<p>I'm trying to </p>

<p><code>kubectl create secret tls foo-secret --key /tls.key --cert /tls.crt</code></p>

<p>From keys and certs I've used made from LetsEncrypt. This processes makes sense with self-signed certificates, but the files made by LetsEncrypt look like this:</p>

<pre><code>cert.pem
chain.pem
fullchain.pem
privkey.pem
</code></pre>

<p>I can convert those pem files, I don't know if <code>--key</code> want's a public key or a private key, and the only option here is <code>privkey.pem</code>. I assume cert is cert.</p>

<p>I can convert <code>private.pem</code> with:</p>

<p><code>openssl rsa -outform der -in privkey.pem -out private.key</code></p>

<p>And <code>cert.pem</code> with:</p>

<p><code>openssl x509 -outform der -in cert.pem -out cert.crt</code></p>

<p>Is this the right process? Since I'll be using this secret for <a href="https://github.com/jcmoraisjr/ingress/blob/master/docs/examples/external-auth/dashboard-ingress.yaml" rel="nofollow noreferrer">ingress oauth</a> in place of <code>__INGRESS_SECRET__</code>, is this ingress suppose to have a private key? This ingress is acting as a TLS terminator for other things.</p>

<p>You are correct, you will need to provide your private key for the <code>tls.key</code> portion. However it's a good practice to automate the letsencrypt certificate generate process, using <a href="https://github.com/jetstack/cert-manager" rel="nofollow noreferrer">cert-manager</a>. Check out this <a href="https://itnext.io/automated-tls-with-cert-manager-and-letsencrypt-for-kubernetes-7daaa5e0cae4" rel="nofollow noreferrer">tutorial</a>. Dong so will automatically create the tls secret resource for you on the cluster.</p>

<p>Your <strong><code>tls.key</code></strong> file is the private key and begins and ends like the following:</p>

<pre><code>-----BEGIN RSA PRIVATE KEY-----

    ... [your private key]

-----END RSA PRIVATE KEY-----
</code></pre>

<p>And your <strong><code>tls.crt</code></strong> is going to be the concatenation of <code>cert.pem</code> and <code>fullchain.pem</code>, and it will look like the following:</p>

<pre><code>-----BEGIN CERTIFICATE-----

    ...
    [your cert content]

-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----

    ...
    [your fullchain cert content]

-----END CERTIFICATE-----
</code></pre>
