Using kubernetes certmanager.k8s.io with metallb.io

Question

Pulumi · Accepted Answer

To use `cert-manager` with Kubernetes and MetalLB, you'll first need to set up `cert-manager` to handle TLS certificates for your services, and then use MetalLB to expose those services externally with a load balancer. `cert-manager` is a Kubernetes add-on to automate the management and issuance of TLS certificates, and MetalLB provides a network load balancer implementation for clusters that do not run on a cloud provider, thus it gives you a LoadBalancer type of service in your Kubernetes cluster.

Here's how you could set everything up using Pulumi:

1. **Install MetalLB:** Before you install `cert-manager`, setting up MetalLB allows you to use LoadBalancer type Services on your cluster.
2. **Install Cert-Manager:** Install `cert-manager` to your cluster. This will involve creating several Kubernetes resources.
3. **Configure Issuer or ClusterIssuer:** These are Kubernetes resources that represent certificate authorities. They can issue and renew certificates when they are requested by `cert-manager` Certificate resources.
4. **Create a Certificate:** This is a `cert-manager` custom resource that specifies details about the certificate you want to obtain.

Let's outline a Pulumi program in TypeScript:

```typescript
import * as k8s from "@pulumi/kubernetes";

// Your Pulumi program will assume that you have a pre-existing Kubernetes cluster defined in your Pulumi stack.

// 1. Install MetalLB
// This typically involves applying MetalLB's manifest to your cluster. However, Pulumi does not have a dedicated library for MetalLB,
// so we'll use k8s.yaml.ConfigGroup to apply the manifest:

const metalLb = new k8s.yaml.ConfigGroup("metallb", {
    files: ["https://raw.githubusercontent.com/metallb/metallb/v0.9.3/manifests/metallb.yaml"],
});

// Make sure to replace the URL with the latest version from MetalLB's official repository.

// If your cluster requires you to configure IP address pools for MetalLB, you'll have to update its ConfigMap accordingly.
// Check the MetalLB documentation on how to set up this configuration.

// 2. Install Cert-Manager
// We use Pulumi's resource for installing helm charts to deploy cert-manager:

const certManager = new k8s.helm.v3.Chart("cert-manager", {
    repo: "jetstack",
    chart: "cert-manager",
    version: "v1.0.3",
    namespace: "cert-manager",
    fetchOpts:{
        repo: "https://charts.jetstack.io",
    },
    values: {
        installCRDs: true,
    },
});

// Make sure the `version` value is replaced with the one you wish to install.
// The `installCRDs` flag instructs cert-manager to install the Kubernetes custom resources it defines.

// 3. Configure Issuer or ClusterIssuer
// For this example, we'll create a self-signed ClusterIssuer for demonstration purposes:

const tlsIssuer = new k8s.apiextensions.CustomResource("tls-issuer", {
    apiVersion: "cert-manager.io/v1alpha2",
    kind: "ClusterIssuer",
    metadata: {
        name: "selfsigned-issuer",
    },
    spec: {
        selfSigned: {},
    },
}, { dependsOn: [certManager] }); // This dependency ensures that cert-manager is installed before creating the Issuer.

// In a production environment, you would use an Issuer that integrates with a real CA (like Let's Encrypt).

// 4. Create a Certificate
// Here, we create a Certificate that specifies the details needed to create a certificate, like common name and DNS names:

const certificate = new k8s.apiextensions.CustomResource("tls-cert", {
    apiVersion: "cert-manager.io/v1alpha2",
    kind: "Certificate",
    metadata: {
        name: "example-com",
        namespace: "default",
    },
    spec: {
        secretName: "example-com-tls",
        issuerRef: {
            name: "selfsigned-issuer",
            kind: "ClusterIssuer",
        },
        commonName: "example.com",
        dnsNames: ["example.com"],
    },
}, { dependsOn: [tlsIssuer] }); // This dependency ensures that the ClusterIssuer is ready before creating the Certificate.
```

In this program:

- We declare a MetalLB manifest as a `ConfigGroup`. This simply runs the `kubectl apply` equivalent for the manifest file on our cluster.
- We then install `cert-manager` using the Helm chart. Helm is a package manager for Kubernetes which `cert-manager` supports.
- Next, we define a `ClusterIssuer`, which is a `cert-manager` component that handles issuing certificates from the specified authority. We're using a self-signed issuer for simplicity.
- Finally, we create a `Certificate` that includes `spec` options like `commonName` and `dnsNames` to create a certificate for our domain.

Please note that we've used some placeholder values and assumptions here (like the MetalLB manifest URL, the `cert-manager` version, and the self-signed ClusterIssuer). You'll need to modify the resources and configurations according to the actual requirements of your environment, like choosing the right `cert-manager` version and Issuer type.

Also, when integrating with real domain names and production environments, you should use an ACME issuer like Let's Encrypt, configure the issuer properly, and make sure your DNS records are in place. Keep in mind you may also need to create appropriate roles and role bindings depending on your cluster's RBAC configuration.

Check the [`cert-manager`](https://www.pulumi.com/registry/packages/kubernetes-cert-manager/api-docs/certmanager/) and [`kubernetes`](https://www.pulumi.com/registry/packages/kubernetes/api-docs/) API docs for more details on each of the objects.