I see that normally a new image is created, that is, a dockerfile, but is it a good practice to pass the cert through environment variables? with a batch that picks it up and places it inside the container

Another approach I see is to mount the certificate on a volume.

What would be the best approximation to have a single image for all environments? Just like what happens with software artifacts, I mean.

Creating a new image for each environment or renewal I find it tedious, but if it has to be like this...

CodePudding user response：

Definitely do not bake certificates into the image.

Because you tagged your question with azure-aks, I recommend using the Secrets Store CSI Driver to mount your certificates from Key Vault.

• See the plugin project page on GitHub
• See also this doc Getting Certificates and Keys using Azure Key Vault Provider
• This doc is better, more thorough and worth going through even if you're not using the nginx ingress controller Enable NGINX Ingress Controller with TLS

And so for different environments, you'd pull in different certificates from one or more key vaults and mount them to your cluster. Please also remember to use different credentials/identities to grab those certs.

CodePudding user response：

The cloud native approach would be to not have your application handle the certificates but to externalize that completely to a different mechanism.

You could have a look at service meshs. They mostly work with the sidecar pattern, where a sidecar container is running in the pod, that handles en-/decryption of your traffic. The iptables inside the pod are configured in a way, that all traffic must go through the sidecar.

Depending on your requirements you can check out istio and linkerd as service mesh solutions.

If a service mesh is not an option I would recommend to store your certs as secret and mount that as volume into your container.