0

Currently I'm learning Kubernetes. It's running on my laptop VBox. I plan to deploy it on 'real' network, but with verry limited public IP. So all API service and Ingress-Nginx will be on private IP address (i.e: 192.168.x.y)

My question is: Can I do the SSL termination on ingress-nginx if it behind HA-Proxy that only reverse-proxying TCP?

enter image description here

Note : The line in red is the only physical ethernet network with Public IP Address

Sincerely

-bino-

Bino Oetomo
  • 571
  • 1
  • 10
  • 23

1 Answers1

1

ingress is more like an API gateway (reverse proxy) which routes the request to a specific backend service based on, for instance, the URL.

SSL Termination is part of reverse proxy. Encrypting the traffic between clients and servers protects it as it crosses a public network like the Internet. But decryption and encryption can be computationally expensive. By decrypting incoming requests and encrypting server responses, the reverse proxy frees up resources on backend servers which they can then devote to their main purpose, serving content.

Reverse proxy as a website’s “public face.” Its address is the one advertised for the website, and it sits at the edge of the site’s network to accept requests from web browsers and mobile apps for the content hosted at the website.

For more information refer to this document.

HAProxy is a reverse proxy for TCP and HTTP applications. Users can make use of HAProxy to improve the performance of websites and applications by distributing their workloads. Performance improvements include minimized response times and increased throughput.

HAProxy Ingress Controller - It does all the heavy lifting when it comes to managing external traffic into a kubernetes cluster.

Ramesh kollisetty
  • 245
  • 1
  • 7
  • thankyou for your help sir. But when CA (i.e Let's encrypt) get a request from my cert-manager, it'll have my HA-proxy node IP address, while the one doing encrypt-decrypt is ingress node that have private IP. Will it work? – Bino Oetomo Jul 25 '22 at 23:22
  • 1
    Please refer to this [link](https://www.haproxy.com/blog/enable-tls-with-lets-encrypt-and-the-haproxy-kubernetes-ingress-controller/) it will help. – Ramesh kollisetty Jul 27 '22 at 12:25
  • sir. The docs that you referingto is about ingress-haproxy-controller. My HA-Proxy is not inside of my cluster. it's at the network edge facing public internet. all my cluster nodes is at private IP and my ingress use ingress-nginx-controller. I really appreciate your response. – Bino Oetomo Jul 28 '22 at 06:52
  • Please check this [link](https://stackoverflow.com/questions/60168324/haproxy-with-public-ip-adress) for your reference and let me know if you facing any issues. – Ramesh kollisetty Jul 29 '22 at 10:38