Ian Harris

A collection of my personal projects, interests and ideas. If you have any questions or fancy a chat, please feel free to drop me a line.

© 2026. All rights reserved.

Raspberry Pi Cluster, Part 7 - SSL

04 Oct 2021

Here we are, the last push to complete this project. Let’s add a SSL certificate to encrypt all traffic to the cluster ensure that the site is as secure as possible. Once that is done, we can take a look at automating the deployment process.

If you have been following along and you have setup Cloudflare as per the previous post, you should see that your website is already protected with a SSL certificate. So why do we need to add another certificate on our server?

Good question. What is happening now is that all connections to the Cloudflare proxy are encrypted, but any connections from Cloudflare to our website are not and any data will be sent over the wire in plain text. Ideally, we want full encryption to our cluster, so we are going to install Let’s Encrypt on the cluster to solve this problem.

Installing Cert Manager

Let’s dive straight into it - the first task is to create a new namespace in Kubernetes so that we can keep all the SSL stuff in its own little bubble:

kubectl create namespace cert-manager

Installing Cert Manager is pretty easy, it’s a single command. Just make sure you replace the version number with the current available version. For me, this was v1.6.1:

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.1/cert-manager.yaml

Once the install has finished, we next need to create a new ClusterIssuer resource on the Create a new file with sudo nano letsencrypt.yml and copy in the following:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: <email-address>
    privateKeySecretRef:
      name: blog-website-tls
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress:
          class: traefik

Replace <email-address> with your email address and keep an note of the name that you assigned for privateKeySecretRef property.

Finally, tell Kubernetes to use our cert-manager manifest file by running:

kubectl apply -f letsencrypt.yml

We can check to make sure everything is working expected by running:

kubectl describe clusterissuer letsencrypt-prod

All being well, we should see that everything is running and the Issuer is returning a Ready status. You may need to give it a couple of minutes to sort itself out.

Updating the ingress

After we have install the means of issuing a Let’s Encrypt certificate on the cluster, we now need to update the Ingress that we configured previously to use TLS and to apply for a certificate. Open up the Ingress manifest again with sudo nano ingress.yml and update it so it looks like this:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: blog-website-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
    cert-manager.io/cluster-issuer: letsencrypt-prod
    acme.cert-manager.io/http01-edit-in-place: "true"
spec:
  tls:
    - secretName: blog-website-tls
      hosts:
        - <external-domain>
  rules:
  - host: <external-domain>
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: blog-website-service
            port:
              number: 80

Make sure you double-check the names and domains like you did before. Also make sure your annotations match the names that you used when you created the ClusterIssuer, for me this is letsencrypt-prod. It’s very easy to get a name mis-match here and you can spend a long, long time trying to track this down. Again, I bet you can’t guess how I know this.

Last job, we need to reapply the manifest:

kubectl apply -f ingress.yml

It will take a few minutes, Let’s Encrypt with dial home with the cluster details and after a few minutes, you should be able to access the cluster directly on https:. If you go into the Cloudflare control panel, you should now be able to set up Full encryption to ensure that all of the data transmissions are secure.

Next, Part 8 - Automation

Related Posts