<p>I am working with cert-manager in my kubernetes cluster, in order to get certificates signed by let'sencrypt CA to my service application inside my cluster.</p>

<p><strong>1. Create a <code>cert-manager</code> namespace</strong></p>

<pre><code>⟩ kubectl create namespace cert-manager
namespace/cert-manager created
</code></pre>

<p><strong>2. I've created the CRDs that helm need to implement the CA and certificates functionality.</strong></p>

<pre><code>⟩ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.7/deploy/manifests/00-crds.yaml

customresourcedefinition.apiextensions.k8s.io/certificates.certmanager.k8s.io created
customresourcedefinition.apiextensions.k8s.io/challenges.certmanager.k8s.io created
customresourcedefinition.apiextensions.k8s.io/clusterissuers.certmanager.k8s.io created
customresourcedefinition.apiextensions.k8s.io/issuers.certmanager.k8s.io created
customresourcedefinition.apiextensions.k8s.io/orders.certmanager.k8s.io created
[I] 
⟩ 
</code></pre>

<p><strong>3. Disable resource validation on the cert-manager namespace</strong> </p>

<pre><code>⟩ kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true 
namespace/cert-manager labeled
[I] 
</code></pre>

<p><strong>4. Add the Jetstack Helm repository and update the local cache</strong></p>

<pre><code>⟩ helm repo add jetstack https://charts.jetstack.io 
"jetstack" has been added to your repositories
[I] 
~
⟩ 

⟩ helm repo update
Hang tight while we grab the latest from your chart repositories...
...Skip local chart repository
...Successfully got an update from the "jetstack" chart repository
...Successfully got an update from the "stable" chart repository
Update Complete. ⎈ Happy Helming!⎈ 
[I] 
</code></pre>

<p><strong>5. I've installed cert-manager inside my k8s cluster using helm:</strong></p>

<pre><code>     helm install \ 
    --name cert-manager \ 
    --namespace cert-manager \ 
    --version v0.7.0 \ 
    jetstack/cert-manager 

</code></pre>

<p><strong>6. I've created an ACME Issuer including <code>http challenger provider</code></strong> to obtained by performing challenge validations against an ACME server such as Let’s Encrypt.   </p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer 
metadata:
  name: letsencrypt-staging
spec:
 acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: b.garcia@possibilit.nl
    privateKeySecretRef:
      name: letsencrypt-staging 
    # Enable the HTTP-01 challenge provider
    http01: {}
</code></pre>

<ul>
<li>Apply in the same namespace (default) in where is located my service application which I want to get the certificates.</li>
</ul>

<pre><code>⟩ kubectl apply -f 01-lets-encrypt-issuer-staging.yaml  
issuer.certmanager.k8s.io/letsencrypt-staging created 

⟩ kubectl get issuer --namespace default 

NAME                  AGE 

letsencrypt-staging   22s 

</code></pre>

<ul>
<li>This have the following description: We can see that <code>the ACME account was registered with the ACME</code> and the <code>Status</code> is <code>True</code> and <code>Ready</code></li>
</ul>

<pre><code>⟩ kubectl describe issuer letsencrypt-staging --namespace default 

Name:         letsencrypt-staging 
Namespace:    default 
Labels:       &lt;none&gt; 
Annotations:  kubectl.kubernetes.io/last-applied-configuration: 

                {"apiVersion":"certmanager.k8s.io/v1alpha1","kind":"Issuer","metadata":{"annotations":{},"name":"letsencrypt-staging","namespace":"default... 

API Version:  certmanager.k8s.io/v1alpha1 
Kind:         Issuer 
Metadata: 
  Creation Timestamp:  2019-03-13T10:12:01Z 
  Generation:          1 
  Resource Version:    247916 
  Self Link:           /apis/certmanager.k8s.io/v1alpha1/namespaces/default/issuers/letsencrypt-staging 

  UID:                 7170a66e-4578-11e9-b6d4-2aeecf80bb69 

Spec: 
  Acme: 
    Email:  b.garcia@myemail.com 
    Http 01: 
    Private Key Secret Ref: 
      Name:  letsencrypt-staging 
    Server:  https://acme-staging-v02.api.letsencrypt.org/directory 
Status: 
  Acme: 
    Uri:  https://acme-staging-v02.api.letsencrypt.org/acme/acct/8550675 
  Conditions: 
    Last Transition Time:  2019-03-13T10:12:02Z 

    Message:               The ACME account was registered with the ACME server 

    Reason:                ACMEAccountRegistered 
    Status:                True 
    Type:                  Ready 

Events:                    &lt;none&gt; 

