Package: k53certbot
k53certbotk53cerbot is specifically targeted at AWS EKS users who want to issue SSL
certificates based onKubernetes Ingressdeclarations and are unable to usecert-managerwhich is
incompatibility with AWS Fargate.Setupk53certbot is intented to run as adeploymentinside thekube-systemnamespace of your Kubernetes clusterContainer image (requires podman - or build manually with Docker)makeimageAfter building, push the image somewhere you can access it from your EKS
cluster, eg ECR or an Artifactory instance you control.Kubernetes RBAC/IAMCreate a IAM policy based on theexampleThis grants access to all Route53 resources, you may want to add
restrictionsCreate a Kubernetes service account mapping theIAM policy to a service
account in the Kubernetes clusterThe example deployment expects service namecertbot-serviceRoute53Configure apublic hosted zonefor the zone you wish to issue certificates inExternal DNSExternal DNS manages the DNS recordfor the ingress- follow the instructionshttps://github.com/kubernetes-sigs/external-dns/to setup external-dnsAWS Load Balancer ControllerAWS Load Balancer Controller exposes the services running behind Ambassador -
follow the instructionshttps://aws.amazon.com/about-aws/whats-new/2020/10/introducing-aws-load-balancer-controller/to setup the load balancer controllerIngress controllerKubernetes requires an Ingress Controller implementation to make your ingress
definitions do anything.
We suggestAmbassadorZeroSSL Setup (not required if using Letsencrypt)Create anopaque kubernetes secretcontaining the zerossl API keyThe example scripts expect:secret name:zerossldata field:zerossl_api_keyk53certbot deploymentDeploy the container image you built to the cluster:Adjust theexampleto suit your environment:<REPLACE_WITH_YOUR_IMAGE><REPLACE_WITH_YOUR_EMAIL>remove--provider zerosslif using Letsencryptkubectl apply -y /path/to/edited/example/k53certbot.kubectl.yamlInspect the deployment once its running:kubectl -n kube-system get podkubectl -n kube-system get deployment ID_OF_DEPLOYMENTkubectl -n kube-system logs ID_OF_POD...etcProvisioning TLS certificatesOnce setup is complete, TLS certificates are provisioned by deploying a
suitable ingress, seeexampleand adjust as
needed, then deploy with:kubectldeploy-f/path/to/edited/example/ingress.kubectl.yamlIf you've done everything right, the site will start working with TLS in a few
minutes time, otherwise look at the pod logs for the container running
k53certbot to start working out what is going on.TipThere are a lot of moving parts needed before k53certbot can work - if you
manage it all in one go you deserve a medal!For the rest of us - break your cluster deployment into steps:AWS Load Balancer + ambassador - can you see a service?External-DNS - can you access your deployment over plainhttpwith the
right hostname?With all this working, your ready to try adding TLS with k53certbotHow does k53certbot work?Watch Kubernetes for ingress deploymentsFor every change:Get the FQDN the ingressruncertbotto register or de-register the FQDN - certbot has built
in support for Route 53 via python packagecertbot-dns-route53certbotmanages files under/etc/letsencryptand will write the TLS
secrets there once they have been provisioned.Create a kubernetes secret including the contents of the appropriate
files under/etc/letsencrypt:Secrets will be named:tls-<FQDN WITH PERIODS CONVERTED TO HYPHENS>eg: the secret forexample.yourdomain.comwould betls-examlple-yourdomain-com- periods are replaced with hypens as
they cause problems in AmbassadorAny existing secret with the same name will be replacedStatusExperimental - does the bare minimum needed to issue an initial certificateFeaturesZeroSSL supportby adaptingcertbot-zerosslLetsencrypt supportDNS-01 challenge supportAWS Fargate EKS compatibleAWS service access viaiamserviceaccount- no need (and not supported) to
embed AWS access keys in secrets, etc.TodoCertificate renewal (workaround: restart script)Testing, bulletproofing, etc.HackingUse live code in docker containerrm/usr/local/lib/python3.8/site-packages/k53certbot/-rf
ln-s/mnt/k53certbot/usr/local/lib/python3.8/site-packages/k53certbot-s