Getting Started

In this tutorial, we will use the Route53 LEGO K8s charm to obtain a certificates from Let’s Encrypt for a requiring charm using the TLS Certificates Requirer Operator as our TLS certificates requirer. This tutorial assumes that you have a Hosted Zone in AWS Route53.

1. Install pre-requisites

Install MicroK8s:

sudo snap install microk8s

Enable the hostpath-storage MicroK8s add-on:

microk8s enable hostpath-storage

Install Juju:

sudo snap install juju

2. Bootstrap a Juju controller

Bootstrap a Juju controller:

juju bootstrap microk8s

Create a Juju model:

juju add-model demo

3. Deploy Route53 LEGO K8s

Deploy the Route53 Lego K8s charm:

juju deploy route53-lego-k8s

Configure the charm with your ACME and AWS information:

juju config \
  server=https://acme-staging-v02.api.letsencrypt.org/directory \
  email=test@gmail.com \
  aws_region=<your AWS region> \
  aws_hosted_zone_id=<your AWS Hosted Zone ID> \
  aws_access_key_id=<your AWS Access Key ID> \
  aws_secret_access_key=<your AWS Secret Access Key>

Make sure to replace the AWS information with the appropriate one.

4. Deploy tls-certificates-requirer

Deploy TLS Certificates Requirer:

juju deploy tls-certificates-requirer --channel=edge

Configure the charm to use the same common name as in your AWS hosted zone:

juju config tls-certificates-requirer common_name=<your common name>

5. Integrate the two charms

Integrate the charms with their tls-certificates interface:

juju integrate route53-lego-k8s tls-certificates-requirer

Wait for both charms to be in the active/idle status. This can take a couple of minutes as the Route53 LEGO K8s charm makes its request to the ACME server. Once this is completed, you should see the following:

ubuntu@server:~$ juju status
Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo   microk8s-localhost  microk8s/localhost  3.1.7    unsupported  10:25:05-05:00

App                        Version  Status   Scale  Charm                      Channel  Rev  Address        Exposed  Message
route53-lego-k8s                    waiting      1  route53-lego-k8s           stable     7  10.152.183.24  no       installing agent
tls-certificates-requirer           active       1  tls-certificates-requirer             0  10.152.183.33  no       Certificate is available

Unit                          Workload  Agent  Address      Ports  Message
route53-lego-k8s/0*           active    idle   10.1.182.53         
tls-certificates-requirer/0*  active    idle   10.1.182.57         Certificate is available

6. Retrieve the TLS Certificates

Use the TLS Certificates Requirer’s get-certificate action to retrieve the Let’s Encrypt certificate:

juju run tls-certificates-requirer/0 get-certificate

You should expect this output (with different certificates of course)

ubuntu@server:~$ juju run tls-certificates-requirer/0 get-certificate
Running operation 3 with 1 task
  - task 4 on unit-tls-certificates-requirer-0

