Configurer un cluster avec Cert-manager, ingress-nginx, external DNS pour pouvoir héberger une application sur Kubernetes

Introduction

Présentation ingress-nginx

Présentation External DNS

Présentation cert-manager

Prérequis pour créer et configurer le cluster Kubernetes

export SCW_ACCESS_KEY="my-access-key"
export SCW_SECRET_KEY="my-secret-key"

Création du cluster Kubernetes sur Scaleway

# Plus d'option de configuration du cluster ici : https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/k8s_cluster
resource "scaleway_k8s_cluster" "cluster" {
  name    = "scaleway_cluster"  
  version = "1.24.7"
  cni     = "cilium"
}

# Plus d'option de configuration du cluster ici : https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/k8s_pool
resource "scaleway_k8s_pool" "pool" {
  cluster_id  = scaleway_k8s_cluster.cluster.id
  name        = "pool"
  node_type   = "PLAY2-NANO"
  size        = 1
  min_size    = 1
  max_size    = 5
  autoscaling = true
  autohealing = true
}

resource "local_file" "kubeconfig" {
  content  = scaleway_k8s_cluster.cluster.kubeconfig[0].config_file
  filename = "../configuration/kubeconfig"
}

• Un cluster Kubernetes à la version 1.24.7 avec comme CNI cilium

• Un groupe des noeuds qui s’autoheal composé d’un noeudNANO pouvant scale entre 1 à 5 noeud

• Le “Kubeconfig” du cluster dans un fichier sur votre PC

terraform {
  required_providers {
    scaleway = {
      source  = "scaleway/scaleway"
      version = "2.9.1"
    }
	}

  required_version = "~> 1.3"
}

cd scaleway_cluster
terraform init
terraform plan
terraform apply

Installation ingress-nginx

resource "helm_release" "nginx" {
  name          = "ingress"
  repository    = "https://kubernetes.github.io/ingress-nginx"
  chart         = "ingress-nginx"
  wait_for_jobs = true
}

Installation External DNS

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: kube-system
stringData:
  cloudflare_api_token: CLOUDFLARE_API_TOKEN

resource "helm_release" "external_dns" {
  repository = "https://charts.bitnami.com/bitnami"
  chart      = "external-dns"
  name      = "external-dns"
  namespace = "kube-system"
  values = [
<<-EOF
# Make sur to create a secret with the CF_API_TOKEN in the kube-system namespace before
provider: cloudflare
cloudflare:
  email: <CLOUDFLARE_ACCOUNT_EMAIL>
  secretName: cloudflare-api-token-secret
  proxied: false
    EOF  
  ]
}

Installation cert-manager

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: cert-manager
stringData:
  cloudflare_api_token: <CLOUDFLARE_API_TOKEN>

module "cert_manager" {
  source                                 = "terraform-iaac/cert-manager/kubernetes"
  version                                = "2.5.0"
  cluster_issuer_email                   = "USER_EMAIL"
  cluster_issuer_name                    = "letsencrypt-staging"
  cluster_issuer_private_key_secret_name = "letsencrypt-staging"
  cluster_issuer_server                  = "https://acme-staging-v02.api.letsencrypt.org/directory"
  solvers = [
    {
      dns01 = {
        cloudflare = {
          email = "CLOUDFLARE_ACCOUNT_EMAIL"
          apiTokenSecretRef = {
            name = "cloudflare-api-token-secret"
            key  = "cloudflare_api_token"
          }
        },
      }
    }
  ]
}
data "kubectl_file_documents" "secret" {
  content = file("./cloudflare-secret-cert.yaml")
}
resource "kubectl_manifest" "secret" {
  for_each  = data.kubectl_file_documents.secret.manifests
  yaml_body = each.value
}

Exemple de déploiement d’un container nginx

• APPLICATION_DOCKER_IMAGE: nom de l’image docker de votre application.

• APPLICATION_DOCKER_IMAGE_PORT: le port du conteneur.

• FQDN: nom de domaine complet.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - image: <APPLICATION_DOCKER_IMAGE>
        name: nginx
        ports:
        - containerPort: <APPLICATION_DOCKER_IMAGE_PORT>
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-staging
spec:
  selector:
    app: nginx
  type: ClusterIP
  ports:
    - protocol: TCP
      port: 80
      targetPort: <APPLICATION_DOCKER_IMAGE>
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    external-dns.alpha.kubernetes.io/hostname: <FQDN> #example toto.keltio.com
    external-dns.alpha.kubernetes.io/ttl: "60" #optional
    kubernetes.io/ingress.class: "nginx"    
    cert-manager.io/cluster-issuer: "letsencrypt-staging"
spec:
  tls:
  - hosts:
    - <FQDN>
    secretName: letsencrypt-staging
  rules:
  - host:<FQDN>
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx
            port:
              number: 80

terraform {
  required_providers {
    scaleway = {
      source  = "scaleway/scaleway"
      version = "2.9.1"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.4"
    }
    kubectl = {
      source  = "gavinbunney/kubectl"
      version = ">= 1.7.0"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "2.8.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "2.17.0"
    }
  }
  required_version = "~> 1.3"
}

Architecture de dossier

├── scaleway_cluster
│  ├── version.tf
│  ├── cluster.tf
├── k8s_core_services
│  ├── ingress.tf
│  ├── cloudflare-secret.yaml
│  ├── external_dns.tf
│  ├── cloudflare-secret-cert.yaml
│  ├── cert_manager.tf
│  ├── manifests.yaml
│  ├── version.tf

cd k8s_core_services
terraform init
terraform plan
terraform apply

Conclusion