9

I have a Kubernetes cluster (AKS) that is hosting a REST echo service. The service runs fine via HTTP. I am using NGINX ingress to route traffic. I now want to set up this service via HTTPS and with mTLS, so forcing the client to specify a certificate to be able to communicate with the echo service. This is a POC, so I am using a self-signed cert.

What Kubernetes components do I need to set up to be able to pull this off? I read NGINX documentation but wasn't able to understand if I need to create a Certificate Authority/Cert-manager in the Kubernetes cluster and use that to configure an ingress service to perform the mTLS step. I am OK with terminating the SSL at ingress (after mTLS has been performed) and allow an unsecured channel from ingress to the echo-service.

I am hoping someone with experience with this kind of setup can provide some guidance.

Thanks!

Rico
  • 58,485
  • 12
  • 111
  • 141
wntrsux
  • 123
  • 1
  • 1
  • 4

1 Answers1

15

First, mTLS and TLS/SSL termination are not exactly the same thing. mTLS is mutual authentication meaning the client authenticates the server and the server authenticates the client.

Typically the SSL termination takes care of the server authenticating the client but it takes client support for the server to be able to authenticate the client.

Also, the Certificate Authority and what I believe you are referring to as certificate manager are 2 different things.

For Kubernetes, you can set up TLS/SSL termination on an Ingress using an ingress controller like Nginx. You can totally use a self-signed certificate with your own Certificate Authority with this. The only thing is that your requests will not be verified but your client/browser unless the CA (Certificate Authority) is added as a trusted entity.

Now with respect to mTLS you don't necessarily care if you use exactly the same CA, Cert, and Key to authenticate both ways. However, you would have to force your ingress to authenticate the client and with the Nginx ingress controller you can do it with these annotations:

nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
nginx.ingress.kubernetes.io/auth-tls-secret: "default/mycerts"

You would create the above secret in K8s with something like this:

kubectl create secret generic mycerts --from-file=tls.crt=server.crt --from-file=tls.key=server.key --from-file=ca.crt=ca.crt

Some more details in this blog.

Note: Service meshes like Istio, Linkerd, and Consul support mTLS out the box between your services.

✌️

Rico
  • 58,485
  • 12
  • 111
  • 141
  • Thanks for the information. I will continue digging. – wntrsux Jul 28 '20 at 04:29
  • Could you please help me in testing the ingress in AWS NLB without using other domains. – Srikanth Bhandary Jan 25 '21 at 12:12
  • If you need help to set up your certs, I wrote a guide here: https://thoughts-about-code.blogspot.com/2021/12/creating-a-ca-for-mtls-with-openssl.html – Peter Molnar Dec 06 '21 at 00:51
  • Hi this is a really good answer but could you help with this question here. https://stackoverflow.com/questions/74048072/can-you-terminate-mtls-mqtts-or-https-client-to-ingress-load-balancer-with-a – Christian Matthew Oct 12 '22 at 21:16