MicroK8s: Multi-Node, Ingress and TLS

Join nodes. On the first node:

microk8s add-node

It prints a microk8s join <ip>:25000/<token> command to run on the next node. With three or more control-plane nodes MicroK8s becomes highly available using its built-in dqlite datastore. Check with microk8s status. Add workers with microk8s join ... --worker.

Publish an app. With the ingress add-on enabled:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  ingressClassName: public
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend: { service: { name: shop, port: { number: 80 } } }

MicroK8s names its ingress class public. Create the Let’s Encrypt ClusterIssuer as in the cert-manager post, and make sure ports 80 and 443 reach the node.

On a private network with no internet DNS, use a CA issuer backed by your own certificate authority, and install that CA on client machines.