TLS certificates

​

Serverless

• Certificates are issued by a public CA and rotated before expiry
• No action is required from you
• The certificate covers the workspace endpoint provisioned by e6data

​

In Your VPC

​

Initial certificate

kubectl create secret tls envoy-tls \
  -n <WORKSPACE_NAME> \
  --cert=fullchain.pem \
  --key=privkey.pem

​

Using Let’s Encrypt with cert-manager

1. Create a ClusterIssuer pointing to Let’s Encrypt’s production server
2. Create a Certificate resource targeting your workspace’s hostname
3. cert-manager fetches and renews the certificate automatically

​

Using your own CA

1. Generate a CSR for your workspace’s hostname
2. Submit to your CA
3. Receive the certificate and chain
4. Create the Kubernetes TLS secret as shown above

​

Certificate rotation

1. Generate or fetch a new certificate
2. Update the TLS secret:
   kubectl create secret tls envoy-tls \
     -n <WORKSPACE_NAME> \
     --cert=new-fullchain.pem \
     --key=new-privkey.pem \
     --dry-run=client -o yaml | kubectl apply -f -
   
3. Envoy automatically picks up the new certificate - typically within a minute, depending on how quickly kubelet syncs the updated secret to the pod; no pod restart needed

​

Monitoring certificate expiry

• Most observability platforms have a built-in TLS-expiry check
• For self-monitoring, query kubectl get secret envoy-tls -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -enddate -noout

​

Verifying your endpoint

openssl s_client -connect <workspace-endpoint>:443 -servername <workspace-endpoint> </dev/null 2>/dev/null | \
  openssl x509 -noout -subject -issuer -dates

​

See also

• Deploy a workspace: AWS · Azure
• Base cluster setup (installs cert-manager): AWS · Azure
• Create and manage clusters