# Setting up TLS CA for Kubernetes

**URL:** <https://forums.suse.com/t/setting-up-tls-ca-for-kubernetes/10013>\
**Category:** Rancher 1.x\
**Created:** [April 7, 2018, 7:19am UTC](https://forums.suse.com/t/setting-up-tls-ca-for-kubernetes/10013 "2018-04-07T07:19:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kfiles](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/kfiles/32/3927_2.png) [@kfiles](https://forums.suse.com/u/kfiles)\
**Post date:** [April 7, 2018, 7:19am UTC](https://forums.suse.com/t/setting-up-tls-ca-for-kubernetes/10013/1 "2018-04-07T07:19:49Z")

</div>

We are using Rancher 1.6.15 to manage a K8S 1.9.5 cluster from the catalog template. I cannot figure out how to get k8s cluster TLS cert signing to work.

Currently, if I create a CSR:  
apiVersion: [certificates.k8s.io/v1beta1](http://certificates.k8s.io/v1beta1)  
kind: CertificateSigningRequest  
metadata:  
name: app-tls-csr  
spec:  
groups:

- system:authenticated  
request:   
usages:
- digital signature
- key encipherment
- server auth

submit it:  
kubectl create -f csr.yaml

and approve it:  
kubectl certificate approve app-tls-csr

The CSR shows as approved, but never Issued:  
$ kc get certificatesigningrequest  
NAME AGE REQUESTOR CONDITION  
app-tls-csr.default 7h admin Approved

According to the k8s TLS docs:

> **[TLS bootstrapping](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/)**
>
> In a Kubernetes cluster, the components on the worker nodes - kubelet and kube-proxy - need to communicate with Kubernetes control plane components, specifically kube-apiserver. In order to ensure that communication is kept private, not interfered...

We need to add these params to the kube-controller-manager  
–cluster-signing-cert-file="/etc/path/to/kubernetes/ca/ca.crt" --cluster-signing-key-file="/etc/path/to/kubernetes/ca/ca.key"

Looking at my exisiting k8s processes, these are not being supplied by Rancher, and I see no variables in the template that can add additional args to the kube-controller-manager.

Can anyone suggest how to get TLS working properly within k8s managed by rancher?