{"id":17888116,"url":"https://github.com/fireflycons/howto-create-pki-for-private-cluster","last_synced_at":"2026-03-19T02:19:32.465Z","repository":{"id":96974360,"uuid":"544546765","full_name":"fireflycons/howto-create-pki-for-private-cluster","owner":"fireflycons","description":"Set up a PKI, cert-manager and secured ingress on your private Kubernetes cluster.","archived":false,"fork":false,"pushed_at":"2022-10-02T19:08:27.000Z","size":399,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-08T16:44:14.980Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fireflycons.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-02T18:46:30.000Z","updated_at":"2023-03-30T09:08:44.000Z","dependencies_parsed_at":"2024-05-01T20:03:02.170Z","dependency_job_id":null,"html_url":"https://github.com/fireflycons/howto-create-pki-for-private-cluster","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fireflycons%2Fhowto-create-pki-for-private-cluster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fireflycons%2Fhowto-create-pki-for-private-cluster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fireflycons%2Fhowto-create-pki-for-private-cluster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fireflycons%2Fhowto-create-pki-for-private-cluster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fireflycons","download_url":"https://codeload.github.com/fireflycons/howto-create-pki-for-private-cluster/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246927809,"owners_count":20856193,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-28T13:36:35.030Z","updated_at":"2026-03-19T02:19:32.407Z","avatar_url":"https://github.com/fireflycons.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Serving Cluster Workloads over SSL\n\n**DISCLAIMER** This work is designed to help you serve applications over HTTPS within a _private_ cluster. It is in no way considered production grade. Moreover, we create a self-signed CA certificate which cannot be used for serving to the public Internet.\n\nThis is a follow on from my tutorial on [installing MetalLB and Ingress](https://github.com/fireflycons/howto-install-metallb).\n\nIn this guide, we will create a Public Key Infrastructure (PKI) using [easy-rsa](https://github.com/OpenVPN/easy-rsa) which is a wrapper for `openssl` written in Bourne Shell. We will create a Root CA which is kept locked away, and from that an Intermediate CA which will be used for issuing certificates to cluster workloads using [cert-manager](https://cert-manager.io/). I am not at this point covering management of Certificate Revocation Lists (CRLs), since you would not be passing any of generated certificates outside of your own direct control.\n\nWe will then proceed to distribute the certificates to trust store(s) on the network, then set up `cert-manager` in the cluster to create web-serving certificates for cluster services, then demonstrate serving a workload over HTTPS.\n\n# Lab Steps\n\n1. [Build the PKI](./docs/01-build-pki.md)\n1. [Distribute Certificates](./docs/02-certificate-distribution.md)\n1. [Install cert-manager](./docs/03-cert-manager.md)\n1. [Deploy a secured service](./docs/04-deploy-service.md)\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffireflycons%2Fhowto-create-pki-for-private-cluster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffireflycons%2Fhowto-create-pki-for-private-cluster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffireflycons%2Fhowto-create-pki-for-private-cluster/lists"}