TLS in Kubernetes

# Create a TLS Secret from existing certificate files
kubectl create secret tls api-tls-cert \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key \
  --namespace payments
# tls.crt: the full certificate chain (leaf + intermediates)
# tls.key: the private key — never commit this to Git

# Inspect a TLS Secret
kubectl get secret api-tls-cert -n payments -o jsonpath='{.data.tls\.crt}' \
  | base64 -d | openssl x509 -noout -text | grep -E "Subject:|Issuer:|Not After"

# Create a self-signed certificate for testing (not for production)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout tls.key -out tls.crt \
  -subj "/CN=api.company.com/O=company" \
  -addext "subjectAltName=DNS:api.company.com"
kubectl create secret tls api-tls-cert --cert=tls.crt --key=tls.key -n payments

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: payment-api
  namespace: payments
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"       # Redirect HTTP → HTTPS (301)
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true" # Even behind a proxy
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.company.com
      secretName: api-tls-cert    # The kubernetes.io/tls Secret containing the cert + key
                                  # Must be in the SAME namespace as the Ingress
  rules:
    - host: api.company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: payment-api
                port:
                  number: 80      # Backend receives plain HTTP — TLS is terminated at the Ingress

# Install cert-manager (Helm)
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.14.0 \
  --set installCRDs=true     # Install the CRDs (Certificate, Issuer, ClusterIssuer, etc.)

# ClusterIssuer: cluster-wide Let's Encrypt issuer via HTTP-01 challenge
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory   # Let's Encrypt production ACME endpoint
    email: platform@company.com                               # Notified on expiry warnings
    privateKeySecretRef:
      name: letsencrypt-prod-account-key  # ACME account private key — cert-manager manages this
    solvers:
      - http01:
          ingress:
            class: nginx                  # Use the nginx Ingress controller for HTTP-01 challenges
            # HTTP-01: Let's Encrypt sends a request to http://yourdomain/.well-known/acme-challenge/...
            # The Ingress controller routes this to cert-manager's challenge solver Pod
            # Your domain must be publicly reachable for this to work

---

# Certificate: request a specific cert — cert-manager creates the TLS Secret automatically
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: api-tls-cert
  namespace: payments
spec:
  secretName: api-tls-cert              # cert-manager creates/updates this TLS Secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - api.company.com
    - api-internal.company.com          # Multiple SANs in one certificate
  duration: 2160h                       # 90 days (Let's Encrypt maximum)
  renewBefore: 720h                     # Renew 30 days before expiry
                                        # cert-manager watches for expiry and renews automatically

# Shortcut: annotate the Ingress — cert-manager creates the Certificate automatically
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: payment-api
  namespace: payments
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod   # cert-manager sees this annotation
    nginx.ingress.kubernetes.io/ssl-redirect: "true"   # and creates a Certificate + TLS Secret
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.company.com
      secretName: api-tls-cert     # cert-manager will create this Secret automatically
  rules:
    - host: api.company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: payment-api
                port:
                  number: 80