</code></pre>

<p><strong>7. I've created the certificate in the same namespace in where the Issuer was created (default) and referencing it:</strong></p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: zcrm365-lets-encrypt-staging
  #namespace: default 
spec:
  secretName: zcrm365-lets-encrypt-staging-tls 
  issuerRef:
    name: letsencrypt-staging
  commonName: test1kongletsencrypt.possibilit.nl

  # http01 challenge
  acme:
    config:
    - http01:
        ingressClass: nginx
        # ingress: nginx # kong-ingress-controller # nginx

      domains:
      - test1kongletsencrypt.possibilit.nl 

</code></pre>

<ul>
<li>Apply the certificate</li>
</ul>

<pre><code>⟩ kubectl apply -f 02-certificate-staging.yaml  
certificate.certmanager.k8s.io/zcrm365-lets-encrypt-staging created 
</code></pre>

<ul>
<li>I execute the  <code>kubectl describe certificate zcrm365-lets-encrypt-staging</code> and I can see, the following:</li>
</ul>

<pre><code>⟩ kubectl describe certificate zcrm365-lets-encrypt-staging 
Name:         zcrm365-lets-encrypt-staging
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"certmanager.k8s.io/v1alpha1","kind":"Certificate","metadata":{"annotations":{},"name":"zcrm365-lets-encrypt-staging","names...
API Version:  certmanager.k8s.io/v1alpha1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2019-03-13T19:32:25Z
  Generation:          1
  Resource Version:    321283
  Self Link:           /apis/certmanager.k8s.io/v1alpha1/namespaces/default/certificates/zcrm365-lets-encrypt-staging
  UID:                 bad7f778-45c6-11e9-b6d4-2aeecf80bb69
Spec:
  Acme:
    Config:
      Domains:
        test1kongletsencrypt.possibilit.nl
      Http 01:
        Ingress Class:  nginx
  Common Name:          test1kongletsencrypt.possibilit.nl
  Issuer Ref:
    Name:       letsencrypt-staging
  Secret Name:  zcrm365-lets-encrypt-staging-tls
Status:
  Conditions:
    Last Transition Time:  2019-03-13T19:32:25Z
    Message:               Certificate issuance in progress. Temporary certificate issued.
    Reason:                TemporaryCertificate
    Status:                False
    Type:                  Ready
Events:                    &lt;none&gt;
</code></pre>

<p>We can see that the <code>Status</code> is <code>False</code> and the certificate issuance is temporary.</p>

<ul>
<li>This certificate, create a secret named <code>zcrm365-lets-encrypt-staging-tls</code> which have my private key pair <code>tls.crt</code> and <code>tls.key</code></li>
</ul>

<pre><code>⟩ kubectl describe secrets zcrm365-lets-encrypt-staging-tls 

Name:         zcrm365-lets-encrypt-staging-tls 
Namespace:    default 
Labels:       certmanager.k8s.io/certificate-name=zcrm365-lets-encrypt-staging 

Annotations:  certmanager.k8s.io/alt-names: test1kongletsencrypt.possibilit.nl 
              certmanager.k8s.io/common-name: test1kongletsencrypt.possibilit.nl 
              certmanager.k8s.io/ip-sans:  
              certmanager.k8s.io/issuer-kind: Issuer 
              certmanager.k8s.io/issuer-name: letsencrypt-staging 
Type:  kubernetes.io/tls
Data 
==== 
ca.crt:   0 bytes 
tls.crt:  1029 bytes 
tls.key:  1679 bytes
</code></pre>

<p><strong>8. Creating the ingress to my service application</strong></p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kong-ingress-zcrm365
  namespace: default
  annotations:
    # kubernetes.io/ingress.class: "nginx" 
    certmanager.k8s.io/issuer: "letsencrypt-staging"
    certmanager.k8s.io/acme-challenge-type: http01
    # certmanager.k8s.io/acme-http01-ingress-class: "true" 

    # kubernetes.io/tls-acme: true
    # this annotation requires additional configuration of the 
    # ingress-shim (see above). Namely, a default issuer must 
    # be specified as arguments to the ingress-shim container.
spec:
  rules: 
  - host: test1kongletsencrypt.possibilit.nl
    http:
      paths:
      - backend:
          serviceName: zcrm365dev
          servicePort: 80
        path: / 
  tls: 
  - hosts: 
    - test1kongletsencrypt.possibilit.nl
    secretName: zcrm365-lets-encrypt-staging-tls 
</code></pre>

<ul>
<li>Apply the ingress </li>
</ul>

<pre><code>⟩ kubectl apply -f 03-zcrm365-ingress.yaml  
ingress.extensions/kong-ingress-zcrm365 created 
</code></pre>

