managed TLS certificates for private AKS using private DNS zones

Question

I have a private AKS cluster that I can access via private link. To expose services I use NGINX ingress controller. I would like to enable HTTPS to my services, I have tried using cert-manager and the self-signed CA issuer. But I would like to know if there is a managed service in Azure that allows lifecycle management of TLS certificates for private endpoints. Thanks

Answer 1

@David Hernandez

Yes, Azure offers a managed service called Azure Key Vault that can help you manage the lifecycle of TLS certificates. There are several options, depending on the certificate you are using and autorenewal should be an option. The resources below should help in getting this setup for AKS:

Upgrade an existing AKS cluster with Azure Key Vault provider for Secrets Store CSI Driver support.

Enable autorotation for AKS.

Configure certificate auto-rotation in Key Vault for certificates issued by an integrated certification authority (CA) or self-signed

Automatic renewal for certificates from nonintegrated CAs

Hope this helps! If you have questions regarding Key Vault please feel free to open a new thread with the Azure Key Vault tag so our team of experts can assist.

---

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!