<p>I am trying to build an HTTPs proxy server in front of another service in Kubernetes, using either an NginX proxy LoadBalancer server, or Ingress.  Either way, I need a certificate and key so that my external requests get authenticated.</p>

<p>I'm looking at <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">how to manage tls in a cluster</a>, and I've noticed that the certificate used to connect to the container cluster is the same one as is mounted at <code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code> on a running pod.</p>

<p>So I'm thinking that my node cluster already has a registered certificate, all I need is the key, throw it into a secret and mount that into my proxy server.  But I can't find how.</p>

<p>Is it this simple?  How would I do that?  Or do I need to create a new certificate, sign it etc etc?  Would I then need to replace the current certificate?</p>

<p>If you want an external request to get into your K8s cluster then this is the job of an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress" rel="noreferrer">ingress controller</a>, or configuring the service with a loadbalancer, if your cloud provider supports it.</p>

<p>The certificate discussed in <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="noreferrer">your reference</a> is really meant to be used for intra-cluster communications, as it says:</p>

<blockquote>
  <p>Every Kubernetes cluster has a cluster root Certificate Authority (CA). The CA is generally used by cluster components to validate the API server’s certificate, by the API server to validate kubelet client certificates, etc.</p>
</blockquote>

<p>If you go for an ingress approach then <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="noreferrer">here is the doc for tls</a>. At the bottom a list of <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#alternatives" rel="noreferrer">alternatives</a>, such as the <a href="https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer" rel="noreferrer">load balancer</a> approach.</p>

<p>I guess you could use the internal certificate externally if you are able to get all your external clients to trust it. Personally I'd probably use <a href="https://github.com/jetstack/kube-lego" rel="noreferrer">kube-lego</a>, which automates getting certificates from <a href="https://letsencrypt.org/" rel="noreferrer">Let's Encrypt</a>, since most browsers trust this CA now.</p>

<p>Hope this helps</p>
