Configure TLS certificates for Platform Base

By default Platform Base issues a self-signed certificate, so browsers warn about every hostname. This guide switches to ACME certificates, for example from Let's Encrypt.

All hostnames share one certificate, which covers every entry of baseDomains and its wildcard. Wildcard certificates need the DNS-01 challenge, so Platform Base supports ACME with a DNS-01 solver only.

Use ACME with Route 53

Add this to cluster/config.libsonnet:

tls+: {
  issuer+: {
    type: 'acme',
    acme+: {
      solver: 'route53',
      route53+: {
        accessKeyID: 'AKIAEXAMPLE',
        region: 'eu-central-1',
        hostedZoneID: 'Z0123456789',
      },
    },
  },
},

Create the Secret with the secret access key in the traefik namespace. cert-manager reads it from the namespace of the issuer:

kubectl -n traefik create secret generic route53-secret-access-key \
  --from-literal=secretAccessKey='<secret access key>'

To use another Secret name or key, set route53+: { secretAccessKey+: { secretRef+: { name: '...', key: '...' } } }. Alternatively, set secretAccessKey+: { value: '...' } and Platform Base creates the Secret for you, see Secret values.

Use another solver

Set acme.solver to one of these and configure the matching block under acme:

solver	Required options	Default Secret (namespace traefik)
route53	route53.accessKeyID	route53-secret-access-key, key secretAccessKey
cloudflare	none	cloudflare-api-token, key apiToken
cloudDNS	cloudDNS.project	clouddns-serviceaccount, key key.json
webhook	webhook.solverName	none

• cloudDNS.hostedZoneName is optional.
• webhook.groupName defaults to acme.<baseDomain> and webhook.config is passed to the webhook as it is.
• route53.hostedZoneID is optional and route53.region defaults to eu-central-1.

Change the ACME account

Option	Default
acme.server	https://acme-v02.api.letsencrypt.org/directory
acme.account.email	hostmaster@<baseDomain>, with the first base domain
acme.account.eab	null, for providers that need external account binding

Check the result

The tls Application creates an Issuer named traefik, a Certificate named basedomains-tls and a Secret named basedomains-wildcard-certs, all in the traefik namespace. It also creates the Traefik TLSStore default that serves this certificate. Wait until the Certificate is ready:

kubectl -n traefik get certificate basedomains-tls

Go back to the self-signed issuer

Set tls.issuer.type to selfSigned. To publish CRL distribution points in the certificate, set tls.issuer.selfSigned.crlDistributionPoints to a list of URLs.