2 Ways to Add Security Certificates to RancherKubernetes Deployments скачать в хорошем качестве

2 Ways to Add Security Certificates to RancherKubernetes Deployments

Learn about the 2 ways to add security certificates to Rancher kubernetes deployments. Here are the commands featured in my video. Transfer certificate to Linux box ---------------------------------- scp #####YOUR_DER_FILE_LOCATION##### rabi@#####LINUX_IP_ADDRESS#####:/home Quick check of file type ------------------------ file /home/test_cert.der ◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇ METHOD 1 (RECOMMENDED) Create a Kubernetes Secret and Mount to Pod ------------------------------------------- Convert DER to PEM openssl x509 -inform der -in ####CERTIFICATE_FILE_NAME####.der -out tls.crt Create a TLS secret if you have a private key kubectl create secret tls app-tls-secret \ --cert=tls.crt \ --key=####PRIVATE_KEY####.key ===== OR ===== if you just have the certificate kubectl create secret generic ####SECRET_NAME#### \ --from-file=####CERTIFICATE_FILE_NAME####.der ********************** *** IMPORTANT *** I did not cover this part in the video because I had only one cluster and one namespace. However that is not always the case. If you wanna create the secret in cluster called "gurung" under the namespace of "rabitest", the process would be similiar. Except that the .der file have to be SCP into the "gurung" cluster machine and run the openssl and "kubectl create" command from that machine. kubectl create secret generic ####SECRET_NAME#### \ --from-file=####CERTIFICATE_FILE_NAME####.der -n ####NAMESPACE#### *** IMPORTANT *** ********************** ◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇ METHOD 2 Using ConfigMap for Certificate ------------------------------- Encode/Convert DER to base64 base64 -w 0 ####CERTIFICATE_FILE_NAME####.der ＞ ####CERTIFICATE_FILE_NAME####.b64 Create ConfigMap kubectl create configmap ####CONFIG_MAP_NAME#### \ --from-file=####CERTIFICATE_FILE_NAME####.der=####CERTIFICATE_FILE_NAME####.b64 ********************** *** IMPORTANT *** I did not cover this part in the video because I had only one cluster and one namespace. However that is not always the case. If you wanna create the config map in cluster called "gurung" under the namespace of "rabitest", the process would be similiar. Except that the .der file have to be SCP into the "gurung" cluster machine and run the base64 and "kubectl create" command from that machine. kubectl create configmap ####CONFIG_MAP_NAME#### \ --from-file=####CERTIFICATE_FILE_NAME####.der=####CERTIFICATE_FILE_NAME####.b64 -n ####NAMESPACE#### *** IMPORTANT *** ********************** ◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇◇◆◇◆◇◆◇ Best Practices: 1. Convert to PEM if your application supports it 2. Use TLS secrets for proper Kubernetes integration 3. Mount as read-only volumes for security 4. Use appropriate paths that your application expects 5. Consider certificate renewal processes #fypシ #k3s #kubernetes #github