4

Coming from Docker

When I was still using Docker for running my services I had an nginx reverse proxy that handled issuing and signing certificates through letsencrypt automatically.

Using this setup, I was able to host a public site service.example.com that did nothing but redirect the user to example.com. The benefit of this was that the reverse proxy setup would then issue and get a certificate signed that I could then use internally.

Using a local DNS on my internal network I could then access my internal service service.example.com using a trusted and signed certificate. All without exposing it to the public.

Now in Kubernetes

Now I am slowly learning to use Kubernetes and want to achieve the same result. Is there any best practise/good way to accomplish the same in Kubernetes?

I am currently running an nginx ingress controller paired with cert manager which is working perfectly for all my exposed services.

Improve this question
5
  • You plan to use kubernetes locally? How did you setup currently? Do you use Minikube? kubernetes.io/docs/tasks/access-application-cluster/… this provides how to run minikube locally. Although I'd personally use traefik, so I could access services like "myservice.localhost" :)
    – holms
    Oct 3, 2021 at 1:32
  • @holms I am using microk8s on my home server in an attempt to learn Kubernetes on my free time. I am already exposing some services to the internet using Letsencrypt to get my certificates signed. But some services such as the PiHole admin GUI and the ArgoCD GUI should only be accessible to users on my home network. Therefore I am having trouble setting up infrastructure for those services to get their certificates signed. Right now these internal services are exposed using LoadBalancer services, but I would prefer an ingress with certificates from some sort of internally trusted CA. But how?
    – Hannes Knutsson
    Oct 3, 2021 at 10:27
  • You can't have internally trusted CA locally, even if you'd buy root cert from CA provider for local domain still browsers wouldn't see it as trusted. Check this topic: security.stackexchange.com/questions/121163/… What I'd do is having a proper public domain available only for letsencrypt and yourself, just setup firewall on your router or smtng. I'd personally just disable https at all and problem solved. You do expect some untrusted guests in your local network to have https..?
    – holms
    Oct 4, 2021 at 23:52
  • @holms Could I not import my own CA as a trusted root CA in my browser and issue certificates using that? What would be wrong about doing so? I just want as little "hacky" solutions as possible.
    – Hannes Knutsson
    Oct 5, 2021 at 21:36
  • quite recently ff doesn't even allow to import self-generated certs.. at least that what I've been dealing recently when I've needed to use self-generated certs.
    – holms
    Oct 12, 2021 at 23:17

1 Answer 1

Reset to default
1

Have you try to do it by Port Forwarding your configured service with TLS to your local machine ?
I've never tried but it seams to be possible with it.

Maybe you can find something here : https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/

Improve this answer
1
  • This would technically work, but I don't think it is best practice. From what I've understood so far, port forwarding like that is meant for debugging purposes. What I believe I am looking for is some sort of CA solution compatible with Kubernetes, but since I am new I am not sure what really is the best practice and am looking for input on that. Thanks for your response though! I appreciate it .
    – Hannes Knutsson
    Oct 1, 2021 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.