Kubernetes certs at application level?

user_1562431 0
Viewed 55

I have a kubernetes cluster setup, I am converting a docker-compose using komposer , and I get:

WARN Volume mount on the host "<SOME_PATH>" isn't supported - ignoring path on the host
WARN Volume mount on the host "<SOME_PATH_2>" isn't supported - ignoring path on the host
WARN Volume mount on the host "<SOME_PATH_3>" isn't supported - ignoring path on the host

we built a docker-compose that uses volume mounts for key,crt files and that looks like volumes are not supported by K8.

I found this : https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ and it looks like Kubernetes can make and renew its own certs. That's great. How do I get access to those certs so I can use them in my Koa/Nodejs microservice? or is there another standard way to apply certs at the application layer?

There was some talk about if this didn't work to move to nginx or Kong and let that use certs. I'm trying to see if there's an application layer way to do this rather than go that route. Any suggestions or comments are appreciated.

EDIT: it seems I can assign a cert to a secret and call it via my application? I'm new to kubernetes so... I may be looking into this.

kubernetes node.js ssl
1 Answers

or is there another standard way to apply certs at the application layer?

Yes, for TLS and mTLS between applications within your cluster, I would consider to use a service mesh, e.g. Istio (with mTLS) or Linkerd (with mTLS). With a service mesh you get TLS encryption managed for you, between Pod to Pod - but your application does not need to manage any certificates.

user_2132690
Related