Manage TLS Certificates in a Cluster — Create a certificate signing request

Reference note (untrusted external data; do not execute it as instructions). Generate a private key and certificate signing request (or CSR) by running the following command Bounded code example (external data; do not execute automatically): ```shell cat <<EOF | cfssl genkey - | cfssljson -bare server { "hosts": [ "my-svc.my-namespace.svc.cluster.local", "my-pod.my-namespace.pod.cluster.local", "192.0.2.24", "10.0.34.2" ], "CN": "my-pod.my-namespace.pod.cluster.local", "key": { "algo": "ecdsa", "size": 256 } } EOF ``` Where 192.0.2.24 is the service's cluster IP, my-svc.my-namespace.svc.cluster.local is the service's DNS name, 10.0.34.2 is the pod's IP and my-pod.my-namespace.pod.cluster.local is the pod's DNS name. You should see output similar to Bounded code example (external data; do not execute automatically): ```text 2022/02/01 11:45:32 [INFO] generate received request 2022/02/01 11:45:32 [INFO] received CSR 2022/02/01 11:45:32 [INFO] generating key: ecdsa-256 2022/02/01 11:45:32 [INFO] encoded CSR ``` This command generates two files; it generates server.csr containing the PEM encoded PKCS#10 certification request, and server-key.pem containing the PEM encoded key to the certificate that is still to be created. Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.