{"id":505,"date":"2025-04-15T14:52:13","date_gmt":"2025-04-15T14:52:13","guid":{"rendered":"https:\/\/premsvmm.com\/?p=505"},"modified":"2025-04-15T15:00:36","modified_gmt":"2025-04-15T15:00:36","slug":"how-to-deploy-traefik-ingress-with-https-and-wildcard-tls-in-gke","status":"publish","type":"post","link":"https:\/\/premsvmm.com\/index.php\/2025\/04\/15\/how-to-deploy-traefik-ingress-with-https-and-wildcard-tls-in-gke\/","title":{"rendered":"How to Deploy Traefik Ingress with HTTPS and Wildcard TLS in GKE"},"content":{"rendered":"\n

This guide walks you through setting up a Google Kubernetes Engine (GKE) cluster with Traefik as an Ingress controller, enabling HTTPS for multiple subdomains<\/strong> using Let\u2019s Encrypt wildcard certificates<\/strong> via cert-manager<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\ude80 Step 1: Create a GKE Cluster<\/strong><\/p>\n\n\n\n

\ud83d\udd04 Note:<\/strong> Replace premsvmm-k8s with your preferred Kubernetes cluster name.<\/p>\n\n\n\n

gcloud container clusters create premsvmm-k8s \\\n  --zone asia-south1-a \\\n  --machine-type e2-medium \\\n  --num-nodes 2 \\\n  --enable-ip-alias<\/pre><\/div>\n\n\n\n
\ud83e\uddf1 Step 2: Create a Namespace for Traefik<\/strong><\/p>\n\n\n\n
kubectl create namespace traefik<\/pre><\/div>\n\n\n\n
\ud83c\udf10 Step 3: Install Traefik Ingress Controller<\/strong><\/p>\n\n\n\n
helm install traefik traefik\/traefik \\\n  --namespace traefik \\\n  --create-namespace \\\n  --set service.type=LoadBalancer \\\n  --set ports.web.port=8000 \\\n  --set ports.websecure.port=8443 \\\n  --set "entryPoints.web.address=:8000" \\\n  --set "entryPoints.web.http.redirections.entryPoint.to=websecure" \\\n  --set "entryPoints.web.http.redirections.entryPoint.scheme=https" \\\n  --set "entryPoints.web.http.redirections.entryPoint.permanent=true" \\\n  --set "entryPoints.websecure.address=:8443" \\\n  --set "securityContext.capabilities.drop[0]=ALL" \\\n  --set securityContext.runAsGroup=65532 \\\n  --set securityContext.runAsUser=65532 \\\n  --set securityContext.runAsNonRoot=true \\\n  --set dashboard.enabled=true \\\n  --set ingressRoute.dashboard.enabled=true \\\n  --set crds.enabled=true<\/pre><\/div>\n\n\n\n
\ud83e\udded Step 4: Create Dashboard IngressRoute<\/strong><\/p>\n\n\n\n
apiVersion: traefik.io\/v1alpha1\nkind: IngressRoute\nmetadata:\n  name: traefik-dashboard\n  namespace: traefik\nspec:\n  entryPoints:\n    - websecure\n  routes:\n    - match: Host(`traefik.k8s.premsvmm.xyz`)\n      kind: Rule\n      services:\n        - name: api@internal\n          kind: TraefikService<\/pre><\/div>\n\n\n\n
\ud83c\udf0d Step 5: Configure DNS A Record<\/strong><\/p>\n\n\n\n
Run the command <\/p>\n\n\n\n
kubectl get svc -n traefik<\/pre><\/div>\n\n\n\n
This will create an external IP. Copy the external IP and update your DNS record accordingly.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ud83d\udd12 Step 6: Install cert-manager for Auto TLS<\/strong><\/strong><\/p>\n\n\n\n
helm repo add jetstack https:\/\/charts.jetstack.io\nhelm repo update\n\nkubectl create namespace cert-manager\n\nhelm install cert-manager jetstack\/cert-manager \\\n  --namespace cert-manager \\\n  --create-namespace \\\n  --set installCRDs=true\n  \t<\/pre><\/div>\n\n\n\n
\ud83d\udec2 Step 7: Configure DNS-01 Challenge via Cloud DNS<\/strong><\/p>\n\n\n\n
Create GCP Service Account and Bind DNS Admin Role:<\/strong><\/p>\n\n\n\n
gcloud iam service-accounts create cert-manager-dns01-solver \\\n  --display-name "cert-manager dns01 solver"\n\ngcloud projects add-iam-policy-binding prem-1516640837807 \\\n  --member "serviceAccount:cert-manager-dns01-solver@prem-1516640837807.iam.gserviceaccount.com" \\\n  --role "roles\/dns.admin"\n\ngcloud iam service-accounts keys create key.json \\\n  --iam-account cert-manager-dns01-solver@prem-1516640837807.iam.gserviceaccount.com<\/pre><\/div>\n\n\n\n
Create Kubernetes Secret for the Key:<\/strong><\/p>\n\n\n\n
kubectl create secret generic clouddns-dns01-solver-sa \\\n  --from-file=key.json=key.json \\\n  -n cert-manager<\/pre><\/div>\n\n\n\n
\ud83d\udd10 Step 8: Create ClusterIssuer for Let\u2019s Encrypt<\/strong><\/p>\n\n\n\n