<ul>
<li>I can see our ingress</li>
</ul>

<pre><code>⟩ kubectl get ingress -n default
NAME                        HOSTS                                ADDRESS         PORTS     AGE
cm-acme-http-solver-2m6gl   test1kongletsencrypt.possibilit.nl                   80        3h3m
kong-ingress-zcrm365        test1kongletsencrypt.possibilit.nl   52.166.60.158   80, 443   3h3m
[I] 
</code></pre>

<p>The detail of my ingress is the following:</p>

<pre><code>⟩ kubectl describe ingress cm-acme-http-solver-2m6gl
Name:             cm-acme-http-solver-2m6gl
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (&lt;none&gt;)
Rules:
  Host                                Path  Backends
  ----                                ----  --------
  test1kongletsencrypt.possibilit.nl  
                                      /.well-known/acme-challenge/br0Y8eEsuZ5C2fKoeNVL2y03wn1ZHOQwKQCOOkyWabE   cm-acme-http-solver-9cwhm:8089 (&lt;none&gt;)
Annotations:
  kubernetes.io/ingress.class:                         nginx
  nginx.ingress.kubernetes.io/whitelist-source-range:  0.0.0.0/0
Events:                                                &lt;none&gt;
[I] 
~/workspace/ZCRM365/Deployments/Kubernetes/cert-manager · (Deployments)

---

⟩ kubectl describe ingress kong-ingress-zcrm365
Name:             kong-ingress-zcrm365
Namespace:        default
Address:          52.166.60.158
Default backend:  default-http-backend:80 (&lt;none&gt;)
TLS:
  zcrm365-lets-encrypt-staging-tls terminates test1kongletsencrypt.possibilit.nl
Rules:
  Host                                Path  Backends
  ----                                ----  --------
  test1kongletsencrypt.possibilit.nl  
                                      /   zcrm365dev:80 (&lt;none&gt;)
Annotations:
  certmanager.k8s.io/acme-challenge-type:            http01
  certmanager.k8s.io/issuer:                         letsencrypt-staging
  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"certmanager.k8s.io/acme-challenge-type":"http01","certmanager.k8s.io/issuer":"letsencrypt-staging"},"name":"kong-ingress-zcrm365","namespace":"default"},"spec":{"rules":[{"host":"test1kongletsencrypt.possibilit.nl","http":{"paths":[{"backend":{"serviceName":"zcrm365dev","servicePort":80},"path":"/"}]}}],"tls":[{"hosts":["test1kongletsencrypt.possibilit.nl"],"secretName":"zcrm365-lets-encrypt-staging-tls"}]}}

Events:  &lt;none&gt;

</code></pre>

<p>When I perform all this, I can see that my application service is exposed via  <code>kong-ingress-zcrm365</code> ingress, because is reached with my  test1kongletsencrypt.possibilit.nl domain.</p>

<p>But as you can see, I don't get the <code>https</code> certificate to my service. The <code>https</code> is an insecure connection</p>

<ul>
<li>I've checked the logs of my cert-manager pod and I have the following: </li>
</ul>

<pre><code>kubectl logs pod/cert-manager-6f68b58796-hlszm -n cert-manager

I0313 19:40:39.254765       1 controller.go:206] challenges controller: syncing item 'default/zcrm365-lets-encrypt-staging-298918015-0'
    I0313 19:40:39.254869       1 logger.go:103] Calling Discover
    I0313 19:40:39.257720       1 pod.go:89] Found pod "default/cm-acme-http-solver-s6s2n" with acme-order-url annotation set to that of Certificate "default/zcrm365-lets-encrypt-staging-298918015-0"but it is not owned by the Certificate resource, so skipping it.
    I0313 19:40:39.257735       1 pod.go:64] No existing HTTP01 challenge solver pod found for Certificate "default/zcrm365-lets-encrypt-staging-298918015-0". One will be created.
    I0313 19:40:39.286823       1 service.go:51] No existing HTTP01 challenge solver service found for Certificate "default/zcrm365-lets-encrypt-staging-298918015-0". One will be created.
    I0313 19:40:39.347204       1 ingress.go:49] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=4095675862,certmanager.k8s.io/acme-http-token=919604798
    I0313 19:40:39.347437       1 ingress.go:98] No existing HTTP01 challenge solver ingress found for Challenge "default/zcrm365-lets-encrypt-staging-298918015-0". One will be created.
    I0313 19:40:39.362118       1 controller.go:178] ingress-shim controller: syncing item 'default/cm-acme-http-solver-2m6gl'
    I0313 19:40:39.362257       1 sync.go:64] Not syncing ingress default/cm-acme-http-solver-2m6gl as it does not contain necessary annotations
    I0313 19:40:39.362958       1 controller.go:184] ingress-shim controller: Finished processing work item "default/cm-acme-http-solver-2m6gl"
    I0313 19:40:39.362702       1 pod.go:89] Found pod "default/cm-acme-http-solver-s6s2n" with acme-order-url annotation set to that of Certificate "default/zcrm365-lets-encrypt-staging-298918015-0"but it is not owned by the Certificate resource, so skipping it.
    I0313 19:40:39.363270       1 ingress.go:49] Looking up Ingresses for selector certmanager.k8s.io/acme-http-domain=4095675862,certmanager.k8s.io/acme-http-token=919604798
    I0313 19:40:46.279269       1 controller.go:206] challenges controller: syncing item 'default/zcrm365-lets-encrypt-staging-tls-1561329142-0'
    E0313 19:40:46.279324       1 controller.go:230] ch 'default/zcrm365-lets-encrypt-staging-tls-1561329142-0' in work queue no longer exists
    I0313 19:40:46.279332       1 controller.go:212] challenges controller: Finished processing work item "default/zcrm365-lets-encrypt-staging-tls-1561329142-0"
    [I] 
</code></pre>

