Temporary Let's Encrypt certificate

Procedure to issue a temporary certificate signed by Let's Encrypt for tst.lets.ef3.in on Kubernetes with Istio.

Create temporary instance for certbot

Save as temp-letsencrypt-server.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: certbot-temp
  namespace: ls-lets-website-tst
  labels:
    app: certbot-temp
spec:
  containers:
  - name: nginx
    image: nginx
    ports:
    - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: certbot-temp-svc
  namespace: ls-lets-website-tst
spec:
  selector:
    app: certbot-temp
  ports:
  - port: 80
    targetPort: 80

Apply it:

kubectl -n ls-lets-website-tst apply -f temp-letsencrypt-server.yaml

Route the acme-challenge to the certbot instance

The virtualservice is an Istio entity. Add this match to the routes:

kubectl -n ls-lets-website-tst edit virtualservice ls-lets-vs

  - match:
    - uri:
        prefix: /.well-known/acme-challenge/
    route:
    - destination:
        host: certbot-temp-svc
        port:
          number: 80

Create certificate

kubectl exec -it certbot-temp -n ls-lets-website-tst -- bash

# Inside the certbot pod: install certbot
apt-get update && apt-get install -y certbot

# Inside the pod: request the certificate
certbot certonly --webroot -w /usr/share/nginx/html -d tst.lets.ef3.in

exit

Copy the new certificate and the key

kubectl exec -n "ls-lets-website-tst" "certbot-temp" -- cat /etc/letsencrypt/live/tst.lets.ef3.in/fullchain.pem > tst.lets.fullchain.pem

kubectl exec -n "ls-lets-website-tst" "certbot-temp" -- cat /etc/letsencrypt/live/tst.lets.ef3.in/privkey.pem > tst.lets.key.pem

Check the certificate:

openssl x509 --noout -in tst.lets.fullchain.pem --text

Certificate:
    Data:
        Version: 3 (0x2)
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Let's Encrypt, CN = YE1
        Validity
            Not Before: Oct 13 13:01:42 2026 GMT
            Not After : Jan 11 13:01:41 2027 GMT
        Subject: CN = tst.lets.ef3.in
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
...

Create Istio secret

kubectl create secret tls tst.lets -n istio-ingress --key=tst.lets.key.pem --cert=tst.lets.fullchain.pem

Enable HTTPS at the gateway

kubectl -n ls-lets-website-tst edit gateway ls-lets-gateway

  - hosts:
    - tst.lets.ef3.in
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      credentialName: tst.lets
      mode: SIMPLE

Clean the environment

• Remove the locally saved *.pem files
• Remove the routing to the certbot pod
• Delete the certbot pod

rm *pem
kubectl -n ls-lets-website-tst edit virtualservice ls-lets-vs
kubectl -n ls-lets-website-tst delete -f temp-letsencrypt-server.yaml