<p>My goal is :</p>

<ul>
<li>create a pod with Nextcloud</li>
<li>create a service to access this pod</li>
<li>from another machine with nginx route a CNAME to the service</li>
</ul>

<p>I tried to deploy a pod with Nextcloud and a service to access it but actually I can't access it. I have an error :</p>

<blockquote>
  <p>message ERR_SSL_PROTOCOL_ERROR.</p>
</blockquote>

<p>I just followed a <a href="https://www.andremotz.com/nextcloud-docker-on-kubernetes-cluster-ssl-certificates/" rel="nofollow noreferrer">tutorial</a> at the beginning but I didn't want to use nginx like it was explained because I have it on another machine.<br/></p>

<p>When I look at pods (nextcloud + db) and services they look ok but I have no response when I try to access nextcloud.</p>

<p><a href="https://i.stack.imgur.com/Ifigb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Ifigb.png" alt="enter image description here"></a>
(nc = nextcloud)</p>

<p><a href="https://i.stack.imgur.com/xH2lm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xH2lm.png" alt="enter image description here"></a></p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nc
  name: nc
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nc
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: nc
    spec:
      containers:
      - env:
        - name: DEBUG
          value: "false"
        - name: NEXTCLOUD_URL
          value: http://test.fr
        - name: NEXTCLOUD_ADMIN_USER
          value: admin
        - name: NEXTCLOUD_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: nextcloud
              key: NEXTCLOUD_ADMIN_PASSWORD
        - name: NEXTCLOUD_UPLOAD_MAX_FILESIZE
          value: 4G
        - name: NEXTCLOUD_MAX_FILE_UPLOADS
          value: "20"
        - name: MYSQL_DATABASE
          value: nextcloud
        - name: MYSQL_HOST
          value: mariadb
        - name: MYSQL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mariadb
              key: MYSQL_ROOT_PASSWORD
        - name: MYSQL_USER
          value: nextcloud
        name: nc
        image: nextcloud
        ports:
        - containerPort: 80
          protocol: TCP
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /var/www/html
          name: vnextcloud
          subPath: html
        - mountPath: /var/www/html/custom_apps
          name: vnextcloud
          subPath: apps
        - mountPath: /var/www/html/config
          name: vnextcloud
          subPath: config
        - mountPath: /var/www/html/data
          name: vimages
          subPath: imgnc
        - mountPath: /var/www/html/themes
          name: vnextcloud
          subPath: themes
      restartPolicy: Always
      volumes:
        - name: vnextcloud
          persistentVolumeClaim:
            claimName: nfs-pvcnextcloud
        - name: vimages
          persistentVolumeClaim:
            claimName: nfs-pvcimages
</code></pre>

<p>For creating the service I use this command line : </p>

<pre><code>kubectl expose deployment nc --type=NodePort --name=svc-nc --port 80
</code></pre>

<p>And to access my nextcloud I tried the address @IP_MASTER:32500</p>

<p>My questions are: </p>

<ul>
<li><b>How to check if a pod is working well ?</b><br/>to know if the problem is coming from the service or the pod</li>
<li><b>What should I do to have access to my nextcloud ?</b><br/>I didn't do the tuto part "Create self-signed certificates" because I don't know how to manage. Should it be on my other Linux machine or in my Kubernetes Cluster</li>
</ul>

Gobelet
<p><strong>1.</strong> Please consider using stable <a href="https://github.com/helm/charts/tree/master/stable/nextcloud" rel="nofollow noreferrer">nextcloud helm chart</a> </p>

<p><strong>2.</strong> This tutorial is a little outdated and can be found also <a href="https://github.com/andremotz/nextcloud-kubernetes" rel="nofollow noreferrer">here</a></p>

<p>In kubernetes 1.16 release you should change in all your deployments apiVersion to <code>apiVersion: apps/v1</code> please take a look at <a href="https://kubernetes.io/docs/setup/release/notes/#deprecations-and-removals" rel="nofollow noreferrer">Deprecations and Removals</a>.
 In addition you should get an error <code>ValidationError(Deployment.spec): missing required field "selector"</code> so please add selectors in your deployment under  <code>Deployment.spec</code> like:</p>

<pre><code>selector:
  matchLabels:
    app: db
</code></pre>

<p><strong>3.</strong> Finally Create self-signed certificates. this repo is using   <strong>OMGWTFSSL - <a href="https://hub.docker.com/r/paulczar/omgwtfssl/" rel="nofollow noreferrer">Self Signed SSL Certificate Generator</a></strong>. Once you provide necessary information like server name, path to your local <code>hostpath</code> and names for your SSL certificates it will be automatically created after one pod-run under specified <code>hostpath</code>:</p>

<pre><code>volumes:
  - name: certs
    hostPath:
      path: "/home/&lt;someFolderLocation&gt;/certs-pv"
</code></pre>

<ul>
<li>those information should be re-used in the section Nginx reverse Proxy for <code>nginx.conf</code></li>
</ul>

<p><strong>4.</strong> In your nc-svc.yaml you can change the service type to the <strong>type: NodePort</strong></p>

<p><strong>5.</strong> How to verify if your sercie is working properly:</p>

<pre><code>kubectl get pods,svc,ep -o wide

Pods:
pod/nc-6d8694659d-5przx   1/1     Running     0          15m   10.244.0.6 
Svc: 
service/svc-nc       NodePort    10.102.90.88   &lt;none&gt;        80:32500/TCP
Endpoints: 
endpoints/svc-nc       10.244.0.6:80
</code></pre>

<p>You can test your service from inside the cluster running separate pod (f.e. ubuntu)</p>

<pre><code>curl your_svc_name
</code></pre>

<p>you can verify if service discovery is working properly:</p>

<pre><code>cat /etc/resolv.conf
nslokup svc_your_svc_name (your_svc_name.default.svc.cluster.local)
</code></pre>

<p>From outside the cluster using NodePort:</p>

<pre><code>curl NODE_IP:NODE_PORT ( if not please verify your firewall rules)
Once you provided hostname for your nextcloud service you should use
curl -vH 'Host:specified_hostname' http://external_ip/ (using http or https according to your configuration)
</code></pre>

<p>In addition you can exec directly into your db pod </p>

<pre><code>kuebctl exec -it db_pod -- /bin/bash  and run 

mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD
mysqlshow  -uroot -p$MYSQL_ROOT_PASSWORD --status nextcloud
</code></pre>

<p><strong>6.</strong> What should I do to have access to my nextcloud ?
I didn't do the tuto part "Create self-signed certificates" because I don't know how to manage.</p>

<p><strong>7.</strong> As described under point 3. </p>

<p><strong>8.</strong> This part is not clear to me: <code>from another machine with nginx route a CNAME to the service</code></p>

<p>Please refer to: 
An <a href="https://kubernetes.io/docs/concepts/services-networking/service/#externalname" rel="nofollow noreferrer">ExternalName Service</a> is a special case of Service that does not have selectors and uses DNS names instead.</p>

<p>Additional resources:</p>

<ul>
<li>Expose your <a href="https://hackernoon.com/expose-your-kubernetes-service-from-your-own-custom-domains-cc8a1d965fc" rel="nofollow noreferrer">Kubernetes service from your own custom domains</a> </li>
<li>What’s <a href="https://totaluptime.com/kb/whats-the-difference-between-a-cname-and-a-web-redirect/" rel="nofollow noreferrer">the difference between a CNAME and a Web Redirect?</a> </li>
</ul>

<p>Hope this help.</p>
