# Using Replicated Console Certs in Kubernetes Workloads **URL:** \ **Category:** Packaging an application\ **Created:** [April 2, 2018, 5:40pm UTC](https://community.replicated.com/t/using-replicated-console-certs-in-kubernetes-workloads/107 "2018-04-02T17:40:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![dex](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/dex/32/26_2.png) [@dex](https://community.replicated.com/u/dex)\ **Post date:** [April 2, 2018, 5:40pm UTC](https://community.replicated.com/t/using-replicated-console-certs-in-kubernetes-workloads/107/1 "2018-04-02T17:40:42Z")
Often, you’ll want to give your Kubernetes+Replicated application access to the Replicated SSL certificates. This example includes an example for storing the replicated SSL data in a secret so it can be consumed by other workloads like reverse proxies and `Ingress` resources. ```yaml --- # kind: replicated replicated_api_version: 2.18.0 name: Replicated+Kubernetes TLS Demo host_requirements: replicated_version: ">=2.18.0" properties: console_title: Admin Console --- # kind: scheduler-kubernetes apiVersion: v1 kind: Secret metadata: name: www-tls # A generic v1/Secret that stores the Replicated Admin Console certificates type: kubernetes.io/tls data: tls.crt: '{{repl ConsoleSetting "tls.cert.data" | Base64Encode }}' tls.key: '{{repl ConsoleSetting "tls.key.data" | Base64Encode }}' --- # kind: scheduler-kubernetes apiVersion: apps/v1 kind: Deployment metadata: name: www labels: tier: www # An example nginx deployment that consumes the secret spec: selector: matchLabels: tier: www replicas: 3 template: metadata: labels: tier: www spec: volumes: - name: tls secret: secretName: www-tls containers: - name: www-test-container image: nginx:latest volumeMounts: - name: tls readOnly: true mountPath: "/etc/ssl/certs/" ``` Note that the above nginx workload isn’t configured to _use_ the certificates yet, but we can `exec` into the container to ensure they’ve been mounted properly: ```txt $ kubectl -n replicated-0590db2a890f4b434360e30c1348673d exec -it www-56d797474b-rmq7b bash root@www-56d797474b-rmq7b:/$ ls /etc/ssl/certs tls.crt tls.key root@www-56d797474b-rmq7b:/$ cat /etc/ssl/certs/tls.crt -----BEGIN CERTIFICATE----- MIIDmTCCAoGgAwIBAgIBCDANBgkqhkiG9w0BAQsFADA5MQwwCgYDVQQGEwNVU0Ex ... -----END CERTIFICATE----- root@www-56d797474b-rmq7b:/$ cat /etc/ssl/certs/tls.key -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAypBqm78lIukqi/RoKNWxxqNrGmhJdpesBuW8d38p2rdQaMYz ... -----END RSA PRIVATE KEY----- ``` ### Usage with Contour For contour, you’ll want to create a secret and Ingress object to forward to your services. Note that contour requires a dns name that matches the cert CN/SAN, IP addresses will not work. ```yaml apiVersion: extensions/v1beta1 kind: Ingress metadata: name: myapp-ingress spec: tls: - hosts: - '{{repl ConsoleSetting "tls.hostname"}}' secretName: myapp-tls rules: - http: paths: - path: /* backend: serviceName: myapp-ui servicePort: 3000 - path: /api/* backend: serviceName: myapp-api servicePort: 3000 - path: /graphql backend: serviceName: myapp-api servicePort: 3000 - host: '{{repl ConsoleSetting "tls.hostname"}}' http: paths: - path: /* backend: serviceName: myapp-ui servicePort: 3000 - path: /api/* backend: serviceName: myapp-api servicePort: 3000 - path: /graphql backend: serviceName: myapp-api servicePort: 3000 --- # kind: scheduler-kubernetes apiVersion: v1 data: tls.key: '{{repl ConsoleSetting "tls.key.data" | Base64Encode }}' tls.crt: '{{repl ConsoleSetting "tls.cert.data" | Base64Encode }}' kind: Secret metadata: name: myapp-tls namespace: default type: kubernetes.io/tls ``` ---
**Author:** ![zvikir](https://avatars.discourse-cdn.com/v4/letter/z/91b2a8/32.png) [@zvikir](https://community.replicated.com/u/zvikir)\ **Post date:** [November 17, 2022, 1:27pm UTC](https://community.replicated.com/t/using-replicated-console-certs-in-kubernetes-workloads/107/2 "2022-11-17T13:27:34Z")
> [@dex](#): > > `ConsoleSetting` Hey dex, Is the ConsoleSetting function still works? I get an error when trying to use it. ```auto function "ConsoleSetting" not defined ``` ---
**Author:** ![jdewinne](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/jdewinne/32/152_2.png) [@jdewinne](https://community.replicated.com/u/jdewinne)\ **Post date:** [November 17, 2022, 4:27pm UTC](https://community.replicated.com/t/using-replicated-console-certs-in-kubernetes-workloads/107/3 "2022-11-17T16:27:13Z")
This post was for an older version of Replicated afaik. If you’re using `kots`, you can use `ConfigOption`. See also the docs for an [example](https://docs.replicated.com/reference/template-functions-config-context#configoption) ---
**Author:** ![zvikir](https://avatars.discourse-cdn.com/v4/letter/z/91b2a8/32.png) [@zvikir](https://community.replicated.com/u/zvikir)\ **Post date:** [November 21, 2022, 1:59pm UTC](https://community.replicated.com/t/using-replicated-console-certs-in-kubernetes-workloads/107/4 "2022-11-21T13:59:33Z")
Okay, but is it possible to use the admin console certificates with ConfigOption ? ---
**Author:** ![jdewinne](https://yyz2.discourse-cdn.com/flex030/user_avatar/community.replicated.com/jdewinne/32/152_2.png) [@jdewinne](https://community.replicated.com/u/jdewinne)\ **Post date:** [November 21, 2022, 7:42pm UTC](https://community.replicated.com/t/using-replicated-console-certs-in-kubernetes-workloads/107/5 "2022-11-21T19:42:25Z")
Not sure if I fully understand your question, but I think you’re referring to the `kostadm-tls` secret: > **[Using TLS Certificates | Replicated Docs](https://docs.replicated.com/vendor/packaging-using-tls-certs)** > > The Replicated app manager provides default self-signed certificates that renew automatically. For Kubernetes installer clusters, the self-signed certificate renews 30 days before expiration when you enable the EKCO add-on version 0.7.0 and later.