<p>I'm trying to figure out how to dynamicly provide SSL Certificates for gRPC Server and Client across Kubernetes clusters.</p>
<p>My current implementation asserts that the CA-certificate (for client), certificate and key for the server are provided inside the pod.
The certs will be created inside kubernetes as secrets.</p>
<p>While using self-signed certificates is enough for development, I'd like to dynamicly create certificates for the client and server to use or find another way of providing encryption communication between them.
My first thought was using a service-mesh like linkerD for this purpose, but I'm not quite sure if the communication would be encrypted all the way from cluster A to cluster B, since Client 2 would have to use an Ingress Gateway.</p>
<p><a href="https://i.stack.imgur.com/qjfBe.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qjfBe.png" alt="Communication across clusters" /></a></p>
<p>When using a service mesh, does gRPC have to be configured as insecure, since all traffic will be routed through the service proxy instead?</p>
<p>Would be great if you could help me on this one.</p>
<p>Regards,
Hown3d</p>

hown3d
<p>When you say server running in K8s, it will be service and deployment.</p>
<p>If K8s internal app(client) connecting to the server it must be using service name as DNS, if you are using any service mesh <strong>mTLS</strong> traffic would be encrypted if enabled.</p>
<p>When you say ingress gateway, is it mean Nginx ingress gateway or Istio ingress gateway.</p>
<p>If you are using the Istio ingress gateway you can configure the mTLS also at the gateway level, something like</p>
<p><a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/#configure-a-mutual-tls-ingress-gateway" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/#configure-a-mutual-tls-ingress-gateway</a></p>
<p>If you are planning to use the Multi clusters <strong>linkerd</strong> is good option, and you can encrypt the traffic with <strong>mTLS</strong> in <strong>east</strong> and <strong>west</strong> clusters.</p>
<p><a href="https://linkerd.io/2.10/tasks/multicluster/" rel="nofollow noreferrer">https://linkerd.io/2.10/tasks/multicluster/</a></p>
<p>I'd like to dynamically create certificates for the client and server to use</p>
<p>You can use the cert-manager : <a href="https://cert-manager.io/docs/configuration/selfsigned/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/selfsigned/</a></p>
