Self signed Kubernetes SSL certificate // easy guide

In this video I will explain how to use local self-signed certificates for your bare-metal Kubernetes Clusters in your Home Lab. We'll use Cert-Manager and OpenSSL to create a Certificate Authority that is trusted in your local network. And then create a valid certificate for a demo project. #Kubernetes #Certmanager #SSL

Follow me:

Timestamps:

00:00 - Introduction
00:47 - Advertisement-*
01:27 - How HTTPS works in local networks
02:29 - What is Cert-Manager
04:00 - Create a Certificate Authority
05:34 - Create a ClusterIssuer
09:30 - Create a valid Certificate
11:41 - Recap and Outcome

________________
All links with "*" are affiliate links.

[digitus]

The only certificate, that is self signed, is the certificate of the CA (as with every Root CA). So the rest of the certificates like the one for your nginx is a signed certificate - it’s signed by a non public CA but it is not self signed.
But despite of this detail your explanation is very useful for getting better view on certificates in common and on Kubernetes in particular.

[TheArtemus]

Hey Christian, hopefully you have enjoyed your holidays!
Thanks for this video and good explanation! In my opinion all of your tutorials are really valuable. Keep on going this good work and as we can see, your community is growing and growing... :-)

[DmitryTsarev]

To everyone who wondered which tool was used to draw the ascii diagram @11:47 …
Not exactly sure which particular one did Christian use (would be nice to know), but such diagrams can be created with tools like ‘asciiflow’ and ‘asciio’

[vitusyu]

Sounds like a bit complicated, but your delivery is quite clear, and I would give it a try on my home lab! Thanks!

[luciano]

Muchas gracias por compartir esta informacion Christian.

[guyfeldman]

You can use kubectl create secret with —from-file flags to upload the contents. I haven’t tried it from windows though

[ethangender]

ok looking forward to learn about self signed certificate on local network without need to be connected to internet .

[Lamnt]

Followed and subscribed. Thanks for your guidance.

[MatiasFranci]

This video es super clear. Could you please tell us which software do you use to show the Architecture Diagram (from Powershell)?

[alex.prodigy]

LabCA is also an interesting one, it's actually a community build of Boulder, the same ACME CA backend used by Let's Encrypt

[kevinyu]

Hi, thanks for the amazing contents! Could you also share the name of the tool that you use for drawing the diagram in markdown?

[dr.wordpress]

Hi, your tutorials helped me a lot. can you do a tutorial about hosting gristlabs/grist with portainer. please?

[dmsi]

you can use stringData instead of data in your secret manifest and paste multiline pem certs instead of base64 string

[paparoup]

What an awesome guide and very clear on the steps, thanks for your time. I followed the steps but i end up with this error message "message: 'Error getting keypair for CA issuer: certificate is not a CA'" when creating the cluster issuer which isn't the case in your video. What am i missing? Thanks again for the time invested

[dillanteagle]

This works but there is also the option of having certmanager automate creating the self signed certificate and secret.

[andibiront]

Great guide. I've followed it but made some changes. I created an intermediate certificate signed by my Active Directory root CA and uploaded the chain to cert-manager. It's working great. I wanted to change the certificate of Rancher and Portainer, but Helm installation automatically creates an Issuer for the namespace, so I don't know exactly how should I change them.

[squalazzo]

diagram at 12:00, did you use some tool, or made it manually?
about base64 and secrets, just use stringData insead of data and put them straight into the secret, no need to encode them

[Resulok]

Hi Christian, I have weird question) How you did scheme on timeline 11:46 ?

[MrToup]

This video give a super clear explanation about issuer and certificate.
Is it right to say that the benefits over let’s Encrypt certificate is to be more independent as we do not expose it to internet?

[hussamhyari]

Thank you for the video.
I am trying to secure a mosquitto broker using k8s cluster and exposed with a loadbalancer, can this implementation be used to secure the mqtt connection?