<p>I think that the <strong>http challenge process is not performed</strong>, because let'sencrypt not trust in that I am the owner of the <a href="https://test1kongletsencrypt.possibilit.nl/index.html" rel="nofollow noreferrer">https://test1kongletsencrypt.possibilit.nl/index.html</a> domain.</p>

<p>How to can I solve this in order to get TLS with letsencrypt?
Is possible that do I need to use <code>ingress-shim</code> functionality in my helm cert-manager and/or <code>WebhookValidation</code> ?</p>

<hr>

<p><strong>IMPORTANT UPDATE</strong></p>

<p>I am currently using <a href="https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/deployment/aks.md" rel="nofollow noreferrer">kong-ingress-controller</a> like ingress to my deployment. </p>

<p><a href="https://gist.github.com/bgarcial/494b006fced3ac6ee1608e5237144810#file-kongwithingress-yaml-L436" rel="nofollow noreferrer">I've installed of this way in this gist</a>. </p>

<p>But I am not sure of how to can I integrate my <code>kong-ingress-controller</code> to work with cert-manager when I am creating my <code>zcrm365-lets-encrypt-staging</code> certificate signing request.</p>

<p>This is my current view of my kong resources</p>

<pre><code>⟩ kubectl get all -n kong 
NAME                                           READY   STATUS      RESTARTS   AGE
pod/kong-7f66b99bb5-ldp4v                      1/1     Running     0          2d16h
pod/kong-ingress-controller-667b4748d4-sptxm   1/2     Running     782        2d16h
pod/kong-migrations-h6qt2                      0/1     Completed   0          2d16h
pod/konga-85b66cffff-6k6lt                     1/1     Running     0          41h

NAME                              TYPE           CLUSTER-IP    EXTERNAL-IP     PORT(S)                      AGE
service/kong-ingress-controller   NodePort       10.0.48.131   &lt;none&gt;          8001:32257/TCP               2d16h
service/kong-proxy                LoadBalancer   10.0.153.8    52.166.60.158   80:31577/TCP,443:32323/TCP   2d16h

NAME                                      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/kong                      1         1         1            1           2d16h
deployment.apps/kong-ingress-controller   1         1         1            0           2d16h
deployment.apps/konga                     1         1         1            1           41h

NAME                                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/kong-7f66b99bb5                      1         1         1       2d16h
replicaset.apps/kong-ingress-controller-667b4748d4   1         1         0       2d16h
replicaset.apps/konga-85b66cffff                     1         1         1       41h

NAME                        COMPLETIONS   DURATION   AGE
job.batch/kong-migrations   1/1           86s        2d16h
</code></pre>

<p>The service <code>service/kong-proxy</code> provide me the external or public IP and when I create the <code>kong-ingress-zcrm365</code>, this ingress take that external IP address provided by kong-proxy. But of course in the ingress I am indicating that use nginx and not kong-ingress-controller.</p>

<p>And by the way I don't have installed nginx ingress controller, I am a little confuse here. </p>

<p>If someone can point me in the correct address, their help will be highly appreciated.</p>

bgarcial
<pre><code>First check if using nginx ingress then nginx ingress controller is tunning
</code></pre>

<p>you are right track but have to added the ingress controller for ingress? if you are using the nginx ingress you have to add the controller in the K8s cluster.</p>

<p>your way and approach is perfect cert-manager and everything. here sharing the link of one tutorial check it out it is from digital ocean :</p>

<p>this link is same approch as you following just compare steps </p>

<blockquote>
  <p><a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</a></p>
</blockquote>

<p>if any issue drop comment for more</p>
