cks-final/submissions/CKS-009-reviewed.md

CKS-009 — Add TLS to an existing Ingress

Domain: 1.3 Ingress TLS
Time: 6 minutes · Score: Section B only

Existing configuration

Certificate files already exist:

/opt/certs/store.crt
/opt/certs/store.key

The complete existing Ingress is:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: storefront
  namespace: shop
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: store.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: storefront
            port:
              number: 80

Task

1. Inspect the certificate and confirm it covers store.example.com.
2. Create TLS Secret storefront-tls in namespace shop from the supplied files.
3. Update the Ingress for TLS using that Secret without changing its existing route.
4. Verify the Secret type and show the final Ingress.

Section B — scored answer

k create secret -n shop tls storefront-tls --cert=/opt/certs/store.crt --key=/opt/certs/store.key

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: storefront
  namespace: shop
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"

spec:
  ingressClassName: nginx

  tls:
  - hosts:
      - store.example.com
    secretName: storefront-tls
  rules:
  - host: store.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: storefront
            port:
              number: 80

k get ingress -n shop storefront
k describe ingress -n shop storefront

Say Grade CKS-009 when saved.