<p>I'm running a service in GKE and have an Ingress for setting up LTS.
I have tried by my self-signing certificates and I could access to my site through https protocol. It looks good.
Please notice that I have a static IP for Ingress and a domain name for it already.</p>

<p>But now I'm going to create a real-certificates and trying to create a CSR and sending it to CA but I'm so confused after reading those posts:</p>

<p><a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#create-a-certificate-signing-request" rel="nofollow noreferrer">Manage TLS Certificates in a Cluster</a></p>

<p><a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="nofollow noreferrer">Certificates</a></p>

<p>I have some questions:</p>

<ul>
<li>What's Pod's DNS, Pod's Ip and Service's Ip?</li>
<li>Do I have to create DNS for pod and service?</li>
<li>Can I generate the *.csr file from my local PC?</li>
<li>Can I create a server certificate authentication if I follow the steps in this link <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/ingress/#tls</a></li>
</ul>

<p>All I want is to make *.crt and *.key file for setting up https on my service. (I have read some blog posts telling about Let's Encrypt but I don't want to use it).</p>

<p>Thank you for reading.</p>

Quoc Lap
<p>Let's go over each of your questions first:</p>
<blockquote>
<p>What's Pod's DNS, Pod's Ip and Service's Ip?</p>
</blockquote>
<p>Within the cluster, each pod has it's own internal IP address and DNS record. Same goes for the services. You can read up on DNS within Kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/" rel="nofollow noreferrer">here</a> and you can read more about IP addresses <a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/" rel="nofollow noreferrer">here</a>.</p>
<blockquote>
<p>Do I have to create DNS for pod and service?</p>
</blockquote>
<p>For use within the cluster, that's automatically taken care of for you. If you want to expose a pod/service and have it externally accessible via a DNS record, you'll have to create it somewhere, just like you would for any other server/service/whatever.</p>
<blockquote>
<p>Can I generate the *.csr file from my local PC?</p>
<p>Can I create a server certificate authentication if I follow the steps...</p>
</blockquote>
<p>When it comes to GKE and Ingress, handling certificates can be done in two different ways. You can just add a certificate to your project and tell the Ingress controller to use it. <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl" rel="nofollow noreferrer">Here in this page</a> you can find a fantastic description on how to do this, and <a href="https://console.cloud.google.com/net-services/loadbalancing/advanced/sslCertificates/list" rel="nofollow noreferrer">here</a> is the page to create a certificate in the Console. This page also shows you how to do it by using secrets, though I personally prefer the added visibility of using a certificate that's part of my project.</p>
