Install Deepfactor portal using Helm

Download the required helper scripts from Deepfactor.

# create a directory for the files
mkdir deepfactor-certs

# change directory
cd deepfactor-certs/

wget https://static.deepfactor.io/scripts/public/df-portal/cert-gen/generate-cert.sh
wget https://static.deepfactor.io/scripts/public/df-portal/cert-gen/openssl-portal.cnf
wget https://static.deepfactor.io/scripts/public/df-portal/cert-gen/openssl-portalca.cnf

Generate certificate

Navigate to the download directory and run the script generate-cert.sh with your preferred domain name as the argument to the script.

chmod +x generate-cert.sh
sudo ./generate-cert.sh <DNS-of-your-portal>

Create Kubernetes secret from the certificates generated by the previous step.

# create new certificates secret
kubectl -n deepfactor create secret generic df-certs-ingress \
 --from-file=tls.crt=portal.crt --from-file=tls.key=portal.key \
 --from-file=ca.crt=portalca.crt

Install Cert Manager

helm repo add jetstack https://charts.jetstack.io
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.1/cert-manager.crds.yaml
helm install \
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.6.1 \
--set prometheus.enabled=false

Create an IAM OIDC provider for your cluster

https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html

Create a service account for AWS PCA issuer and add helm

In the following example, pls replace the AWS zone as applicable.

eksctl create iamserviceaccount \
 --region=us-east-2 \
 --cluster=qa-test-awspca \
 --namespace=aws-pca-issuer \
 --name=aws-pca-issuer \
 --attach-policy-arn=arn:aws:iam::<Your Account ID>:policy/certificate-manager-policy \
 --override-existing-serviceaccounts --approve

Install Helm Chart For AWS PCA

helm repo add awspca https://cert-manager.github.io/aws-privateca-issuer 
helm repo update 
helm install aws-pca-issuer awspca/aws-privateca-issuer -n aws-pca-issuer \
      --set serviceAccount.create=false --set serviceAccount.name=aws-pca-issuer

Create issuer for AWS PCA

cat <<EOF | kubectl -n deepfactor apply -f -
apiVersion: awspca.cert-manager.io/v1beta1
kind: AWSPCAIssuer
metadata:
  name: df-awspcs-issuer
spec:
  arn: arn:aws:acm-pca:us-east-2:<Your Account ID>:certificate-authority/b7a66d42-65da-4970-9ebe-429988b68430
  region: us-east-2
EOF

Create certificate for the portal

Create yaml for Certificate as follows.

kind: Certificate
apiVersion: cert-manager.io/v1
metadata:
  name: app.deepfactor.io
spec:
  commonName: app.deepfactor.io
  dnsNames:
    - app.deepfactor.io
  duration: 2160h0m0s
  issuerRef:
    group: awspca.cert-manager.io
    kind: AWSPCAIssuer
    name: df-awspcs-issuer
  renewBefore: 360h0m0s
  secretName: app.deepfactor.io
  usages:
    - server auth
    - client auth
  privateKey:
    algorithm: "RSA"
    size: 2048

Use the following commands to create the certificate using the file (cert.yaml) created above

kubectl -n deepfactor apply -f cert.yaml

Check certificate status

alice@localhost:~$ kubectl -n deepfactor get certificate 
NAME                READY    SECRET                 AGE 
app.deepfactor.io   True     app.deepfactor.io      13s

Install Cert Manager

helm repo add jetstack https://charts.jetstack.io 
helm repo update
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.1/cert-manager.crds.yaml 
helm install \
 cert-manager jetstack/cert-manager \
 --namespace cert-manager \
 --create-namespace \
 --version v1.6.1 \
 --set prometheus.enabled=false

Create issuer for Let’s Encrypt

Create yaml file, le-issuer.yaml for Let's Encrypt issuer as follows. Replace the highlighted configs as applicable

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: matt@example.io
    privateKeySecretRef:
      name: letsencrypt-issuer
    solvers:
      - http01:
          ingress:
            class: df-ingress-nginx

Use the following command to create issuer for Let's encrypt using the file (le-issuer.yaml) created above

kubectl -n deepfactor apply -f le-issuer.yaml

Create CA certificate

wget https://letsencrypt.org/certs/isrgrootx1.pem
kubectl -n deepfactor create secret generic deepfactor-certs --from-file=portalca.crt=isrgrootx1.pem

Create a certificate for the portal

Create yaml for Certificate as follows. Replace the highlighted configs as applicable

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: dfp-letsencrypt.dmux.in
spec:
  secretName: dfp-letsencrypt.dmux.in
  dnsNames:
  - dfp-letsencrypt.dmux.in
  issuerRef:
    name: letsencrypt-issuer
    kind: Issuer
    group: cert-manager.io

Use the following commands to create a Let's Encrypt certificate using the file (cert.yaml) created above

kubectl -n deepfactor apply -f cert.yaml