<p>I am trying to connect my Kubernetes Cluster in Digital Ocean with a Managed Database.</p>
<p>I need to add the <code>CA CERTIFICATE</code> that is a file with extension <code>cer</code>.  Is this the right way to add this file/certificate to a secret?</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: secret-db-ca
type: kubernetes.io/tls
data:
  .tls.ca: |
        &quot;&lt;base64 encoded ~/.digitalocean-db.cer&gt;&quot;
</code></pre>

<p><strong>How to create a secret from certificate</strong></p>
<hr />
<p>The easiest and fastest way is to create a secret from command line:</p>
<pre><code>kubectl create secret generic secret-db-ca --from-file=.tls.ca=digitalocean-db.cer
</code></pre>
<p>Please note that type of this secret is <code>generic</code>, not <code>kubernetes.io/tls</code> because <code>tls</code> one requires both keys provided: <code>tls.key</code> and <code>tls.crt</code></p>
<p>Also it's possible to create a key from manifest, however you will need to provide full <code>base64 encoded</code> string to the data field and again use the type <code>Opaque</code> in manifest (this is the same as generic from command line).</p>
<p>It will look like:</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: secret-db-ca
type: Opaque
data:
  .tls.ca: |
     LS0tLS1CRUdJTiBDRVJ..........
</code></pre>
<p>Option you tried to use is used for <code>docker config</code> files. Please see <a href="https://kubernetes.io/docs/concepts/configuration/secret/#docker-config-secrets" rel="nofollow noreferrer">Docker config - secrets</a></p>
<hr />
<p><strong>Note!</strong> I tested the above with <code>cer</code> certificate.</p>
<p>DER (Distinguished Encoding Rules) is a binary encoding for X.509 certificates and private keys, they do not contain plain text (extensions .cer and .der). Secret was saved in <code>etcd</code> (generally speaking database for kubernetes cluster), however there may be issues with workability of secrets based on this type of secrets.</p>
<p>There is a chance that different type/extension of certificate should be used (Digital Ocean has a lot of useful and good documentation).</p>
<hr />
<p>Please refer to <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">secrets in kubernetes page</a>.</p>
