How to configure https on deployment yaml file for asp.net core app locally in minikube? - asp.net-core

Question

I have an ASP.NET Core app that I want to configure with HTTPS in my local kubernetes clustur using minikube.
The deployment yaml file is:
apiVersion: apps/v1
kind: Deployment
metadata:
name: kube-volume
labels:
app: kube-volume-app
spec:
replicas: 1
selector:
matchLabels:
component: web
template:
metadata:
labels:
component: web
spec:
containers:
- name: ckubevolume
image: kubevolume
imagePullPolicy: Never
ports:
- containerPort: 80
- containerPort: 443
env:
- name: ASPNETCORE_ENVIRONMENT
value: Development
- name: ASPNETCORE_URLS
value: https://+:443;http://+:80
- name: ASPNETCORE_HTTPS_PORT
value: '443'
- name: ASPNETCORE_Kestrel__Certificates__Default__Password
value: mypass123
- name: ASPNETCORE_Kestrel__Certificates__Default__Path
value: /app/https/aspnetapp.pfx
volumeMounts:
- name: ssl
mountPath: "/app/https"
volumes:
- name: ssl
configMap:
name: game-config
You can see i have added environment variables for https in yaml file.
I also created a service for this deployment. The yaml file of the service is:
apiVersion: v1
kind: Service
metadata:
name: service-1
spec:
type: NodePort
selector:
component: web
ports:
- name: http
protocol: TCP
port: 100
targetPort: 80
- name: https
protocol: TCP
port: 200
targetPort: 443
But unfortunately the app is not opening by the service when I run the minikube service service-1 command.
However when I remove the env variables for https then the app is opening by the service. These are the lines which when I remove the app opens:
- name: ASPNETCORE_URLS
value: https://+:443;http://+:80
- name: ASPNETCORE_HTTPS_PORT
value: '443'
- name: ASPNETCORE_Kestrel__Certificates__Default__Password
value: mypass123
- name: ASPNETCORE_Kestrel__Certificates__Default__Path
value: /app/https/aspnetapp.pfx
I also confirmed with the shell that the certificate is present in the /app/https folder.
Whay I am doing wrong?

Answer 1

I think your approach does not fit well with the architecture of Kubernetes. A TLS certificate (for https) is coupled to a hostname.
I would recommend one of two different approaches:
Expose your app with a Service of type: LoadBalancer
Expose your app with an Ingress resource
Expose your app with a Service of type LoadBalancer
This is typically called a Network LoadBalancer as it exposes your app for TCP or UDP directly.
See LoadBalancer access in the Minikube documentation. But beware that your app get an external address from your LoadBalancer, and your TLS certificate probably has to match that.
Expose your app with an Ingress resource
This is the most common approach for Microservices in Kubernetes. In addition to your Service of type: NodePort you also need to create an Ingress resource for your app.
The cluster needs an Ingress controller and the gateway will handle your TLS certificate, instead of your app.
See How to use custom TLS certificate with ingress addon for how to configure both Ingress and TLS certificate in Minikube.
I would recommend to go this route.