Using kubernetes certmanager.k8s.io with stackgres.io

Question

Pulumi · Accepted Answer

In this guide, we'll create a Pulumi program to deploy Cert-Manager using the Kubernetes provider on a Kubernetes cluster, which will manage TLS certificates automatically. For StackGres, the assumption here is that it's already installed on the Kubernetes cluster or will be managed separately. Cert-Manager will provide a way to issue and renew certificates that StackGres can utilize for Postgres databases over SSL/TLS.

Cert-Manager is a Kubernetes add-on that automates the management and issuance of TLS certificates from various issuing sources, including Let's Encrypt, HashiCorp Vault, Venafi, simple signing key pairs, or self-signed.

We'll use the `kubernetes-cert-manager` package available in Pulumi that provides a high-level abstraction to deploy Cert-Manager in a Kubernetes cluster.

Before running this program, make sure you have the following prerequisites in place:
- A configured Kubernetes cluster where you have permissions to deploy resources.
- Pulumi CLI installed and configured for Kubernetes (typically done via `pulumi login` and `kubectl` configured with the context set for your cluster).
- Node.js installed to run the Pulumi TypeScript program.

Now, let's go through the steps and the corresponding TypeScript program.

1. **Setting up your project**: You'll start with setting up a new Pulumi project if you haven't already.

```shell
pulumi new kubernetes-typescript
```

2. **Writing the Pulumi program**: Next, you'll write the necessary code to deploy Cert-Manager to your Kubernetes cluster.

```typescript
import * as k8s from "@pulumi/kubernetes";

// Initialize the Kubernetes provider.
const provider = new k8s.Provider("provider", { /* provider config */ });

// Deploy Cert-Manager using the `kubernetes-cert-manager` package.
// This resource will deploy Cert-Manager along with necessary CRDs (Custom Resource Definitions).
const certManager = new k8s.apiextensions.CustomResource(
    "cert-manager",
    {
        apiVersion: "cert-manager.io/v1",
        kind: "ClusterIssuer",
        metadata: {
            name: "letsencrypt",
        },
        spec: {
            acme: {
                server: "https://acme-v02.api.letsencrypt.org/directory",
                email: "email@example.com", // Replace with your email
                privateKeySecretRef: {
                    name: "letsencrypt-private-key",
                },
                solvers: [
                    {
                        http01: {
                            ingress: {
                                class: "nginx",
                            },
                        },
                    },
                ],
            },
        },
    },
    { provider: provider }
);

// Export the Cert-Manager ClusterIssuer name
export const clusterIssuerName = certManager.metadata.name;
```

This program does the following:
- It imports the necessary Pulumi and Kubernetes packages.
- It initializes the Kubernetes provider, which allows Pulumi to communicate with your Kubernetes cluster.
- It then defines a `ClusterIssuer` kind from the Cert-Manager's API, which represents a certificate authority that can generate signed certificates by honoring certificate signing requests.
  - The `acme` section configures the ACME server and solver. Here, the ACME server is set to Let's Encrypt with an `http01` challenge for domain validation which would work with an Ingress controller like nginx.

Replace `email@example.com` with your own email address, which is used for Let's Encrypt registration and recovery.

3. **Running the Pulumi program**: To apply this program to your Kubernetes cluster, run the following commands:

```shell
pulumi up
```

This command will prompt you to confirm the deployment. Upon confirmation, Pulumi will communicate with your Kubernetes cluster to deploy Cert-Manager and set up the ClusterIssuer.

4. **Checking the results**: After the `up` command completes, you should see the ClusterIssuer being reported as created. You can also verify this with `kubectl`:

```shell
kubectl get clusterissuers letsencrypt -o yaml
```

This should reflect the `ClusterIssuer` you described in the Pulumi program.

Now your Cert-Manager is set up, and you can use it to issue certificates for your applications. For StackGres', PostgreSQL instances, you can reference the ClusterIssuer from your database manifests to ensure that TLS certificates are automatically issued and renewed for secure database connections.

That's it! You've successfully deployed Cert-Manager with Pulumi and prepared a way for StackGres to use certificates for secure communication.