Kubernetes TLS

TLS is the cryptographic protocol that powers encryption for many network applications. To use Kubernetes TLS, you need certificates. TLS certificates are fundamental to standing up a Kubernetes cluster and for interacting with/within the cluster. Given this reliance on certificates, we are often asked for advice on how to “do certificates in Kubernetes”.

"Doing certificates in Kubernetes" can mean a lot of things!

Here’s a hit list of places where you can use TLS certificates:

At Smallstep, we’ve thought deeply about these cases and have created a series of articles to help you on your journey toward Kubernetes TLS.

It all starts with a question - “What are you looking to achieve?”

Kubernetes can be a complex beast. There's a lot of concepts to learn and practice before one knows what they’re doing. It can become even more difficult to secure Kubernetes while wrangling the other moving pieces of your cluster. Regardless of the network hierarchy and policies in place, automating security by design will always make your cluster’s workload safer and more reliable.

Using Certificate Manager alongside some of Smallstep’s open-source projects, it suddenly becomes simple to automate certificate issuance into a Kubernetes deployment. All you need is a little bit of YAML and a working cluster to start issuing Kubernetes TLS certificates to your microservices, and stop bad actors in their tracks. Simple and straightforward tooling can make the difference between an exposed microservice, and one that is secure by design.