<p>I have an application that is internal and exposed only to other application on the cluster by a service with cluster IP. Other services are accessing this application via it's DNS (<code>serviceName-namespace.svc.cluster.local</code>). This application handles sensitive data, so although all the communication is inside the cluster I would like to use TLS to secure the communications to this application.</p>

<p>My question is - how can I enable TLS on a service? Is there something already exist or should I handle it on the application code? Also, is there already a CA I can use on the cluster that can sign certificates for <code>.svc.cluster.local</code>?</p>

<p>To clarify, I know I can use ingress for this purpose. The only problem is keeping this service internal only - so only services inside the cluster will be able to access it.</p>

<p>Thanks,
Omer</p>

<p>I just found that Kubernetes API can be used to generate a certificate that will be trusted by all the pods running on the cluster. This option might be simpler than the alternatives. You can find the documentation <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="noreferrer">here</a>, including full flow of generating a certificate and using it.</p>
