Kubernetes: using an intermediate CA which certificate is signed by a self-signed root CA certificate

Volodymyr Melnyk

9/3/23, 3:12 PM

Does anyone use own certificate chains for Kubernetes clusters?

There's an issue with such kind of setup, and I would be grateful for any ideas on how to solve it.

Let's assume we have a Root CA which certificate is self-signed. Also we have an Intermediate CA which certificate is signed by the Root CA. We make a certification chain (by concatenating both PEM containers in one file) and set up Kubernetes with that. Almost everything works perfectly: Kubernetes works fine, Kubernetes clients works fine, Kubernetes operators works fine... Life is good.

But there is one thing that we have to keep in mind. All Secret object that contains security tokens for the ServiceAccount objects have "shortened" versions of the CA certificate. The "shortened" version doesn't contain the Root CA certificate, only the Intermediate one.

As I can see, for the most of TLS libraries that is enough. A piece of software establishes a TLS connection with the Kubernetes API Server, makes sure that the server's certificate is signed by a trusted CA (assuming that the Intermediate CA certificate that is gotten from the related Secret is trusted) and everything works smoothly.

But sometimes we have a problem. When we a piece of software (for example a Kubernetes operator or any other program that needs to communicate with Kubernetes API Server) that uses a little bit more strict TLS library - we are in trouble. In this case we have to provide this tool with the version of the certification chain (containing both the Intermediate CA certificate and the Root one), because the "shortened" version which is provided by Kubernetes is not enough. And that's OK if we are able to provide this tool with the full certificate chain, but sometimes that's not possible, so it takes the "shortened" CA certificate from /var/run/secrets/kubernetes.io/serviceaccount/ca.crt and that's not easy to persuade it to take the CA certificate from another source. :-(

My question is the following: is there any way to make Kubernetes create these Secret objects with the full version of the certification chain? And if there is, will it cause another kind of difficulties (e.g. if the software that will be provided with the full chain will glitch)? Or, perhaps, there could be another workaround?

Thanks in advance.

0 + 0

ssl

x509

kubernetes

self-signed-certificate

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Kubernetes: using an intermediate CA which certificate is signed by a self-signed root CA certificate

TH: Kubernetes: ใช้ CA ระดับกลางซึ่งใบรับรองลงนามโดยใบรับรอง CA หลักที่ลงนามด้วยตนเอง

RO: Kubernetes: folosind un CA intermediar al cărui certificat este semnat de un certificat CA rădăcină autosemnat

RU: Kubernetes: использование промежуточного ЦС, сертификат которого подписан самозаверяющим сертификатом корневого ЦС.

VI: Kubernetes: sử dụng CA trung gian có chứng chỉ được ký bởi chứng chỉ CA gốc tự ký

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.