Red Hat OpenShift Container Platform

Add a service certificate

To secure internal communication to a service in Red Hat OpenShift Container Platform, you can annotate the service to generate a signed serving certificate and key pair into a secret in the same namespace.

The generated certificate is only valid for the internal service DNS name <service.name>.<service.namespace>.svc, and is only valid for internal communications. If your service is a headless service (no clusterIP value set), the generated certificate also contains a wildcard subject in the format of *.<service.name>.<service.namespace>.svc.

Because the generated certificates contain wildcard subjects for headless services, you must not use the service Certificate Authority (CA) if your client must differentiate between individual pods. In this case:

Generate individual TLS certificates by using a different CA.
Do not accept the service CA as a trusted CA for connections that are directed to individual pods and must not be impersonated by other pods. These connections must be configured to trust the CA that was used to generate the individual TLS certificates.

Prerequisites

You must have a service defined.

Procedure

Annotate the service with service.beta.openshift.io/serving-cert-secret-name:
```
$ oc annotate service <service_name> \
     service.beta.openshift.io/serving-cert-secret-name=<secret_name>
```
- Replace <service_name> with the name of the service to secure.
- <secret_name> will be the name of the generated secret containing the certificate and key pair.
  
  For convenience, it is recommended that this value be the same as <service_name>.
  
  For example, use the following command to annotate the service test1:
  $ oc annotate service test1 service.beta.openshift.io/serving-cert-secret-name=test1

Examine the service to confirm that the annotations are present:

$ oc describe service <service_name>

Example output

...
Annotations:              service.beta.openshift.io/serving-cert-secret-name: <service_name>
                          service.beta.openshift.io/serving-cert-signed-by: openshift-service-serving-signer@1556850837
...

After the cluster generates a secret for your service, your Pod spec can mount it, and the pod will run after it becomes available.