Answers: <p>Have you try to do it by Port Forwarding your configured service with TLS to your local machine ?<br />
  I've never tried but it seams to be possible with it.</p>
  <p>Maybe you can find something here : <a href="https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-01T06:30:31.913Z
Answers: This would technically work, but I don't think it is best practice. From what I've understood so far, port forwarding like that is meant for debugging purposes. What I believe I am looking for is some sort of CA solution compatible with Kubernetes, but since I am new I am not sure what really is the best practice and am looking for input on that. Thanks for your response though! I appreciate it .
Answers: Hannes Knutsson
Answers: CC BY-SA 4.0
Answers: 2021-09-30T22:04:13.343Z
Answers: 2021-09-30T22:04:13.343Z
Answers: benCat
Body: <h2>Coming from Docker</h2>
  <p>When I was still using Docker for running my services I had an nginx reverse proxy that handled issuing and signing certificates through letsencrypt automatically.</p>
  <p>Using this setup, I was able to host a public site <strong>service.example.com</strong> that did nothing but redirect the user to <strong>example.com</strong>. The benefit of this was that the reverse proxy setup would then issue and get a certificate signed that I could then use internally.</p>
  <p>Using a local DNS on my internal network I could then access my internal service <strong>service.example.com</strong> using a trusted and signed certificate. All without exposing it to the public.</p>
  <h2>Now in Kubernetes</h2>
  <p>Now I am slowly learning to use Kubernetes and want to achieve the same result. Is there any best practise/good way to accomplish the same in Kubernetes?</p>
  <p>I am currently running an nginx ingress controller paired with cert manager which is working perfectly for all my exposed services.</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-10-03T01:32:51.247Z
Comments: You plan to use kubernetes locally? How did you setup currently? Do you use Minikube? https://kubernetes.io/docs/tasks/access-application-cluster/ingress-minikube/ this provides how to run minikube locally. Although I'd personally use traefik, so I could access services like "myservice.localhost" :)
Comments: holms
Comments: CC BY-SA 4.0
Comments: 2021-10-03T10:27:16.003Z
Comments: @holms I am using microk8s on my home server in an attempt to learn Kubernetes on my free time. I am already exposing some services to the internet using Letsencrypt to get my certificates signed. But some services such as the PiHole admin GUI and the ArgoCD GUI should only be accessible to users on my home network. Therefore I am having trouble setting up infrastructure for those services to get their certificates signed. Right now these internal services are exposed using LoadBalancer services, but I would prefer an ingress with certificates from some sort of internally trusted CA. But how?
Comments: Hannes Knutsson
Comments: CC BY-SA 4.0
Comments: 2021-10-04T23:52:58.887Z
Comments: You can't have internally trusted CA locally, even if you'd buy root cert from CA provider for local domain still browsers wouldn't see it as trusted. Check this topic: https://security.stackexchange.com/questions/121163/how-do-i-run-proper-https-on-an-internal-network What I'd do is having a proper public domain available only for letsencrypt and yourself, just setup firewall on your router or smtng. I'd personally just disable https at all and problem solved. You do expect some untrusted guests in your local network to have https..?
Comments: holms
Comments: CC BY-SA 4.0
Comments: 2021-10-05T21:36:54.227Z
Comments: @holms Could I not import my own CA as a trusted root CA in my browser and issue certificates using that? What would be wrong about doing so? I just want as little "hacky" solutions as possible.
Comments: Hannes Knutsson
Comments: CC BY-SA 4.0
Comments: 2021-10-12T23:17:08.907Z
Comments: quite recently ff doesn't even allow to import self-generated certs.. at least that what I've been dealing recently when I've needed to use self-generated certs.
Comments: holms
Tags: <kubernetes><cert-manager>
Title: What is the best practise way to expose a service over https in kubernetes without exposing it to the internet?
UserDisplayName: Hannes Knutsson
ThreadText: # What is the best practise way to expose a service over https in kubernetes without exposing it to the internet?
  
  (Asked by: username_0 on 2021-09-29)
  
  ## Coming from Docker
  
  When I was still using Docker for running my services I had an nginx reverse proxy that handled issuing and signing certificates through letsencrypt automatically.
  
  Using this setup, I was able to host a public site **service.example.com** that did nothing but redirect the user to **example.com**. The benefit of this was that the reverse proxy setup would then issue and get a certificate signed that I could then use internally.
  
  Using a local DNS on my internal network I could then access my internal service **service.example.com** using a trusted and signed certificate. All without exposing it to the public.
  
  ## Now in Kubernetes
  
  Now I am slowly learning to use Kubernetes and want to achieve the same result. Is there any best practise/good way to accomplish the same in Kubernetes?
  
  I am currently running an nginx ingress controller paired with cert manager which is working perfectly for all my exposed services.
  
  **Tags:** kubernetes, cert-manager
  
  > **Comments:**
  > **username_1**: You plan to use kubernetes locally? How did you setup currently? Do you use Minikube? https://kubernetes.io/docs/tasks/access-application-cluster/ingress-minikube/ this provides how to run minikube locally. Although I'd personally use traefik, so I could access services like "myservice.localhost" :)  
  > **username_0**: @username_1 I am using microk8s on my home server in an attempt to learn Kubernetes on my free time. I am already exposing some services to the internet using Letsencrypt to get my certificates signed. But some services such as the PiHole admin GUI and the ArgoCD GUI should only be accessible to users on my home network. Therefore I am having trouble setting up infrastructure for those services to get their certificates signed. Right now these internal services are exposed using LoadBalancer services, but I would prefer an ingress with certificates from some sort of internally trusted CA. But how?  
  > **username_1**: You can't have internally trusted CA locally, even if you'd buy root cert from CA provider for local domain still browsers wouldn't see it as trusted. Check this topic: https://security.stackexchange.com/questions/121163/how-do-i-run-proper-https-on-an-internal-network What I'd do is having a proper public domain available only for letsencrypt and yourself, just setup firewall on your router or smtng. I'd personally just disable https at all and problem solved. You do expect some untrusted guests in your local network to have https..?  
  > **username_0**: @username_1 Could I not import my own CA as a trusted root CA in my browser and issue certificates using that? What would be wrong about doing so? I just want as little "hacky" solutions as possible.  
  > **username_1**: quite recently ff doesn't even allow to import self-generated certs.. at least that what I've been dealing recently when I've needed to use self-generated certs.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2021-09-30. Score: 1
  
  Have you try to do it by Port Forwarding your configured service with TLS to your local machine ?  
  I've never tried but it seams to be possible with it.
  
  Maybe you can find something here : <https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/>
  
  > **Comments:**
  > **username_0**: This would technically work, but I don't think it is best practice. From what I've understood so far, port forwarding like that is meant for debugging purposes. What I believe I am looking for is some sort of CA solution compatible with Kubernetes, but since I am new I am not sure what really is the best practice and am looking for input on that. Thanks for your response though! I appreciate it .  
  
  ---
  
  