Skip to content
This repository was archived by the owner on Aug 18, 2025. It is now read-only.

Commit e209115

Browse files
ericpaulsenKatie Horne
ericpaulsen
and
Katie Horne
authored
add: Cloud DNS SSL config (#269)
* add Cloud DNS SSL config * Edit text * add to manifest * Fix metadata * fix typos Co-authored-by: Katie Horne <katie@coder.com>
1 parent 30ad667 commit e209115

File tree

3 files changed

+222
-1
lines changed

3 files changed

+222
-1
lines changed

‎guides/ssl-certificates/cloudDNS.md

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
---
2+
title: Cloud DNS
3+
description:
4+
Learn how to use cert-manager to set up SSL certificates using Cloud DNS for
5+
DNS01 challenges.
6+
---
7+
8+
[cert-manager](https://cert-manager.io/) allows you to enable HTTPS on your
9+
Coder installation, regardless of whether you're using
10+
[Let's Encrypt](https://letsencrypt.org/) or you have your own certificate
11+
authority.
12+
13+
This guide will show you how to install cert-manager v1.0.1 and set up your
14+
cluster to issue Let's Encrypt certificates for your Coder installation so that
15+
you can enable HTTPS on your Coder deployment. It will also show you how to
16+
configure your Coder hostname and dev URLs.
17+
18+
> We recommend reviewing the official cert-manager
19+
> [documentation](https://cert-manager.io/docs/) if you encounter any issues or
20+
> if you want info on using a different certificate issuer.
21+
22+
You must have:
23+
24+
- A Kubernetes cluster with internet connectivity
25+
- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
26+
- A [Cloud DNS](https://cloud.google.com/dns) account
27+
- A
28+
[GCP Service Account](https://cloud.google.com/iam/docs/creating-managing-service-accounts)
29+
with the `dns.admin` role
30+
31+
## Step 1: Add cert-manager to your Kubernetes cluster
32+
33+
To add cert-manager to your cluster (which we assume to be running Kubernetes
34+
1.16+), run:
35+
36+
```console
37+
kubectl apply --validate=false -f \
38+
https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager.yaml
39+
```
40+
41+
> `--validate=false` is required to bypass kubectl's resource validation on the
42+
> client-side that exists in older versions of Kubernetes.
43+
44+
Once you've started the installation process, verify that all the pods are
45+
running:
46+
47+
```console
48+
$ kubectl get pods -n cert-manager
49+
50+
NAME READY STATUS RESTARTS AGE
51+
cert-manager-7cd5cdf774-vb2pr 1/1 Running 0 84s
52+
cert-manager-cainjector-6546bf7765-ssxhf 1/1 Running 0 84s
53+
cert-manager-webhook-7f68b65458-zvzn9 1/1 Running 0 84s
54+
```
55+
56+
## Step 2: Get the private key from the service account
57+
58+
You can get the private key from the GCP Service Account using:
59+
60+
```console
61+
gcloud iam service-accounts keys create key.json \
62+
--iam-account <service-account-name>@<project-name>.gserviceaccount.com
63+
```
64+
65+
The response should look similar to the following:
66+
67+
```console
68+
created key [44...3d] of type [json] as [key.json] for [<service-account-name>@<project-name>.iam.gserviceaccount.com]
69+
```
70+
71+
## Step 3: Configure cluster issuer secret and add it to cert-manager namespace
72+
73+
Next, configure the cluster issuer secret, and add it to cert-manager's
74+
namespace:
75+
76+
```console
77+
kubectl -n cert-manager create secret generic \
78+
clouddns-dns01-solver-svc-acct --from-file=./key.json
79+
```
80+
81+
If successful, you'll see a response similar to:
82+
83+
```console
84+
secret/clouddns-dns01-solver-svc-acct created
85+
```
86+
87+
## Step 4: Create a cluster issuer resource and apply it
88+
89+
1. Using the text editor of your choice, create a new
90+
[configuration file](https://cert-manager.io/docs/configuration/acme/dns01/)
91+
called `letsencrypt.yaml` (you can name it whatever you'd like) that includes
92+
your newly created private key:
93+
94+
```yaml
95+
apiVersion: cert-manager.io/v1alpha2
96+
kind: ClusterIssuer
97+
metadata:
98+
name: letsencrypt
99+
spec:
100+
acme:
101+
privateKeySecretRef:
102+
name: gclouddnsissuersecret
103+
server: https://acme-v02.api.letsencrypt.org/directory
104+
solvers:
105+
- dns01:
106+
clouddns:
107+
# The ID of the GCP project
108+
project: <project-id>
109+
# This is the secret used to access the service account
110+