Waiting for task 4...
ca-certificate: |-
  -----BEGIN CERTIFICATE-----
  MIIFVDCCBDygAwIBAgIRAO1dW8lt+99NPs1qSY3Rs8cwDQYJKoZIhvcNAQELBQAw
  cTELMAkGA1UEBhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1
  cml0eSBSZXNlYXJjaCBHcm91cDEtMCsGA1UEAxMkKFNUQUdJTkcpIERvY3RvcmVk
  IER1cmlhbiBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQw
  M1owZjELMAkGA1UEBhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBT
  ZWN1cml0eSBSZXNlYXJjaCBHcm91cDEiMCAGA1UEAxMZKFNUQUdJTkcpIFByZXRl
  bmQgUGVhciBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbagEdD
  Ta1QgGBWSYkyMhscZXENOBaVRTMX1hceJENgsL0Ma49D3MilI4KS38mtkmdF6cPW
  nL++fgehT0FbRHZgjOEr8UAN4jH6omjrbTD++VZneTsMVaGamQmDdFl5g1gYaigk
  kmx8OiCO68a4QXg4wSyn6iDipKP8utsE+x1E28SA75HOYqpdrk4HGxuULvlr03wZ
  GTIf/oRt2/c+dYmDoaJhge+GOrLAEQByO7+8+vzOwpNAPEx6LW+crEEZ7eBXih6V
  P19sTGy3yfqK5tPtTdXXCOQMKAp+gCj/VByhmIr+0iNDC540gtvV303WpcbwnkkL
  YC0Ft2cYUyHtkstOfRcRO+K2cZozoSwVPyB8/J9RpcRK3jgnX9lujfwA/pAbP0J2
  UPQFxmWFRQnFjaq6rkqbNEBgLy+kFL1NEsRbvFbKrRi5bYy2lNms2NJPZvdNQbT/
  2dBZKmJqxHkxCuOQFjhJQNeO+Njm1Z1iATS/3rts2yZlqXKsxQUzN6vNbD8KnXRM
  EeOXUYvbV4lqfCf8mS14WEbSiMy87GB5S9ucSV1XUrlTG5UGcMSZOBcEUpisRPEm
  QWUOTWIoDQ5FOia/GI+Ki523r2ruEmbmG37EBSBXdxIdndqrjy+QVAmCebyDx9eV
  EGOIpn26bW5LKerumJxa/CFBaKi4bRvmdJRLAgMBAAGjgfEwge4wDgYDVR0PAQH/
  BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLXzZfL+sAqSH/s8ffNE
  oKxjJcMUMB8GA1UdIwQYMBaAFAhX2onHolN5DE/d4JCPdLriJ3NEMDgGCCsGAQUF
  BwEBBCwwKjAoBggrBgEFBQcwAoYcaHR0cDovL3N0Zy1kc3QzLmkubGVuY3Iub3Jn
  LzAtBgNVHR8EJjAkMCKgIKAehhxodHRwOi8vc3RnLWRzdDMuYy5sZW5jci5vcmcv
  MCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQBgt8TAQEBMA0GCSqGSIb3DQEB
  CwUAA4IBAQB7tR8B0eIQSS6MhP5kuvGth+dN02DsIhr0yJtk2ehIcPIqSxRRmHGl
  4u2c3QlvEpeRDp2w7eQdRTlI/WnNhY4JOofpMf2zwABgBWtAu0VooQcZZTpQruig
  F/z6xYkBk3UHkjeqxzMN3d1EqGusxJoqgdTouZ5X5QTTIee9nQ3LEhWnRSXDx7Y0
  ttR1BGfcdqHopO4IBqAhbkKRjF5zj7OD8cG35omywUbZtOJnftiI0nFcRaxbXo0v
  oDfLD0S6+AC2R3tKpqjkNX6/91hrRFglUakyMcZU/xleqbv6+Lr3YD8PsBTub6lI
  oZ2lS38fL18Aon458fbc0BPHtenfhKj5
  -----END CERTIFICATE-----
certificate: |-
  -----BEGIN CERTIFICATE-----
  MIIFLDCCBBSgAwIBAgISKwAxw9n9Zd/jc81/j0iyAVhFMA0GCSqGSIb3DQEBCwUA
  MFkxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExcoU1RBR0lORykgTGV0J3MgRW5jcnlw
  dDEoMCYGA1UEAxMfKFNUQUdJTkcpIEFydGlmaWNpYWwgQXByaWNvdCBSMzAeFw0y
  NDAxMTcxNDI0NThaFw0yNDA0MTYxNDI0NTdaMCMxITAfBgNVBAMTGHBpenphLmNh
  bm9uaWNhbHRlbGNvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
  AKf527FKvKx32VFxZhz6eQPr7J5KUhLifbD0rJHpDwAvuKBjDBALqYMmQNYNjQO9
  r/cHqtt8+WWBLBB3l4+jeEgkFPJ4XW3pcdEeKVrlKbwyZzJ5DlXjRxAf3kigLApK
  7P/HGWUelSFpx0SYfcC0QwKmH1FEVxkehIcwQBjsz2Yq25/T8fqzRavsKWRCkxwr
