What's the easiest way to create an HTTPS endpoint on Kubernetes?

Question

I've created a simple Python API using responder and deployed it to Google Cloud with Kubernetes. I don't have a domain name just a raw IP address.

http://192.0.2.42/api/myapi

And deployed as:

kubectl get service
NAME         TYPE           CLUSTER-IP    EXTERNAL-IP    PORT(S)        AGE
kubernetes   ClusterIP      192.0.2.1     <none>         443/TCP        5d15h
web          LoadBalancer   192.0.2.100   192.0.2.42        80:32749/TCP   5d15h

and

kubectl get pods
NAME                   READY   STATUS    RESTARTS   AGE
my-pod-name   1/1     Running   0          16h

I'd like to make it an HTTPS endpoint so I can use it as:

https://192.0.2.42/api/myapi

But I am struggling to find the easiest way to do it.

Should this be something that is done via Kubernetes, or something that is done in the Python code? It doesn't look like responder provides an easy mechanism for this.

I would suggest with Ingress and let's encrypt https://docs.bitnami.com/kubernetes/how-to/secure-kubernetes-services-with-ingress-tls-letsencrypt/ — Tummala Dhanvi, Sep 24 '19 at 17:54
@TummalaDhanvi That seems very involved. Does an "ingress" replace a "service" or do both need to be in place? — nickponline, Sep 24 '19 at 18:05
Ingress maps an url to a service https://kubernetes.io/docs/concepts/services-networking/ingress/#what-is-ingress — Tummala Dhanvi, Sep 24 '19 at 18:08
https://cloud.google.com/kubernetes-engine/docs/concepts/ingress link specific to gcp, let me see if we can get ssl via service in gcp — Tummala Dhanvi, Sep 24 '19 at 18:11
Using IP addresses in HTTPS URLs is not a good idea. Instead of fighting for that to work just buy any domain name and use it. — Patrick Mevzek, Sep 24 '19 at 18:11

score 0 · Answer 1 · answered Sep 24 '19 at 20:52

0

If you're looking for the bare minimum level of effort to do this, you'll need to install an SSL certificate inside your docker container. You can also continue to use externalIP as you are now.

Then in responder you can enable HSTS to redirect http to https.

api = responder.API(enable_hsts=True)

Then just access your pod with

https://192.0.2.42/api/myapi

answered Sep 24 '19 at 20:52

Shogan

1,154
1
10
24

I did see that option, but I don't think has provisions to use SSL certificates. I can't see anything in the docs. I also asked here: https://github.com/taoufik07/responder/issues/391 – nickponline Sep 24 '19 at 21:16

What's the easiest way to create an HTTPS endpoint on Kubernetes?

1 Answers1