public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-14 13:04:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update _index.md

Browse Source
This commit is contained in:
Mark Bishop
2018-08-15 16:52:33 -07:00
committed by GitHub
parent 63be0b14a9
commit 134d7a76d4
1 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md
+13 -11
View File
@@ -53,21 +53,23 @@ ingress:
## Configuring an NGINX Default Certificate
It is possible to configure nginx to use a custom, default certificate that is used for ingress objects if no certificate is specified for them. This can be useful for wildcard certificates.
When configuring an ingress object with TLS termination, you must provide it with a certificate used for encryption/decryption. Instead of explicitly defining a certificate each time you configure an ingress, you can set up a custom certificate that's used by default.
### Requirements
Setting up a default certificate is especially helpful in environments where a wildcard certificate is used, as the certificate can be applied in multiple subdomains.
- Access to the `cluster.yml` used to create the cluster
- The PEM encoded certificate you will use as the default certificate
>**Prerequisites:**
>
>- Access to the `cluster.yml` used to create the cluster.
>- The PEM encoded certificate you will use as the default certificate.
### Steps
1. Obtain or generate your certificate key pair in a PEM encoded form
2. Generate a Kubernetes secret object from your PEM encoded certificate with the following command, substituting your certificate for `mycert.cert` and `mycert.key`
1. Obtain or generate your certificate key pair in a PEM encoded form.
2. Generate a Kubernetes secret from your PEM encoded certificate with the following command, substituting your certificate for `mycert.cert` and `mycert.key`.
```
kubectl create secret tls ingress-default-cert --cert=mycert.cert --key=mycert.key -o yaml --dry-run=true > ingress-default-cert.yaml
```
3. Include the contents of `ingress-default-cert.yml` inline with your RKE `cluster.yml`, for example
3. Include the contents of `ingress-default-cert.yml` inline with your RKE `cluster.yml` file. For example:
```yaml
addons: |-
@@ -83,7 +85,7 @@ It is possible to configure nginx to use a custom, default certificate that is u
namespace: ingress-nginx
type: kubernetes.io/tls
```
4. Define your ingress resource with the following `default-ssl-certificate` argument that references the secret we created above under `extra_args` in your `cluster.yml` like such:
4. Define your ingress resource with the following `default-ssl-certificate` argument, which references the secret we created earlier under `extra_args` in your `cluster.yml`:
```yaml
ingress:
@@ -92,8 +94,8 @@ It is possible to configure nginx to use a custom, default certificate that is u
default-ssl-certificate: "ingress-nginx/ingress-default-cert"
```
5. *optional* If you are applying this to a cluster that was already created, you must restart the nginx ingress controller pods in order to have them apply the latest `extra_args`
5. **Optional:** If you want to apply the default certificate to ingress in a cluster that already exists, you must restart the Nginx ingress controller pods to apply the latest `extra_args`.
```
kubectl delete po -l app=ingress-nginx -n ingress-nginx
kubectl delete pod -l app=ingress-nginx -n ingress-nginx
```