Best practice LE certs

[b-thiswatch]

Hi,
I am running distroless images on my K8s cluster and it's a pain in the *** to manage self-signed certificates. I do not want to tinker with the java truststore / keytool etc. So I guess my best option would be to use Letsencrypt to generate certificates for the REST API.
However I would need to automate the retrieval via cert-manager and - at least in theory - know when to renew the LE CA cert (valid until 2035)...
Are there any best practice ways of doing this? How are you guys dealing with the mandatory TLS for the REST API on your clusters?

Thanks

[swoehrl-mw]

Hi @b-thiswatch. Since you are talking about LetsEncrypt I assume you are using an official domain to expose your REST API and not the k8s internal stuff?
The best practice here is to put an ingress in front of opensearch and have that "translate" from the internal self-signed certs to "good" certs from LE or another CA. That way the ingress controller and cert-mabager take care of any LE cert rotiation and opensearch can hapily use its internal certs.

For cluster-internal access the safe way is to provide the certs (in a keystore or as pem) in a secret and mount that in any container that wants to access the opensearch API. Of course you can also put an internal ingress in front of opensearch but then need another way to generate valid certs as LE will not hand out any for cluster-internal domains.

[b-thiswatch]

Hi @swoehrl-mw,

thanks for taking the time. Actually, I thought about misusing LE for the internal stuff, but that turned out to be even more complex and off-standard. In the end I settled for an initContainer to add the CA to the truststore and copy that to the final container...

[swoehrl-mw]

In the end I settled for an initContainer to add the CA to the truststore and copy that to the final container...

As long as you have control over your services, that of course works and is not a bad solution.

[b-thiswatch]

Agreed. The reason why I asked is that I generally dislike the idea of allowing my app to accept a truststore from "somewhere". Seems a bit like security issue tbh. Generating my own CA and putting this in all my Dockerfiles at build time also does not seem favorable to me. Hence the question how you guys handle this in general. I know this is beyond the scope of the operator, but since it enforces TLS for internal services...

[b-thiswatch]

And yes, I see the irony of not wanting to accept a truststore, but not using TLS internally :)