apiVersion: cert-manager.io\/v1\nkind: ClusterIssuer\nmetadata:\n  name: letsencrypt-dns\nspec:\n  acme:\n    email: prem.svmm@gmail.com\n    server: https:\/\/acme-v02.api.letsencrypt.org\/directory\n    privateKeySecretRef:\n      name: letsencrypt-dns-account-key\n    solvers:\n    - dns01:\n        cloudDNS:\n          project: prem-1516640837807\n          serviceAccountSecretRef:\n            name: clouddns-dns01-solver-sa\n            key: key.json<\/pre><\/div>\n\n\n\n
Apply it with:<\/p>\n\n\n\n
kubectl apply -f cluster-issuer.yaml<\/pre><\/div>\n\n\n\n
<\/p>\n\n\n\n
\ud83d\udcc4 Step 9: Request a Wildcard TLS Certificate<\/strong><\/p>\n\n\n\n
apiVersion: cert-manager.io\/v1\nkind: Certificate\nmetadata:\n  name: ssl-cret\n  namespace: traefik\nspec:\n  secretName: ssl-cret\n  issuerRef:\n    name: letsencrypt-dns\n    kind: ClusterIssuer\n  commonName: "*.k8s.premsvmm.xyz"\n  dnsNames:\n    - "*.k8s.premsvmm.xyz"\n    - "k8s.premsvmm.xyz"\n     <\/pre><\/div>\n\n\n\n
\ud83d\udd04 Step 10: Update Traefik Dashboard for HTTPS<\/strong><\/p>\n\n\n\n
apiVersion: traefik.io\/v1alpha1\nkind: IngressRoute\nmetadata:\n  name: traefik-dashboard\n  namespace: traefik\nspec:\n  entryPoints:\n    - websecure\n  routes:\n    - match: Host(`traefik.k8s.premsvmm.xyz`)\n      kind: Rule\n      services:\n        - name: api@internal\n          kind: TraefikService\n  tls:\n    secretName: ssl-cret<\/pre><\/div>\n\n\n\n
You can now access your secure dashboard at:<\/p>\n\n\n\n
\ud83d\udd17 https:\/\/traefik.k8s.premsvmm.xyz<\/a><\/p>\n\n\n\n
Step 11: Create App Namespace and Deploy Your Service<\/strong><\/p>\n\n\n\n
kubectl create namespace app<\/pre><\/div>\n\n\n\n
\ud83d\ude80 Step 12: Deploy Sample App with HTTPS IngressRoute<\/strong><\/p>\n\n\n\n
# app1-deployment.yaml\napiVersion: apps\/v1\nkind: Deployment\nmetadata:\n  name: app1-deployment\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: app1\n  template:\n    metadata:\n      labels:\n        app: app1\n    spec:\n      containers:\n      - name: whoami\n        image: traefik\/whoami\n        ports:\n        - containerPort: 80\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: app1-service\nspec:\n  selector:\n    app: app1\n  ports:\n  - protocol: TCP\n    port: 80\n    targetPort: 80\n---\napiVersion: traefik.io\/v1alpha1\nkind: IngressRoute\nmetadata:\n  name: app1-ingressroute\n  namespace: app\nspec:\n  entryPoints:\n    - websecure\n  routes:\n    - match: Host(`app1.k8s.premsvmm.xyz`) && PathPrefix(`\/`)\n      kind: Rule\n      services:\n        - name: app1-service\n          port: 80\n  tls:\n    secretName: ssl-cret\n    <\/pre><\/div>\n\n\n\n
\u2705 You can now access your app securely at<\/p>\n\n\n\n
\ud83d\udd17 https:\/\/app1.k8s.premsvmm.xyz<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ud83e\uddf9 Optional: Delete the Cluster<\/strong><\/p>\n\n\n\n
gcloud container clusters delete premsvmm-k8s \\\n  --zone asia-south1-a<\/pre><\/div>\n","protected":false},"excerpt":{"rendered":"
This guide walks you through setting up a Google Kubernetes Engine (GKE) cluster with Traefik as an Ingress controller, enabling HTTPS for multiple subdomains using Let\u2019s Encrypt wildcard certificates via cert-manager. \ud83d\ude80 Step 1: Create a GKE Cluster \ud83d\udd04 Note: Replace premsvmm-k8s with your preferred Kubernetes cluster name. \ud83e\uddf1 Step 2: Create a Namespace for …<\/p>\n
  How to Deploy Traefik Ingress with HTTPS and Wildcard TLS in GKE<\/span> Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-global-header-display":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","footnotes":""},"categories":[7],"tags":[16],"_links":{"self":[{"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/posts\/505"}],"collection":[{"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/comments?post=505"}],"version-history":[{"count":6,"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/posts\/505\/revisions"}],"predecessor-version":[{"id":519,"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/posts\/505\/revisions\/519"}],"wp:attachment":[{"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/media?parent=505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/categories?post=505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/premsvmm.com\/index.php\/wp-json\/wp\/v2\/tags?post=505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}