferrer">this README</a>, I see that I must be able to install it on my cluster. From the Jelastic dashboard, it's not obvious at all that I can do so. The addons icon appears on the Workers and Storage nodes. And through that icon, in both cases, I see no letsencrypt addon.</p>

<p>What's the best practice here? How do I get that up and running? First, the nginx ingress controller installed by default does not meet our security requirements. Second, any subdomain we add to this Jelastic environment does not get provided with the necessary ssl certificates by default. How do I get around this?</p>

Laurent Michel
<p>Let me shed some light on SSLs. You are 100% right that there are at least two options of how SSLs can be handled in Jelastic's K8s.</p>

<p>Briefly:</p>

<p>1) Deploy SSLs to SLB (<a href="https://docs.jelastic.com/api/#!/api/environment.Binder-method-AddSSLCert" rel="nofollow noreferrer">via API</a> or via <a href="https://github.com/jelastic-jps/lets-encrypt" rel="nofollow noreferrer">LE addon</a>). LE addon + SLB combination is now available to <a href="https://jelastic.com/private-cloud/" rel="nofollow noreferrer">Private Cloud</a> customers only (support for <a href="https://jelastic.com/paas-cloud-hosting/" rel="nofollow noreferrer">Public Cloud</a> is coming soon). In this way you can forward your requests to your K8s cluster from SLB using https2http termination (so your ingress controller will be listening http only).</p>

<p>2) Deploy SSL to K8s directly using certification manager. Latest version of <a href="https://github.com/jelastic-jps/kubernetes/tree/v1.16.6" rel="nofollow noreferrer">K8s in Jelastic</a> has support of this. To be able to use this method it is required to attach <a href="https://docs.jelastic.com/public-ip" rel="nofollow noreferrer">Public IPs</a> on all worker nodes (as they have direct listeners of ingress controllers). In this case SSL certificate issuing will be triggered by an ingress rule where dedicated annotation is used. This method is recommended and considered as more secured. Your K8s cluster will accept direct connections on port 443, every exposed service may have dedicated ACME ingress for verification.</p>
