86 lines
1.7 KiB
Markdown
86 lines
1.7 KiB
Markdown
# CKS-009 — Add TLS to an existing Ingress
|
|
|
|
Domain: **1.3 Ingress TLS**
|
|
Time: **6 minutes** · Score: **Section B only**
|
|
|
|
## Existing configuration
|
|
|
|
Certificate files already exist:
|
|
|
|
```text
|
|
/opt/certs/store.crt
|
|
/opt/certs/store.key
|
|
```
|
|
|
|
The complete existing Ingress is:
|
|
|
|
```yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: storefront
|
|
namespace: shop
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: store.example.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: storefront
|
|
port:
|
|
number: 80
|
|
```
|
|
|
|
## Task
|
|
|
|
1. Inspect the certificate and confirm it covers `store.example.com`.
|
|
2. Create TLS Secret `storefront-tls` in namespace `shop` from the supplied files.
|
|
3. Update the Ingress for TLS using that Secret without changing its existing route.
|
|
4. Verify the Secret type and show the final Ingress.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
k create secret -n shop tls storefront-tls --cert=/opt/certs/store.crt --key=/opt/certs/store.key
|
|
```
|
|
|
|
```yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: storefront
|
|
namespace: shop
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
|
|
spec:
|
|
ingressClassName: nginx
|
|
|
|
tls:
|
|
- hosts:
|
|
- store.example.com
|
|
secretName: storefront-tls
|
|
rules:
|
|
- host: store.example.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: storefront
|
|
port:
|
|
number: 80
|
|
|
|
k get ingress -n shop storefront
|
|
k describe ingress -n shop storefront
|
|
```
|
|
|
|
Say **Grade CKS-009** when saved.
|