Skip to content

Commit cb94af7

Browse files
maxmwangmaxmwang
authored
fix k8s certificate management and add docs (#829)
* use manually created secrets for all dns names, do not use cert-manager ingress-shim * add docs
1 parent 6356eec commit cb94af7

File tree

9 files changed

+125
-20
lines changed

9 files changed

+125
-20
lines changed

‎docs/src/SUMMARY.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
- [Infrastructure](./core/infrastructure/README.md)
2727
- [Onboarding](./core/infrastructure/onboarding.md)
2828
- [CI/CD Workflow](./core/infrastructure/cicd-workflow.md)
29+
- [DNS & Certificates](./core/infrastructure/dns-certificates.md)
2930
- [Runbooks](./core/infrastructure/runbooks.md)
3031

3132
---

‎docs/src/core/infrastructure/dns-certificates.md

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# DNS & TLS Certificates
2+
3+
<!-- toc -->
4+
5+
## Introduction
6+
### What is the Domain Name System (DNS)?
7+
8+
The DNS is a system used across to internet to associate domains, such as `berkeleytime.com`, with IP addresses, such as `123.123.123.123`. Internet browsers use the DNS protocol to translate common domains to IP addresses to know where to route packets.
9+
10+
UC Berkeley classes that cover how a DNS work include:
11+
- [CS 168 (Internet Architecture)](https://www2.eecs.berkeley.edu/Courses/CS168/)
12+
- [CS 161 (Computer Security)](https://www2.eecs.berkeley.edu/Courses/CS161/)
13+
14+
Learn more about DNSs:
15+
- [CS 168 Textbook - DNS](https://textbook.cs168.io/applications/dns.html)
16+
- [What is DNS? | How DNS works](https://www.cloudflare.com/learning/dns/what-is-dns/)
17+
18+
### What are TLS Certificates?
19+
20+
A TLS Certificate secures connections between internet browsers and web servers by authenticating web servers, exchanging keys to encrypt data packets, and providing integrity guarantees over the connection. Connections to websites secured with TLS certificates typically use HTTPS instead of HTTP.
21+
22+
UC Berkeley classes that cover how TLS Certificates work include:
23+
- [CS 161 (Computer Security)](https://www2.eecs.berkeley.edu/Courses/CS161/)
24+
- [CS 168 (Internet Architecture)](https://www2.eecs.berkeley.edu/Courses/CS168/)
25+
26+
Learn more about SSL/TLS (SSL is the predecessor to TLS):
27+
- [What is an SSL Certificate?](https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/)
28+
- [What is SSL? | SSL definition](https://www.cloudflare.com/learning/ssl/what-is-ssl/)
29+
30+
## Our Cloudflare DNS Setup
31+
32+
For the most relevant setup documentation, refer to [Cloudflare's DNS Setup Docs](https://developers.cloudflare.com/dns/).
33+
34+
We pay for the domains `berkeleytime.com` and `stanfurdtime.com`, both registered with [Cloudflare Registrar](https://www.cloudflare.com/products/registrar/). In addition, our authoritative DNS is also Cloudlfare, and its configuration (what domains map to what IPs) can be changed on [the Cloudflare Developer Dashboard](https://dash.cloudflare.com/).
35+
36+
## Our Kubernetes Cluster Setup
37+
38+
There are two relevant Kubernetes components when discussing DNS and Certificates: our reverse proxy `ingress-nginx` and `cert-manager`.
39+
40+
### Ingress Nginx
41+
42+
Recall from [An HTTP Request's Life](./onboarding.md#an-http-requests-life), `ingress-nginx` is our reverse proxy responsible for routing between our application services. Its input is effectively a mapping from a path to a service. This is down through the [Ingress Resource](https://kubernetes.io/docs/concepts/services-networking/ingress/):
43+
44+
```yaml
45+
apiVersion: networking.k8s.io/v1
46+
kind: Ingress
47+
metadata:
48+
# ...
49+
spec:
50+
ingressClassName: nginx
51+
tls:
52+
# ...
53+
rules:
54+
- host: berkeleytime.com
55+
http:
56+
paths:
57+
- path: /
58+
backend:
59+
service:
60+
name: bt-frontend-svc
61+
- path: /api
62+
backend:
63+
service:
64+
name: bt-backend-svc
65+
```
66+
67+
This example `Ingress` resource maps packets routed to `berkeleytime.com/` to the frontend service and maps packets routed to `berkeleytime.com/api` to the backend service.
68+
69+
The `ingressClassName` instructs `ingress-nginx` to manage this `Ingress` resource as one of its reverse proxy destinations.
70+
71+
72+
### Certificate Manager
73+
74+
`cert-manager` is a service that can automatically issue and renew certificates. We only use it to renew certificates. We hardcode a certificate with all domains needed instead of automatic issuing.
75+
76+
```yaml
77+
apiVersion: cert-manager.io/v1
78+
kind: Certificate
79+
metadata:
80+
name: bt-cert
81+
spec:
82+
secretName: bt-cert
83+
dnsNames:
84+
- berkeleytime.com
85+
- "*.berkeleytime.com"
86+
- "*.dev.berkeleytime.com"
87+
- stanfurdtime.com
88+
- "*.stanfurdtime.com"
89+
- "*.dev.stanfurdtime.com"
90+
```
91+
92+
Here is a snippet of the hardcoded certificate deployed as of August 2025. This is linked in the `Ingress` resource earlier under `spec.tls`.

