SEsercand·Jul 25, 2017
If you have a Kubernetes cluster you can use https://github.com/PalmStoneGames/kube-cert-manager. Certbot (https://certbot.eff.org/) also has several configurations.
In How to use Let's Encypt with Google Cloud PlatformPalmStoneGames
kube-cert-manager
Go2016–2017
PalmStoneGames / kube-cert-manager
kube-cert-manager
Manage Lets Encrypt certificates for a Kubernetes cluster.
4Distinct people
4Mentions
0Explicit recommenders
536GitHub stars
What to know before exploring
What it is
Manage Lets Encrypt certificates for a Kubernetes cluster.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month4 dated mentions
Observed mentions: 2016-10-06 12:29:23 UTC to 2017-07-25 16:02:34 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Oct 2016 | 2016-10-01 00:00:00 UTC | 2016-11-01 00:00:00 UTC | 2 | 1 | 1 |
| Nov 2016 | 2016-11-01 00:00:00 UTC | 2016-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2016 | 2016-12-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2017 | 2017-01-01 00:00:00 UTC | 2017-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2017 | 2017-02-01 00:00:00 UTC | 2017-03-01 00:00:00 UTC | 1 | 0 | 1 |
| Mar 2017 | 2017-03-01 00:00:00 UTC | 2017-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2017 | 2017-04-01 00:00:00 UTC | 2017-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2017 | 2017-05-01 00:00:00 UTC | 2017-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2017 | 2017-06-01 00:00:00 UTC | 2017-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2017 | 2017-07-01 00:00:00 UTC | 2017-08-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
4 sourcesNote one significant gotcha with this approach: the Ingress does TLS termination, so the hop from the Ingress to your pod is unencrypted.
That might be OK if 1) your data isn's sensitive or 2) you're running on your own metal (and so you control the network), but in GKE your nodes are on Google's SDN, and so you're sending your traffic across their DCs in the clear.
There are a couple of pieces of hard-to-find config required to achieve TLS-to-the-pod with Ingress:
1) You need to enable ssl-passthrough on your nginx ingress; this is a simple annotation: https://github.com/kubernetes/contrib/issues/1854. This will use nginx's streaming mode to route requests with SNI without terminating the TLS connection.
2) Now you'll need a way of getting your certs into the pod; kube-lego attaches the certs to the Ingress pod, which is not what you wan
Read the rest
t for TLS-to-the-pod. https://github.com/PalmStoneGames/kube-cert-manager/ lets you do this in an automated way, by creating k8s secrets containing the letsencrypt certs.
3) Your pods will need an SSL proxy to terminate the TLS connection. I use a modified version of https://github.com/GoogleCloudPlatform/nginx-ssl-proxy.
4) You'll want a way to dynamically create DNS entries; Mate is a good approach here. Note that once you enable automatic DNS names for your Services, then it becomes less important to share a single public IP using SNI. You can actually abandon the Ingress, and have Mate set up your generated DNS records to point to the Service's LoadBalancer IP.
(As an aside, if you stick with Nginx Ingress, you can connect it to the outside world using a Kubernetes loadbalancer, instead of having to use a Terraform LB; the (hard-to-find and fairly new) config flag for that is `publish-service` (https://github.com/kubernetes/ingress/blob/master/core/pkg/i...).
Sicne a few days ago, ingress objects are now supported directly with the correct annotations. See https://github.com/PalmStoneGames/kube-cert-manager/blob/mas...
In Simplify Lets Encrypt Certificates Management for KubernetesSimplify Lets Encrypt Certificates Management for Kubernetes
75 points · Open discussion