Publishing /v1/cert.pem

[vinzenz-muser]

Hi all

I recently set up Sealed Secrets on our cluster and it's working great.

However, I was wondering if what I am doing is a security risk. In the documentation it says:

"You can set up your internal automation to publish certificates somewhere you trust.

kubeseal --cert https://your.intranet.company.com/sealed-secrets/your-cluster.cert"

However, the cert is already published by the controller on /v1/cert.pem. So instead publishing the certs somewhere else, I set up an ingress controller with route-prefix /v1 to the controller, which works like a charm.

Is this considered bad practice or a security issue? Is the controller not considered secure?