Kubernetes - Manage TLS Certificates, CA, Certificate Signing Request CSR, Signers, Usage

Kubernetes - Manage TLS Certificates, CA, Certificate Signing Request CSR, Signers, Usage
Chapters
00:00 About
00:08 Https - TLS
02:30 1st TCP - Connection
03:32 2nd TLS Handshake
05:03 CA Types
07:19 Certificate Signing
09:50 Kubernetes CA About
12:54 Kubernetes Various CAs
15:58 Kubernetes Certs & Its CA mapping
17:57 Kubernetes Components and Its certs
19:56 How Kubelet gets certificate for node
22:53 Kubernetes TLS Communication types
31:17 CSR Manifest Explanation
35:54 CSR signers
36:23 CSR Key Usage
36:59 CSR commands
37:31 CSR with Custom CA steps
39:36 CSR Use Case
40:40 CSR Demo 1
52:45 CSR Demo 2
Liinks:
kubernetes.io/docs/reference/...
kubernetes.io/docs/tasks/tls/...
github.com/kubernetes/enhance...
github.com/kelseyhightower/ku...
serverfault.com/questions/970...
CKS playlist: • Certified Kubernetes S...
Connect with me on Slack: join.slack.com/t/learnwithgvr...
Like, Comment & Subscribe Learn with GVR
#cks #kubenetes #kubernetessecurity #k8s #learnwithgvr

[@vaishakh-aws]

Excellent explanation with all your expertise, Dear GVR. I'm sure this content of yours will stay at the top among all for many more years. Thank you for making it easy to understand.

[@learnwithgvr]

My pleasure, keep learning

[@abdelhamidmatter7849]

Thank you so much for this great tutorial; I had a problem with my headphones

[@learnwithgvr]

Thanks for the feedback, keep learning

[@773Emo]

this is great work. you are a life saver. keep it coming!

[@learnwithgvr]

Thank you 👍

[@rveeranki296]

Awsome content. One of the best video I have ever seen in TH-cam on this topic

[@learnwithgvr]

Thank you pls subscribe and keep learning

[@themuleify]

Great tutorial done with zeal and genuine desire to share.
Thank you for this Venkat!

[@learnwithgvr]

Thank you

[@hrabhijith]

Very good information. Much needed.

[@learnwithgvr]

Thank you

[@AnilKumar123]

Excellent explanation. Thanks a ton !

[@learnwithgvr]

Thank you for the feedback,👍

[@ramkumargorre2958]

Good one with good insight on K8 certificates & secure communication

[@learnwithgvr]

Thank you and keep learning

[@borhadesumit58]

Amazing work, Venkat! 👌🏻👌🏻👌🏻

[@learnwithgvr]

Thanks a ton

[@anilkommalapati6248]

Amazing tutorial on K8Certs. Really superb. First 40 minutes are really outstanding but from there I felt little complicate. May be too much depth of k8. Thank you very much for your great efforts. 🤗

[@learnwithgvr]

Thanks Bro ..keep learning

[@prashantdhage4448]

Gem 💎 of an explanation

[@learnwithgvr]

Thank you Prashant

[@pravinsingh8782]

Best tutorial to understand kubernetes certificates.

[@learnwithgvr]

Thank you Pravin... Please watch my other videos yoo

[@pravinsingh8782]

Thank you Venkat for this hard work & sharing this valuable knowledge.

[@learnwithgvr]

My pleasure Pravin

[@rajesh-devops]

Super video GVR sir ,you are the best Teacher

[@learnwithgvr]

My pleasure

[@dasilavanya7429]

Really excellent explonation....so far i have not seen this kind of explonation in TH-cam....keep going and do more videos.....

[@learnwithgvr]

Thanks a ton, i will

[@durga4frnds]

Excellent video , keep making such good videos. Thanks Venkata

[@learnwithgvr]

Thank you Durgarao

[@a143r]

Keep making videos someday you will beat UDEMY we like depth content. thanks GVR.

[@learnwithgvr]

My pleasure

[@SurajSingh-kn2jx]

awesome content man..well explained, thanks

[@learnwithgvr]

Glad to hear the feedback. Thank you Suraj, keep learning

[@sheryfsays]

Very resourceful. Thank you for putting in the time and effort.
Note: I quite new to administering/managing certificates and there's not alot of resources to dumb it down to newbies. Your video did alot for me.
Quick question: I have a wild card SSL certificate that was issued by an approved CA.
My use case is to have this in my kube cluster and managed by cert-manager. thus certmanager will issue subdomain certs as required.
How do I; if possible, create a CA certificate using my existing wild card SSL cert to achieve this?
Thanking you

[@learnwithgvr]

Thanks for your feedback.
For your question, you have to provision kubernetes cluster manually (just google it..kubernetes hard way github), there you can create your own CA for entire cluster. To create CA from wildcard certificate... you have check 2 things...
1) contact your actual CA, get Intermediate CA,
2) use that Intermediate CA and provision k8s cluster
Its complicated use case...just try to see how the setup done for EKS or AKE ot GKE clusters how they setup their CA's

[@everythingelse3801]

Thanks for this video, Venkat! It is very informative and well detailed.
Question: I have to secure inter pod communication (not with api server) in my cluster. Could I use CSR for this need?

[@learnwithgvr]

CSR is kubernetes resource type, allows any client to issue x.509 certificate with some Signer, then you will be using that signed certficate to/from communication with Kubernetes API server.
What is your use case? if your one of the service being used as webhook for admission controller then you need CSR.
Refer the video from here: th-cam.com/video/OHmgb7h-2-g/w-d-xo.html

[@everythingelse3801]

@@learnwithgvr Thanks for a quick response.
Use case: I have to host a http server to which clients can upload and download files. All clients are hosted within the cluster and communication is 100% internal to cluster. I plan to use self signed certificate to enable tls in this setup. To save effort in adding cert to CA of all the clients, I am exploring CSR option.

[@YouTubers-rj9xv]

Bro superb teaching looking for RBAC service

[@learnwithgvr]

Thank you and please look at my RBAC video
th-cam.com/video/CTtfxsqCIdw/w-d-xo.html

[@keratishvili]

would like to see CA rotation video incase cluster kube admin config was compromised how it could be rotated

[@learnwithgvr]

Thank you & Appreciate your Suggestions.
CA rotation detailed steps in documentation. Will try video
kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/