Self signed Kubernetes SSL certificate // easy guide

Подписаться 208 тыс.

Просмотров 34 тыс.

50% 1

In this video I will explain how to use local self-signed certificates for your bare-metal Kubernetes Clusters in your Home Lab. We'll use Cert-Manager and OpenSSL to create a Certificate Authority that is trusted in your local network. And then create a valid certificate for a demo project. #Kubernetes #Certmanager #SSL
Project Files: github.com/christianlempa/vid...
Teleport-*: goteleport.com/thedigitallife
Self-Signed Certificate Tutorial: • How to create a valid ...
Cert-Manager Tutorial: • Free SSL Certs in Kube...
Follow me:
TWITTER: / christianlempa
INSTAGRAM: / christianlempa
DISCORD: / discord
GITHUB: github.com/christianlempa
PATREON: / christianlempa
MY EQUIPMENT: kit.co/christianlempa
Timestamps:
00:00 - Introduction
00:47 - Advertisement-*
01:27 - How HTTPS works in local networks
02:29 - What is Cert-Manager
04:00 - Create a Certificate Authority
05:34 - Create a ClusterIssuer
09:30 - Create a valid Certificate
11:41 - Recap and Outcome
________________
All links with "*" are affiliate links.

Опубликовано:

21 июл 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 62

@vitusyu9583 2 года назад

Sounds like a bit complicated, but your delivery is quite clear, and I would give it a try on my home lab! Thanks!

@TheArtemus75 2 года назад

Hey Christian, hopefully you have enjoyed your holidays! Thanks for this video and good explanation! In my opinion all of your tutorials are really valuable. Keep on going this good work and as we can see, your community is growing and growing... :-)

@christianlempa 2 года назад

Thank you so much! Yeah holidays were good :)

@jonzuka9746 11 месяцев назад

Thank you! Quick and precise.

@DmitryTsarev Год назад

To everyone who wondered which tool was used to draw the ascii diagram @11:47 … Not exactly sure which particular one did Christian use (would be nice to know), but such diagrams can be created with tools like ‘asciiflow’ and ‘asciio’

@GihanS 2 года назад

This is super awesome. Keep going !

@christianlempa 2 года назад

Thanks! :)

@kevinyu9934 2 года назад

Hi, thanks for the amazing contents! Could you also share the name of the tool that you use for drawing the diagram in markdown?

@MatiasFranci 2 года назад

This video es super clear. Could you please tell us which software do you use to show the Architecture Diagram (from Powershell)?

@Lamnt213 8 месяцев назад

Followed and subscribed. Thanks for your guidance.

@christianlempa 8 месяцев назад

Thanks! and welcome :)

@dr.wordpress 2 года назад

Hi, your tutorials helped me a lot. can you do a tutorial about hosting gristlabs/grist with portainer. please?

@digitus888 2 года назад

The only certificate, that is self signed, is the certificate of the CA (as with every Root CA). So the rest of the certificates like the one for your nginx is a signed certificate - it’s signed by a non public CA but it is not self signed. But despite of this detail your explanation is very useful for getting better view on certificates in common and on Kubernetes in particular.

@christianlempa 2 года назад

Thanks mate! You're absolutely right, I often say that to make it clear the cert is signed by self-signed ca. Might be a bit lazy that's true 🤣

@lenoah8692 4 месяца назад

Thank you ! Best teacher

@christianlempa 3 месяца назад

Thanks 🙏

@guyfeldman4697 2 года назад

You can use kubectl create secret with -from-file flags to upload the contents. I haven’t tried it from windows though

@christianlempa 2 года назад

Thanks! I'll try it

@paparoup Год назад

What an awesome guide and very clear on the steps, thanks for your time. I followed the steps but i end up with this error message "message: 'Error getting keypair for CA issuer: certificate is not a CA'" when creating the cluster issuer which isn't the case in your video. What am i missing? Thanks again for the time invested

@dillanteagle3726 2 года назад

This works but there is also the option of having certmanager automate creating the self signed certificate and secret.

@Resulok 2 года назад

Hi Christian, I have weird question) How you did scheme on timeline 11:46 ?

@dmsi1980 2 года назад

you can use stringData instead of data in your secret manifest and paste multiline pem certs instead of base64 string

@alex.prodigy 2 года назад

LabCA is also an interesting one , it's actually a community build of Boulder , the same ACME CA backend used by Let's Encrypt

@christianlempa 2 года назад

Thx great idea, I'll check it out

@sachinmalhotra9235 2 года назад

How to manage windows server data real time backup i can purchase to servers

@zakeeyullah Год назад

Hi, can you make a tutorial how to redirect IP address automatically to domain When using nginx proxy manager to manage containers reverse proxy.

