Resequence steps and add cert-manager

03-join-nodes/README.md

@@ -1,4 +1,4 @@
-# 05 | Join Additional Controller and Worker Nodes
+# 03 | Join Additional Controller and Worker Nodes
 
 At this point, other nodes can be joined to the cluster.  From a control node, you can get the join command by doing the following.
 

04-nfs-subdir-provisioner/README.md

@@ -1,4 +1,4 @@
-# 03 | Dynamic Volume Provisiong to NFS Subdirectory
+# 04 | Dynamic Volume Provisiong to NFS Subdirectory
 
 [https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner)
 

05-ingress-controller-nginx/README.md

@@ -1,8 +1,11 @@
-# 04 | Ingress Controller = NGINX
+# 05 | Ingress Controller = NGINX
 
 [https://kubernetes.github.io/ingress-nginx/](https://kubernetes.github.io/ingress-nginx/)
+
 [https://github.com/kubernetes/ingress-nginx](https://github.com/kubernetes/ingress-nginx)
 
+The ingress controller provides external access to services in the cluster by acting as a reverse proxy.  In this case, I've selected nginx which is simple to configure, and very fast.  It does not have as many fancy features as some other options though.  
+
 ```bash
 helm upgrade --install ingress-nginx ingress-nginx   --repo https://kubernetes.github.io/ingress-nginx   --namespace ingress-nginx --create-namespace -f values.yaml
 
@@ -28,7 +31,7 @@ spec:
             name: mandelmapper
             port:
               number: 6161
-
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

06-cert-manager/README.md

@@ -0,0 +1,18 @@
+# 06 | Cert Manager
+
+https://cert-manager.io/docs/installation/kubectl/
+
+Install cert-manager - check for latest version.
+
+```yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
+```
+
+After cert manager is installed, create the Let's Encrypt issuer:
+
+```yaml
+
+# Be sure to edit the file and set the production URL if not a test cluster
+kubectl apply -f lets-encrypt-issuer.yaml
+```
+

06-cert-manager/lets-encrypt-issuer.yaml

@@ -0,0 +1,23 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: letsencrypt
+  namespace: default
+spec:
+  acme:
+    # The ACME server URL
+    # production is https://acme-v02.api.letsencrypt.org/directory
+    # stagiong is https://acme-staging-v02.api.letsencrypt.org/directory
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: himself@stevenpolley.net
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt
+    # Enable the HTTP-01 challenge provider
+    solvers:
+    # An empty 'selector' means that this solver matches all domains
+    - selector: {}
+      http01:
+        ingress:
+          ingressClassName: nginx