Panduan Lengkap Deploy Ingress NGINX dan Cert-Manager Kubernetes dengan HTTPS Otomatis (Let’s Encrypt)

🌟 Pendahuluan

Panduan ini menjelaskan langkah-langkah melakukan deployment Ingress NGINX dan Cert-Manager di Kubernetes dengan SSL otomatis dari Let’s Encrypt. Tutorial ini juga dilengkapi konfigurasi MetalLB untuk Load Balancer pada VPS atau bare-metal.

Selain itu, panduan ini mencakup setup redirect dari domain non-www ke www demi konsistensi SEO dan branding.

📁 Struktur Folder

.
├── cert-manager
│   ├── cert-manager-deploy.yaml
│   ├── cluster-issuer.yaml
│   └── namespace.yaml
├── ingress-nginx
│   ├── ingress-nginx-deploy.yaml
│   ├── ingress-nginx-svc.yaml
│   └── namespace.yaml
└── nginx-test
    ├── deployment.yaml
    ├── ingress-www.yaml
    ├── redirect-to-www.yaml
    └── service.yaml

🔧 Isi File YAML

📂 Folder cert-manager

1. cert-manager-deploy.yaml

Install cert-manager:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.0/cert-manager.yaml

2. cluster-issuer.yaml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod-private-key
    solvers:
    - http01:
        ingress:
          class: nginx

3. namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager

📂 Folder ingress-nginx

1. namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: ingress-nginx

2. ingress-nginx-deploy.yaml

Deployment NGINX Controller lengkap dengan konfigurasi:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/component: controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/component: controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/component: controller
    spec:
      serviceAccountName: ingress-nginx
      containers:
      - name: controller
        image: registry.k8s.io/ingress-nginx/controller:v1.10.1
        args:
          - /nginx-ingress-controller
          - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
          - --election-id=ingress-controller-leader
          - --controller-class=k8s.io/ingress-nginx
          - --ingress-class=nginx
          - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        ports:
          - name: http
            containerPort: 80
          - name: https
            containerPort: 443
        readinessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
        livenessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
        resources:
          limits:
            cpu: 500m
            memory: 512Mi
          requests:
            cpu: 250m
            memory: 256Mi

3. ingress-nginx-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https

📂 Folder nginx-test

1. deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-test
  template:
    metadata:
      labels:
        app: nginx-test
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

2. service.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-test
spec:
  selector:
    app: nginx-test
  ports:
    - port: 80
      targetPort: 80

3. ingress-www.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-test
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - www.masdika.my.id
    secretName: www-masdika-my-id-tls
  rules:
  - host: www.masdika.my.id
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-test
            port:
              number: 80

4. redirect-to-www.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: redirect-to-www
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/permanent-redirect: https://www.masdika.my.id$request_uri
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - masdika.my.id
    secretName: masdika-my-id-tls
  rules:
  - host: masdika.my.id
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: dummy
            port:
              number: 80

🚀 Langkah-Langkah Deploy Lengkap

1. Deploy Cert-Manager:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.0/cert-manager.yaml
kubectl apply -f cert-manager/cluster-issuer.yaml

2. Deploy Ingress NGINX:

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.11.3/deploy/static/provider/cloud/deploy.yaml

3. Deploy Aplikasi NGINX Test:

kubectl apply -f nginx-test/deployment.yaml
kubectl apply -f nginx-test/service.yaml

4. Buat Ingress untuk Domain Utama (www):

kubectl apply -f nginx-test/ingress-www.yaml

5. Buat Redirect dari Non-WWW ke WWW:

kubectl apply -f nginx-test/redirect-to-www.yaml

6. Verifikasi:

• 📅 Akses https://www.masdika.my.id ✔️ Berhasil
• 📅 Akses https://masdika.my.id ✔️ Redirect ke www
• 🔐 HTTPS valid dengan sertifikat dari Let’s Encrypt

🏁 Penutup

Dengan setup ini, kamu mendapatkan:

• 🌐 Load Balancer dengan Ingress NGINX
• 🔒 SSL/TLS otomatis dari Let’s Encrypt via Cert-Manager
• 🔁 Redirect non-www ke www otomatis
• 📁 Struktur folder rapi dan terorganisir