@hemanthnlr Год назад

HI , This tutorial is good . thanks lot for sharing info . when i try to install cert-manager using helm ... cert-manager helm status shown as pending-install and my kuberates version v1.23.3... can you share your suggestion on this

@sashapokatilov Год назад

Thx, bro! U are my hero)

@christianlempa Год назад

You're welcome! Thank you :)

@MohitSharma-fm2vj Месяц назад

I followed the exact tutorial, but traefik is unable to find the middleware, saying it doesnot exist. Can anyone help on this??

@haddysrosserrier2061 Год назад

Tried this method, doesn't work. Had an issue with the RSA structure being too large after encoded. Just a heads up.

@hussamhyari Год назад

Thank you for the video. I am trying to secure a mosquitto broker using k8s cluster and exposed with a loadbalancer, can this implementation be used to secure the mqtt connection?

@christianlempa Год назад

You're welcome :) I'm not quire sure about mosquitto, haven't worked with it before

@andibiront2316 2 месяца назад

Great guide. I've followed it but made some changes. I created an intermediate certificate signed by my Active Directory root CA and uploaded the chain to cert-manager. It's working great. I wanted to change the certificate of Rancher and Portainer, but Helm installation automatically creates an Issuer for the namespace, so I don't know exactly how should I change them.

@christianlempa 2 месяца назад

Nice work! Thank you!

@MrToup 2 года назад

This video give a super clear explanation about issuer and certificate. Is it right to say that the benefits over let’s Encrypt certificate is to be more independent as we do not expose it to internet?

@christianlempa 2 года назад

Thank you! And yeah absolutely, everything that you expose on the internet is a potential risk.

@Xiovox 2 года назад

Which VSC theme & font are you using?

@christianlempa 2 года назад

I created my own theme the digital life and use the Hack Nerd Font

@BP-qy2pb 2 года назад

Use git-bash or WSL2 instead.

@squalazzo Год назад

diagram at 12:00, did you use some tool, or made it manually? about base64 and secrets, just use stringData insead of data and put them straight into the secret, no need to encode them

@christianlempa Год назад

I used asciiflow but it’s a lot manual work as well :P

@mohammedsadrulhudaquadri8731 Год назад

Shell theme is so cool. Could someone please help me with the name of the theme

@christianlempa Год назад

Thanks, mate, You find the settings for the Windows terminal and other stuff on GitHub in my dot files repo!

@mohammedsadrulhudaquadri8731 Год назад

@@christianlempa Thanks buddy ! btw loved your content !!

@KairosVI Год назад

how to base64 in powershell? docker run -it bash XD

@christianlempa Год назад

@yiye2707 Год назад

SSL certificate problem: self signed certificate

@joshuabruno 2 года назад

Bro all we care about is whether or not an American style Kölsch counts as a REAL Kölsch.

@darthweiter7074 Год назад

Doing it under windows -> install wsl2 and use linux there 😂

@russellrv 2 года назад

SSL Certificate and Easy Guide should never be used in the same statement

@Reiner030 2 года назад

Base64: from a stackOverflow answer this should be the solution and I also had to use certutils for importing a certificate to ADS in Windows Server 2012: > Windows comes with certutil.exe (a tool to manipulate certificates) which can base64 encode and decode files. > certutil -encode test.exe test.txt > certutil -decode test.txt test.exe Additional M$ has a documentation "Convert file to Base64 string format" with this one-liner: > [convert]::ToBase64String((Get-Content -path "your_file_path" -Encoding byte))

@nireeshwaravaanam Год назад

How can I contact you +

@leela5012 Год назад

i have tried using in windows using physical location it worked for me to convert self-signed certificate > cat C:\\Users\\username\\ca.crt | base64 -w 0

@aswinmaheshc 2 года назад

May be you can try like this for encoding with Base64 with Powershell Encoding: $Cert = ‘This is a secret' $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Cert) $EncodedText =[Convert]::ToBase64String($Bytes) $EncodedText

@christianlempa 2 года назад

Thx! Maybe I could put it in a script

@malthaeldai2083 2 года назад

Hi, you could break this down to: [convert]::ToBase64String((Get-Content -path "ca.crt" -AsByteStream -Raw)) At least while using PowerShell 7.2. For PowerShell 5.1 this won't work unfortunately. But in my opinion using either Linux direct or via wsl is by far shorter and faster to type. Best regards from Hamburg

@malthaeldai2083 2 года назад

In addition: [convert]::ToBase64String((Get-Content -path "ca.crt" -Encoding byte)) Would be for PowerShell 5.1