<p>I'm trying to sort out certificates for applications deployed to a k8s cluster (running on docker-for-win, WSL2 on Windows 10 20H2).</p>
<p>I would like to use the DNS to connect to services, e.g. <code>registry.default.svc.cluster.local</code>, which I've verified is reachable. I created a certificate by following these steps:</p>
<ol>
<li>Create an <code>openssl.conf</code> with content</li>
</ol>
<pre><code>[ req ]
default_bits = 2048
prompt = no
encrypt_key = no
distinguished_name = req_dn
req_extensions = req_ext

[ req_dn ]
CN = *.default.svc.cluster.local

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = *.default.svc.cluster.local
</code></pre>
<ol start="2">
<li>Create csr and key file with <code>openssl req -new -config openssl.conf -out wildcard.csr -keyout wildcard.key</code></li>
<li>Created a certificate signing request with</li>
</ol>
<pre class="lang-sh prettyprint-override"><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: wildcard_csr
spec:
  groups:
  - system:authenticated
  request: $(cat wildcard.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF
</code></pre>
<ol start="4">
<li>Approved the request: <code>kubectl certificate approve wildcard_csr</code></li>
<li>Extracted the crt file: <code>kubectl get csr wildcard_csr -o jsonpath='{.status.certificate}' | base64 -d &gt; wildcard.crt</code></li>
<li>Deleted the request <code>kubectl delete csr wildcard_csr</code>.</li>
</ol>
<p>I've then started a pod with the <code>registry:2</code> image and configured it to use the <code>wildcard.crt</code> and  <code>wildcard.key</code> files.</p>
<p>In a different pod, I then tried to push to that registry, but got the error</p>
<pre><code>Error response from daemon: Get https://registry.default.svc.cluster.local:2100/v2/: x509: certificate signed by unknown authority
</code></pre>
<p>So it seems that within the pod, the k8s CA isn't trusted. Am I right with this observation? If so, how can I make k8s trust itself (after all, it was a k8s component that signed the certificate)?</p>

<p>I found a way to achieve this with changes to the yaml only: On my machine (not sure how universal that is), the CA certificate is available in the service-account-token secret <code>default-token-7g75m</code> (<code>kubectl describe secrets</code> to find out the name, look for the secret of type <code>kubernetes.io/service-account-token</code> that contains an entry <code>ca.crt</code>).</p>
<p>So to trust this certificate, add a <code>volume</code></p>
<pre class="lang-yaml prettyprint-override"><code>name: &quot;kube-certificate&quot;
secret:
  secretName: &quot;default-token-7g75m&quot;
</code></pre>
<p>and to the pod that requires the certificate, add a <code>volumeMount</code></p>
<pre class="lang-yaml prettyprint-override"><code>name: &quot;kube-certificate&quot;
mountPath: &quot;/etc/ssl/certs/kube-ca.crt&quot;,
subPath: &quot;ca.crt&quot;
</code></pre>