serviceAccountSecretRef:
111+
name: clouddns-dns01-solver-svc-acct
112+
key: key.json
113+
```
114+
115+
1. Apply your configuration changes:
116+
117+
```console
118+
kubectl apply -f ./clusterissuer.yaml
119+
```
120+
121+
If successful, you'll see a response similar to:
122+
123+
```console
124+
clusterissuer.cert-manager.io/letsencrypt created
125+
```
126+
127+
## Step 5: Create a certificates.yaml file and apply it
128+
129+
We will now issue certificates for your Coder instance. Below is a sample
130+
`certificates.yaml` file:
131+
132+
```yaml
133+
apiVersion: cert-manager.io/v1alpha2
134+
kind: Certificate
135+
metadata:
136+
name: coder-root
137+
namespace: # Your Coder deployment namespace
138+
spec:
139+
secretName: # Your Coder base url secret name. Use hyphens in place of spaces.
140+
duration: 2160h # 90d
141+
renewBefore: 360h # 15d
142+
dnsNames:
143+
- domain.com # Your base domain for Coder
144+
issuerRef:
145+
name: letsencrypt
146+
kind: ClusterIssuer
147+
148+
---
149+
apiVersion: cert-manager.io/v1alpha2
150+
kind: Certificate
151+
metadata:
152+
name: coder-devurls
153+
namespace: # Your Coder deployment namespace
154+
spec:
155+
secretName: coder-devurls-cert # Your Coder devurls secret name
156+
duration: 2160h # 90d
157+
renewBefore: 360h # 15d
158+
dnsNames:
159+
- "*.domain.com" # Your dev URLs wildcard subdomain
160+
issuerRef:
161+
name: letsencrypt
162+
kind: ClusterIssuer
163+
```
164+
165+
At this point, you're ready to [install](../../setup/installation.md) Coder.
166+
However, to use all of the functionality you set up in this tutorial, use the
167+
following `helm install` command instead:
168+
169+
```console
170+
helm install coder coder/coder --namespace coder \
171+
--version=<CODER_VERSION> \
172+
--set devurls.host="*.exampleCo.com" \
173+
--set ingress.host="coder.exampleCo.com" \
174+
--set ingress.tls.enable=true \
175+
--set ingress.tls.devUrlsHostSecretName="coder-devurls-cert" \
176+
--set ingress.tls.hostSecretName="coder-root-cert" \
177+
--set \
178+
"ingress.additionalAnnotations[0]=cert-manager.io/cluster-issuer:letsencrypt" \
179+
--wait
180+
```
181+
182+
There are additional steps to make sure that your hostname and Dev URLs work.
183+
184+
1. Check the contents of your namespace
185+
186+
```console
187+
kubectl get all -n <your_namespace> -o wide
188+
```
189+
190+
Find the **service/ingress-nginx** line and copy the **external IP** value
191+
shown.
192+
193+
1. Return to Google Cloud Platform, navigate to the
194+
[Cloud DNS](https://cloud.google.com/dns) Console, and select the Zone that
195+
your cluster is in.
196+
197+
**Note:** You will need to create two A records, one for both the hostname
198+
and Dev URLs
199+
200+
1. Click **Add Record Set**
201+
202+
1. Provide your **DNS Name**
203+
204+
a. If you're configuring the hostname, this value will be a standard domain
205+
206+
b. If you're configuring your dev URLs, this will be a wildcard domain (e.g.,
207+
`*.domain.com`)
208+
209+
1. Set the **Resource Record Type** to **A**
210+
211+
1. Copy and paste the IP address from the **service/ingress-nginx** line in your
212+
terminal to the `IPv4 Address` field
213+
214+
1. Click **Create**
215+
216+
At this point, you can return to **step 6** of the
217+
[installation](../../setup/installation.md) guide to obtain the admin
218+
credentials you need to log in.

‎guides/ssl-certificates/route53.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ helm install coder coder/coder --namespace coder \
142142
--set devurls.host="*.exampleCo.com" \
143143
--set ingress.host="coder.exampleCo.com" \
144144
--set ingress.tls.enable=true \
145-
--set ingress.tls.devUrlsHostSecretName=devUlrCertificate \
145+
--set ingress.tls.devUrlsHostSecretName=devUrlCertificate \
146146
--set ingress.tls.hostSecretName=hostCertificate \
147147
--set \
148148
"ingress.additionalAnnotations[0]=cert-manager.io/cluster-issuer:letsencrypt" \

‎manifest.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,9 @@
292292
"path": "./guides/ssl-certificates/index.md",
293293
"navigable": false,
294294
"children": [
295+
{
296+
"path": "./guides/ssl-certificates/cloudDNS.md"
297+
},
295298
{
296299
"path": "./guides/ssl-certificates/cloudflare.md"
297300
},

0 commit comments

Comments
 (0)