4

Coming from Docker

When I was still using Docker for running my services I had an nginx reverse proxy that handled issuing and signing certificates through letsencrypt automatically.

Using this setup, I was able to host a public site service.example.com that did nothing but redirect the user to example.com. The benefit of this was that the reverse proxy setup would then issue and get a certificate signed that I could then use internally.

Using a local DNS on my internal network I could then access my internal service service.example.com using a trusted and signed certificate. All without exposing it to the public.

Now in Kubernetes

Now I am slowly learning to use Kubernetes and want to achieve the same result. Is there any best practise/good way to accomplish the same in Kubernetes?

I am currently running an nginx ingress controller paired with cert manager which is working perfectly for all my exposed services.

5
  • You plan to use kubernetes locally? How did you setup currently? Do you use Minikube? kubernetes.io/docs/tasks/access-application-cluster/… this provides how to run minikube locally. Although I'd personally use traefik, so I could access services like "myservice.localhost" :)
    – holms
    Oct 3 at 1:32
  • @holms I am using microk8s on my home server in an attempt to learn Kubernetes on my free time. I am already exposing some services to the internet using Letsencrypt to get my certificates signed. But some services such as the PiHole admin GUI and the ArgoCD GUI should only be accessible to users on my home network. Therefore I am having trouble setting up infrastructure for those services to get their certificates signed. Right now these internal services are exposed using LoadBalancer services, but I would prefer an ingress with certificates from some sort of internally trusted CA. But how? Oct 3 at 10:27
  • You can't have internally trusted CA locally, even if you'd buy root cert from CA provider for local domain still browsers wouldn't see it as trusted. Check this topic: security.stackexchange.com/questions/121163/… What I'd do is having a proper public domain available only for letsencrypt and yourself, just setup firewall on your router or smtng. I'd personally just disable https at all and problem solved. You do expect some untrusted guests in your local network to have https..?
    – holms
    Oct 4 at 23:52
  • @holms Could I not import my own CA as a trusted root CA in my browser and issue certificates using that? What would be wrong about doing so? I just want as little "hacky" solutions as possible. Oct 5 at 21:36
  • quite recently ff doesn't even allow to import self-generated certs.. at least that what I've been dealing recently when I've needed to use self-generated certs.
    – holms
    Oct 12 at 23:17
1

Have you try to do it by Port Forwarding your configured service with TLS to your local machine ?
I've never tried but it seams to be possible with it.

Maybe you can find something here : https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/

1
  • This would technically work, but I don't think it is best practice. From what I've understood so far, port forwarding like that is meant for debugging purposes. What I believe I am looking for is some sort of CA solution compatible with Kubernetes, but since I am new I am not sure what really is the best practice and am looking for input on that. Thanks for your response though! I appreciate it . Oct 1 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.