A TLS certificate helps authenticate a network endpoint and establish HTTPS connections. In Kubernetes, an Ingress can terminate TLS at the load balancer, keeping certificate handling out of the application. It can then forward traffic to backend Services over HTTP or HTTPS. section 7.2.1
A Kubernetes TLS setup combines these pieces:
- A certificate issued by a certificate authority and its matching private key. section 7.2.1
- A Kubernetes Secret containing the certificate and key. section 7.2.1
Using a self-signed certificate
For testing, OpenSSL can create a private key and self-signed certificate, which can then be imported with kubectl create secret tls my-tls-cert --cert example.crt --key example.key. This encrypts the connection, but browsers cannot verify the endpoint’s identity and will show warnings. section 7.2.1
