ExternalDNSとcert-managerでお家KubernetesとHTTPSな通信をする

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-helloworld
spec:
  selector:
    matchLabels:
      app: ingress-helloworld
  replicas: 1
  template:
    metadata:
      labels:
        app: ingress-helloworld
    spec:
      containers:
        - name: ingress-helloworld
          image: gcr.io/google-samples/hello-app:1.0
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: 10m
              memory: 30Mi
            requests:
              cpu: 10m
              memory: 30Mi
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-helloworld
  labels:
    app: ingress-helloworld
spec:
  ports:
    - port: 8080
      protocol: TCP
  selector:
    app: ingress-helloworld
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-helloworld
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - annotation.your.domain # あなたのドメインに書き換えてください
      secretName: nginx-annotation-tls
  rules:
    - host: annotation.your.domain # あなたのドメインに書き換えてください
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-helloworld
                port:
                  number: 8080

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: primary
  namespace: metallb-ns
spec:
  addresses:
  - 192.168.1.200-192.168.1.254

apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: l2-primary
  namespace: metallb-ns
spec:
  ipAddressPools:
    - primary

apiVersion: v1
kind: Service
metadata:
  name: sample-lb
spec:
  type: LoadBalancer
  ports:
    - port: 80
  selector: {}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-helloworld
spec:
  selector:
    matchLabels:
      app: ingress-helloworld
  replicas: 1
  template:
    metadata:
      labels:
        app: ingress-helloworld
    spec:
      containers:
      - name: ingress-helloworld
        image: gcr.io/google-samples/hello-app:1.0
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-helloworld
  labels:
    app: ingress-helloworld
spec:
  ports:
  - port: 8080
    protocol: TCP
  selector:
    app: ingress-helloworld
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-helloworld
spec:
  rules:
  - host: helloworld.info
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ingress-helloworld
            port:
              number: 8080
  ingressClassName: nginx

apiVersion: v1
kind: Namespace
metadata:
  name: external-dns
---
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-secret
  namespace: external-dns
data:
  # echo 'YourSecret' | base64
  token: YourToken
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: external-dns
  namespace: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: external-dns
rules:
  - apiGroups: [""]
    resources: ["services", "endpoints", "pods"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: external-dns-viewer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns
subjects:
  - kind: ServiceAccount
    name: external-dns
    namespace: external-dns
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns
  namespace: external-dns
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: external-dns
  template:
    metadata:
      labels:
        app: external-dns
    spec:
      serviceAccountName: external-dns
      containers:
        - name: external-dns
          image: registry.k8s.io/external-dns/external-dns:v0.13.5
          args:
            - --log-level=info
            - --log-format=text
            - --source=service # ingress is also possible
            - --source=ingress
            - --policy=sync # ingressが消えた際にレコードを消してほしくない場合はupsert-onlyにする
            - --events
            - --interval=1m # より早く同期したい場合は10sなどにする
            - --domain-filter=YourDomain # (optional) limit to only example.com domains; change to match the zone created above.
            - --provider=cloudflare
            - --cloudflare-dns-records-per-page=5000 # (optional) configure how many DNS records to fetch per request
          livenessProbe:
            failureThreshold: 2
            httpGet:
              path: /healthz
              port: http
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            limits:
              cpu: 50m
              memory: 50Mi
            requests:
              cpu: 50m
              memory: 50Mi
          env:
            - name: CF_API_TOKEN
              valueFrom:
                secretKeyRef:
                  name: cloudflare-secret
                  key: token

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 3
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: docker.io/nginx:latest
          ports:
            - containerPort: 80
          resources:
            limits:
              cpu: 10m
              memory: 30Mi
            requests:
              cpu: 10m
              memory: 30Mi
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  labels:
    app: nginx
spec:
  selector:
    app: nginx
  ports:
    - port: 80
      protocol: TCP
      name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
spec:
  ingressClassName: nginx
  rules:
    - host: nginx.your.domain
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: nginx-service
                port:
                  number: 80

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-secret
  namespace: cert-manager
data:
  # echo 'YourSecret' | base64
  token: YourToken
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: cert-manager
spec:
  acme:
    email: YourEmail
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging-private-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-secret
              key: token
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
  namespace: cert-manager
spec:
  acme:
    email: YourEmail
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-production-private-key
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-secret
              key: token

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-helloworld
spec:
  selector:
    matchLabels:
      app: ingress-helloworld
  replicas: 1
  template:
    metadata:
      labels:
        app: ingress-helloworld
    spec:
      containers:
        - name: ingress-helloworld
          image: gcr.io/google-samples/hello-app:1.0
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: 10m
              memory: 30Mi
            requests:
              cpu: 10m
              memory: 30Mi
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-helloworld
  labels:
    app: ingress-helloworld
spec:
  ports:
    - port: 8080
      protocol: TCP
  selector:
    app: ingress-helloworld
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-helloworld
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - annotation.your.domain # あなたのドメインに書き換えてください
      secretName: nginx-annotation-tls
  rules:
    - host: annotation.your.domain # あなたのドメインに書き換えてください
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-helloworld
                port:
                  number: 8080