  cfwuuMCJf392JeHWvQoeeLbv3rwd1r0gK6Qnwpf3XmsY+Hif5D0mvWzoeqAjbZ4q
  WEG5vEKLcQ3npSKq4iLlxk3V15Ggq1nOPrmAPgqqQKd6PgOD9uyrwnuv6ZQ3AvFy
  sDaRL86krLcnwfnz258ti1kCAwEAAaOCAiIwggIeMA4GA1UdDwEB/wQEAwIFoDAd
  BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
  HQ4EFgQUziLKzmQC8iK2XAbPPiHCix8KQCwwHwYDVR0jBBgwFoAU3nJ6SN8xw6ZQ
  35+FI99XN0tdLmUwXQYIKwYBBQUHAQEEUTBPMCUGCCsGAQUFBzABhhlodHRwOi8v
  c3RnLXIzLm8ubGVuY3Iub3JnMCYGCCsGAQUFBzAChhpodHRwOi8vc3RnLXIzLmku
  bGVuY3Iub3JnLzAjBgNVHREEHDAaghhwaXp6YS5jYW5vbmljYWx0ZWxjby5jb20w
  EwYDVR0gBAwwCjAIBgZngQwBAgEwggEEBgorBgEEAdZ5AgQCBIH1BIHyAPAAdgAo
  dhoYkCf77zzQ1hoBjXawUFcpx6dBG8y99gT0XUJhUwAAAY0YBotuAAAEAwBHMEUC
  IF0W5ERRXpAhi27UAd5mTp01uT5BBcP8Xyx61wCTySUcAiEAyfCwKizK2G8DU/3s
  WZkGDEHz3s3uZ3r+L5WZJcP5Yf8AdgCwzIPlpfl9a698CcwoSQSHKsfoixMsY1C3
  xv0m4WxsdwAAAY0YBotKAAAEAwBHMEUCIBAaKbSnKjO8kWbKHbsQwmBobmQ2yVeV
  J9pRGebVM9bDAiEA/iyGQRBZjGMY+zbg1gTuIBzJ9m2BL2UUOqRnbGWFyKEwDQYJ
  KoZIhvcNAQELBQADggEBAKZBaUVppLENs4IZc5yL//WfNJ9qneTKl4doEf+2wA4p
  bt4vGCVtTPb4S1+IEqA59SsFgk4nLTEJLlZQCB0Czcf+9FUbWp6jmlDVuue3jqok
  oecNFCVFGeFs+3PiWxKYraZDqZEYLs797bxvStIHH2+QDxXb0pqi9UNSq1hb1tx7
  2QzpCQ1TAQ1Gk/RVMh4RmGggywxMr/TneYOETNMslhWCLmuXU53le0u3CNmTKTkV
  9gnuiQD9HfDRan5CfzYSeZDm9XxjwB05z8J9RRazsVaSEwoBr0fLnJyEKNBceFfH
  eEObXNuFCdpw7lVLOxTxLSkeh7YGvlBp6HS9AjvyTlg=
  -----END CERTIFICATE-----
csr: |-
  -----BEGIN CERTIFICATE REQUEST-----
  MIIClzCCAX8CAQAwUjEhMB8GA1UEAwwYcGl6emEuY2Fub25pY2FsdGVsY28uY29t
  MS0wKwYDVQQtDCRiNTdmNmU2Ni1kNzRiLTQyOTUtODEzYS1jNGMwNTRmNzljZWMw
  ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCn+duxSrysd9lRcWYc+nkD
  6+yeSlIS4n2w9KyR6Q8AL7igYwwQC6mDJkDWDY0Dva/3B6rbfPllgSwQd5ePo3hI
  JBTyeF1t6XHRHila5Sm8MmcyeQ5V40cQH95IoCwKSuz/xxllHpUhacdEmH3AtEMC
  ph9RRFcZHoSHMEAY7M9mKtuf0/H6s0Wr7ClkQpMcK3H8LrjAiX9/diXh1r0KHni2
  7968Hda9ICukJ8KX915rGPh4n+Q9Jr1s6HqgI22eKlhBubxCi3EN56UiquIi5cZN
  1deRoKtZzj65gD4KqkCnej4Dg/bsq8J7r+mUNwLxcrA2kS/OpKy3J8H589ufLYtZ
  AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAoRKeqvD50ZsJNR39cBs98POY1fFt
  AO1Ss0qpIwzHuZUUxqxspAMe+J/yCSw5SsBtyhUBdjnzJeYv9IAVCJQmToM7N7SL
  3bEQOnTMj+7aPr8K00g5tDfKsuyDOJydfmEgi0yZuMGOPAkIVFkG4dhDFqD8pc6y
  Sp78RUc2YTQbR0jrF0oCl8v4pMG199h3y7+nlqChMvYPEjw1y/9jxQmwWRwtfY51
  8kpE2qMFYTnfvTCkLTCGmXEvfvyu6+IdncoafDrQ/bRompcl2RdYqMTYxTcqOCvs
  2tlJVuVkj5NwruxyYedJgHwtSwpuss6aS/pA7jOU8d2c/qI3RgTfuQCrAA==
  -----END CERTIFICATE REQUEST-----

There you go, you have obtained certificates from Let’s Encrypt!

7. Destroy the environment

Kill the Juju controller:

juju kill-controller microk8s-localhost

Uninstall the Juju and MicroK8s snaps:

sudo snap remove microk8s juju --purge