There is an amazing post on software architecture named The Architecture Behind A One-Person Tech Startup which you should check it out. I’m almost using same tech architecture for my projects.
There is one thing however that I want to tweak:
Since Cloudflare proxying all external traffic to my Load Balancer(Ingress controlled Load Balancer) with default browser side SSL ceritificate;
I only need Origin Server TLS certificate for a full SSL tunnel:
As Cloudflare mentioned in End-to-end HTTPS with Cloudflare - Part 3: SSL options, you can provide your self-signed certificate for Full mode or you can provide a Cloudflare Origin CA certificate (or a valid certificate purchased from a CA) to enable Full (strict) mode:
So I don’t need Let’s Encrypt to grant me SSL certificate for my site. Yes, I am grateful for their free ACME certificates but in our case it’s better to not load extra work to Lets' Encrypt while Cloudflare is also a CA.
1. Origin CA
OK, We saw what we need but how we’re going to issue and add an Origin CA ceritificate to our origin server?
The default way is like this: Managing Cloudflare Origin CA certificates. Although it’s manual, rquires a lot effort and we need to regenerate and revoke our own certificates. We don’t like to use this way for our kubernetes clusters for sure.
The solution comes from Cloudflare team: origin-ca-issuer.
Origin CA Issuer is a cert-manager CertificateRequest controller for Cloudflare’s Origin CA feature. It handles above mentioned default way by itself.
Clone the github repo and apply manifests to install Origin CA Issuer to your cluster:
$ kubectl apply \ -f deploy/crds \ -f deploy/rbac \ -f deploy/manifests
By default the Origin CA Issuer will be deployed in the
1.2. Adding an OriginIssuer
Get your Origin CA Key from API Token section of your Cloudflare dashboard and create a secret yaml for it:
$ kubectl create secret generic \ origin-ca-key \ -n default \ --from-literal key=v1.0-FFFFFFF-FFFFFFFF \ --dry-run=client \ -o yaml > origin-ca-key.yaml
default namespace according to your need, then create
Apply these manifests to your cluster:
$ kubectl apply \ -f origin-ca-key.yaml \ -f issuer.yaml
OriginIssuer resource will be updated once the Origin CA Issuer is ready.
After that create your Ingress resource like below:
Apply it as well:
$ kubectl apply -f example-ingress.yaml
Now you got:
- DNS record for example.com proxied by Cloudflare
- SSL certificate for your origin server signed by Cloudflare
- Full (strict) mode enabled
- Orange Cloud enabled
and you’re ready to go.
- I wish origin-ca-issuer had a
Helm Reposo we can install it via
helm install, and they had
ClusterOriginIssuerinstead of namespace scoped
OriginIssuer. Fortunately there are related issues on the repo and they are already working on them.
- How much I tried I couldn’t make origin-ca-issuer work by
ingress-traefik. If someone achieves that I’ll be happy to learn.