<p>We have service provider that takes a request and creates cluster of elastic search.</p>

<p>What is the best practice to issue ssl certificate ?
1. Should we issue certificate per cluster ?
2. or One cluster for my service provider should be enough which will be used to access clusters ?</p>

<p>I am assuming issuing new certificate while creating cluster is better.</p>

<p>Please provide me the input.</p>

<p>Also, inside the cluster, do I really need to enable ssl so that pods talk to each other passing certificate ?</p>

<p>Yes, you should definitely use TLS to encrypt network traffic to, from, and within your Elasticsearch clusters run on shared and managed K8S version (GKE).</p>

<p>Additionally I would opt for a maximum separation of customer spaces with:</p>

<ul>
<li>Kubernetes namespaces</li>
<li>namespaced serviceaccounts/rolebindings
<br><br>and even PD-SSD based volumes with <a href="https://cloud.google.com/compute/docs/disks/customer-supplied-encryption" rel="nofollow noreferrer">customer supplied encryption</a> keys</li>
</ul>

<p>I'm not sure if you are aware of existence of '<a href="https://www.elastic.co/blog/introducing-elastic-cloud-on-kubernetes-the-elasticsearch-operator-and-beyond" rel="nofollow noreferrer">Elastic Cloud on Kubernetes</a>' (ECK) - it applies Kubernetes Operator pattern for running and operating Elasticsearch clusters on your own K8S cluster in GCP. Treat it also like a collection of a best practices for running Elasticsearch cluster in most secure way, <a href="https://github.com/elastic/cloud-on-k8s/blob/master/docs/k8s-quickstart.asciidoc" rel="nofollow noreferrer">here</a> is a quick start tutorial.</p>