‎infra/app/templates/ingress.yaml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,12 @@ metadata:
44
name: {{ .Release.Name }}-ingress
55
labels:
66
{{- include "bt-app.labels" . | nindent 4 }}
7-
annotations:
8-
cert-manager.io/issuer: {{ .Values.issuer }}
97
spec:
108
ingressClassName: nginx
119
tls:
1210
- hosts:
1311
- {{ .Values.host }}
14-
secretName: {{ .Release.Name }}-cert
12+
secretName: bt-cert
1513
rules:
1614
- host: {{ .Values.host }}
1715
http:

‎infra/base/templates/certificate.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: bt-cert
5+
spec:
6+
secretName: bt-cert
7+
issuerRef:
8+
name: {{ .Values.issuerName }}
9+
kind: Issuer
10+
dnsNames:
11+
- berkeleytime.com
12+
- "*.berkeleytime.com"
13+
- "*.dev.berkeleytime.com"
14+
- stanfurdtime.com
15+
- "*.stanfurdtime.com"
16+
- "*.dev.stanfurdtime.com"

‎infra/base/templates/cloudflare-api-token-sealed-secret.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: bitnami.com/v1alpha1
2+
kind: SealedSecret
3+
metadata:
4+
name: {{ .Values.acme.cloudflareApiTokenSecretName }}
5+
namespace: bt
6+
spec:
7+
encryptedData:
8+
api-token: AgCFa3QC416PcdI2BAodEnnX5Vm05Hl8WE7rKkf0F9zP/OAWYnuFfJqhAtCDbOPz3iyREyTHepBflawZspaIj+XOXg3ZL2A4vMEvpr5BGupc94NTIQyzF3K6OwrTHTU7U/1ZhFo4Y2/daNANzyhbOuqSSou1nRplslRz4Ejg0Tc3X3uRJYqUHHuri95AcbA9hcKPDLEeEgmliYNC8FPn5HtSX/7pp5kod6/da0vI0h3eRjGt6JNwaAxCX8lWQDPBGizcx3xyEMuxleOcKEiSijos2/VMY9NVK2JY4FKSQZz/2Z29cdoRxwN1H+B9ySnvSJoIb3+J/AZ22P1JMo56IZa2GcaE/ooV8x0yySWua4s2kUhngpFWlirOTJCRbU5JaZ9uM7gKdBFZ4/zgxKNdMZCUZLqef6RHZVEjEn5HvklBIMmC5RWe+wtJ7i6uqBK5R2r92ZQ0XE/dWGKT69nIaz5rHVGT26e3edpKJKZV21EXJGAADB80EbyV9Tmbik1s7w/zUQ328bpgvQkIgbDUyrybooF/x/nQfGPXm47OD1daS4PVzwngTCy748TRM0MeHqCjSYRkkiXJzIjDHLYAQtqpKuwZkbRK3q/lKk/z3tABfswMZyKgrpv0GQ7cTn5OIC4FvraT9CU78aGX+N//vWkPx3e2O36oPaU2AJpiiwWolNuhtHGpsAmJMRK9/ykKLzesVqJdoQMVqzjif/C/iufQIWgqtkwway3KXHniwIQFeyen9CV26M7l
9+
template:
10+
metadata:
11+
name: {{ .Values.acme.cloudflareApiTokenSecretName }}
12+
namespace: bt

‎infra/base/templates/cloudflare-stanfurdtime-sealed-secret.yaml

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎infra/base/templates/issuer.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ spec:
1515
- dns01:
1616
cloudflare:
1717
apiTokenSecretRef:
18-
name: {{ .Values.acme.cfApiTokenSecretName }}
18+
name: {{ .Values.acme.cloudflareApiTokenSecretName}}
1919
key: api-token

‎infra/base/values.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@ issuerName: letsencrypt-prod
22
acme:
33
email: [email protected]
44
server: https://acme-v02.api.letsencrypt.org/directory
5-
cfApiTokenSecretName: cloudflare-api-token-stanfurdtime-secret
5+
cloudflareApiTokenSecretName: cloudflare-api-token-secret
66
ipAddressRange: 169.229.226.51-169.229.226.51

‎infra/docs/templates/ingress.yaml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,12 @@ metadata:
44
name: {{ .Release.Name }}-ingress
55
labels:
66
{{- include "bt-docs.labels" . | nindent 4 }}
7-
annotations:
8-
cert-manager.io/issuer: {{ .Values.issuer }}
97
spec:
108
ingressClassName: nginx
119
tls:
1210
- hosts:
1311
- {{ .Values.host }}
14-
secretName: {{ .Release.Name }}-cert
12+
secretName: bt-cert
1513
rules:
1614
- host: {{ .Values.host }}
1715
http:

0 commit comments

Comments
 (0)