← All notes

Visualization service - Setup K8s on Digital Ocean

projectchatbotk8s

Setting Up Kubernetes on DigitalOcean with HTTPS

This guide walks through setting up a production-ready Kubernetes cluster on DigitalOcean with automatic SSL certificate management using Let’s Encrypt.

Overview

We’ll set up:

  • DigitalOcean Kubernetes cluster
  • NGINX Ingress Controller
  • cert-manager for automatic SSL certificates
  • Domain configuration with HTTPS
  • Test application to verify everything works

Prerequisites

  • DigitalOcean account
  • Domain name (I used my own domain zeelu.me with subdomain ingresstest.do.zeelu.me)
  • kubectl configured to access your cluster
  • helm package manager

Step 1: Create DigitalOcean Kubernetes Cluster

  1. Go to DigitalOcean Control Panel
  2. Navigate to Kubernetes → Create Cluster
  3. Choose your configuration:
    • Datacenter: I used Toronto Datacenter
    • Node pool: I only get 1 nodes for testing purpose, which I get vCPU: 1 Shared, vRAM: 2 GB, Storage: 50 GB for $12/month
    • Node size: Basic plan (2GB RAM minimum) - The cheapest plan
  4. Click Create Cluster

Step 2: Configure kubectl

After the cluster is created, it will pop up some instructions, simply follow the DigitalOcean’s guide to install doctl, and set up the kubeconfig.

Step 3: Install Helm

Install Helm package manager:

Terminalbash
1# On macOS with Homebrew2brew install helm3​4# Verify installation5helm version

Add required repositories:

Terminalbash
1helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx2helm repo add jetstack https://charts.jetstack.io3helm repo update

Step 4: Install NGINX Ingress Controller

Install the NGINX Ingress Controller:

Terminalbash
1helm install ingress-nginx ingress-nginx/ingress-nginx \2  --namespace ingress-nginx \3  --create-namespace

Check the installation:

Terminalbash
1kubectl get pods --namespace ingress-nginx2kubectl get service --namespace ingress-nginx ingress-nginx-controller --output wide

Wait for the load balancer to get an external IP (usually 1-2 minutes).

Step 5: Configure DNS

  1. Go to DigitalOcean → Networking → Domains
  2. Find your domain (zeelu.me)
  3. Add an A record:
    • Name: ingresstest (for ingresstest.do.zeelu.me)
    • Value: YOUR_LOAD_BALANCER_IP (from step 4) - Normally you can select from the dropdown list
    • TTL: default

Test DNS resolution:

Use nslookup or simply view the domain in the browser

Terminalbash
1nslookup ingresstest.do.zeelu.me

Step 6: Install cert-manager

Install cert-manager for automatic SSL certificate management:

Terminalbash
1helm install cert-manager jetstack/cert-manager \2  --namespace cert-manager \3  --create-namespace \4  --set installCRDs=true

Verify installation:

Terminalbash
1kubectl get pods --namespace cert-manager

Step 7: Configure Let’s Encrypt Issuer

Create a ClusterIssuer for Let’s Encrypt:

yaml
1# letsencrypt-issuer.yaml2apiVersion: cert-manager.io/v13kind: ClusterIssuer4metadata:5  name: letsencrypt-prod6spec:7  acme:8    # The ACME server URL9    server: https://acme-v02.api.letsencrypt.org/directory10    # Email address used for ACME registration11    email: your-email@domain.com  # Replace with your email12    # Name of a secret used to store the ACME account private key13    privateKeySecretRef:14      name: letsencrypt-prod15    # Enable the HTTP-01 challenge provider16    solvers:17    - http01:18        ingress:19          class: nginx

Apply the configuration:

Terminalbash
1kubectl apply -f letsencrypt-issuer.yaml

Check the issuer status:

Terminalbash
1kubectl get clusterissuer letsencrypt-prod2# Should show READY=True

Step 8: Deploy Test Application

Create a simple test application:

Terminalbash
1# Deploy nginx test app2kubectl create deployment test-app --image=nginx:alpine3kubectl expose deployment test-app --port=80 --type=ClusterIP

Step 9: Configure HTTPS Ingress

Create an ingress with SSL certificate:

yaml
1# test-ingress.yaml2apiVersion: networking.k8s.io/v13kind: Ingress4metadata:5  name: test-ingress6  namespace: default7  annotations:8    cert-manager.io/cluster-issuer: "letsencrypt-prod"9spec:10  ingressClassName: nginx11  tls:12  - hosts:13    - ingresstest.do.zeelu.me14    secretName: ingresstest-tls15  rules:16    - host: ingresstest.do.zeelu.me17      http:18        paths:19          - path: /20            pathType: Prefix21            backend:22              service:23                name: test-app24                port:25                  number: 80

Apply the ingress:

Terminalbash
1kubectl apply -f test-ingress.yaml

Step 10: Verify SSL Certificate

Check certificate status:

Terminalbash
1kubectl get certificates2kubectl describe certificate ingresstest-tls

Wait for the certificate to be issued (usually 1-2 minutes). You should see READY=True.

Step 11: Test HTTPS

Test both HTTP and HTTPS:

Terminalbash
1# Test HTTP2curl http://ingresstest.do.zeelu.me3​4# Test HTTPS5curl https://ingresstest.do.zeelu.me6​7# Test with headers8curl -I https://ingresstest.do.zeelu.me

You should see:

  • HTTP/2 response
  • strict-transport-security header
  • Valid SSL certificate

Step 12: Browser Test

Visit https://ingresstest.do.zeelu.me in your browser. You should see the nginx welcome page.

Troubleshooting

DNS Issues

Terminalbash
1# Check DNS resolution2nslookup ingresstest.do.zeelu.me3dig ingresstest.do.zeelu.me4​5# Test direct IP6curl -H "Host: ingresstest.do.zeelu.me" http://YOUR_LOAD_BALANCER_IP

Certificate Issues

Terminalbash
1# Check certificate status2kubectl get certificates3kubectl describe certificate ingresstest-tls4​5# Check challenges6kubectl get challenges7kubectl describe challenge CHALLENGE_NAME8​9# Check orders10kubectl get orders11kubectl describe order ORDER_NAME

Ingress Issues

Terminalbash
1# Check ingress status2kubectl get ingress3kubectl describe ingress test-ingress4​5# Check ingress controller logs6kubectl logs -n ingress-nginx deployment/ingress-nginx-controller

Cleanup

To remove test resources:

Terminalbash
1# Delete test application2kubectl delete deployment test-app3kubectl delete service test-app4kubectl delete ingress test-ingress5kubectl delete certificate ingresstest-tls6​7# Delete ingress controller (optional)8helm uninstall ingress-nginx --namespace ingress-nginx9​10# Delete cert-manager (optional)11helm uninstall cert-manager --namespace cert-manager

Resources

← Back to the journal