Python utility for cert generation

Question

Currently I am running with some issue where I need to write an utility in python to install certificate for an ingress in a namespace for given host & subject alt names. Any help will be much appreciated.

Answer 1

If you want to request certificates dynamically on demand then consider using a ssl client which has a REST interface, for example CFSSL. Its pretty simple to keep it running as a server and requesting ssl certificates with lots of configuration options.

Also if you're looking for more managed stuff, also consider setting up Lemur. It is an open source software by Netflix which makes it a lot more easier to manage ssl certificates along with some added functionalities like role based access, sources, destinations and good old user interface.

You can run cfssl server inside a pod and use it internally to request certificates, of course after setting up a CA and ideally a subCA too. It already has a docker image which you can use directly with minimal configuration changes.

Answer 2

You can write the python utility and deploy it as deployment in Kubernetes.

You can deploy ingress controller or if you have already deployed ingress controller you can simply write the ingress rule and apply it to Kubernetes cluster.

For generating & managing SSL/TLS certificate you can use the cert-manager.

You can check this link : https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes