<p>My Kubernetes cluster has 2 applications. </p>

<ul>
<li>A deployment connecting to an external API through <code>https://</code> - lets call it <code>Fetcher</code></li>
<li>A proxy service which terminates the <code>HTTPs</code> request to inspect the headers for rate limiting - called <code>Proxy</code></li>
</ul>

<p>The deployment uses the mentioned proxy, picture the following architecture</p>

<p><code>Fetcher deployment &lt;-- private network / Kubernetes --&gt; Proxy &lt;-- Internet --&gt; external API</code></p>

<p>Before I moved to Kubernetes this was solved by creating a self-signed certificate and certificate authority CA to trust and place them on the Fetcher and proxy. The certificate simply contained the IP address of docker as SAN.</p>

<pre><code>X509v3 Subject Alternative Name: 
DNS:example.com, DNS:www.example.com, DNS:mail.example.com, DNS:ftp.example.com, IP Address:192.168.99.100, IP Address:192.168.56.1, IP Address:192.168.2.75
</code></pre>

<p>However I can't do this in Kubernetes, can I? Since the IP addresses of both the deployment and service are not guaranteed, the IP's could change. I am using a Kubernetes <code>CoreDNS</code> solution, could I add the dns addresses in the certificate? I dont know enough about <code>ssl/certificates</code> to understand.</p>

<p>How can I create a certificate and CA in Kubernetes to create a trust between the certificate sent by the proxy with a custom certificate authority on the fetcher?</p>

<p>If you expose the proxy deployment via a service, then by default it will be assigned a <code>ClusterIP</code> which will be stable even as the IPs of the pods running the proxy may change over time. You will want to generate a cert with an IPSAN corresponding to the <code>ClusterIP</code> of the service, rather than any of the IPs of the pods. Check out the <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">official docs regarding the "service" concept</a>.</p>
