A TLS Secret is a Kubernetes Secret for storing a TLS certificate and its corresponding private key. Keeping these files in a Secret avoids baking them into a container image and lets Kubernetes provide them to an application or ingress proxy. section 8.3.2 section 12.3.2
Create a TLS Secret from certificate and key files:
- kubectl create secret tls kiada-tls --cert example-com.crt --key example-com.key section 8.3.2
- The generated Secret stores the certificate under tls.crt and the private key under tls.key. section 12.3.2
- For an Ingress, reference the Secret in spec.tls and list the hostnames covered by the certificate. section 12.3.2
Terminate TLS at an Ingress
An ingress proxy can terminate the client’s HTTPS connection using the certificate and key from a TLS Secret, then forward the HTTP request unencrypted to backend pods. The names in tls.hosts must match names in the certificate. section 12.3.2
Listing 12.8 Adding a TLS secret to an Ingress
on: networking.k8s.io/v1
kind: Ingress
metadata:
name: kiada
spec:
tls: #1
- secretName: tls-example-com #2
hosts: #3
- "*.example.com" #3
rules:
...
Inspect a complete Ingress manifest showing secretName and host configuration. section 12.3.2
