使用TLS保护Kubernetes服务

Question

I have an application that is internal and exposed only to other application on the cluster by a service with cluster IP. Other services are accessing this application via it's DNS ( serviceName-namespace.svc.cluster.local ). This application handles sensitive data, so although all the communication is inside the cluster I would like to use TLS to secure the communications to this application.

My question is - how can I enable TLS on a service? Is there something already exist or should I handle it on the application code? Also, is there already a CA I can use on the cluster that can sign certificates for .svc.cluster.local ?

To clarify, I know I can use ingress for this purpose. The only problem is keeping this service internal only - so only services inside the cluster will be able to access it.

Thanks, Omer

Answer 1

I just found that Kubernetes API can be used to generate a certificate that will be trusted by all the pods running on the cluster. This option might be simpler than the alternatives. You can find the documentation here , including full flow of generating a certificate and using it.

Answer 2

Following @vonc comments from bellow, I think I have a solution:

• Purchase a public valid domain for this service (eg something.mycompany.com ).
• Use CoreDNS to add override rule so all requests to something.mycompany.com will go to something-namesapce.svc.cluster.local , as the service is not exposed externally (this can be done also with normal A record for my use case).
• Use Nginx or something else to handle TLS with the certificate for something.mycompany.com .

This sounds pretty complicated but might work. What do you think?

Answer 3

Check if the tutorial " Secure Kubernetes Services with Ingress, TLS and LetsEncrypt " could apply to you:

Ingress can be backed by different implementations through the use of different Ingress Controllers. The most popular of these is the Nginx Ingress Controller , however there are other options available such as Traefik , Rancher , HAProxy , etc. Each controller should support a basic configuration, but can even expose other features (eg rewrite rules, auth modes) via annotations.

Give it a domain name and enable TLS. LetsEncrypt is a free TLS certificate authority, and using the kube-lego controller we can automatically request and renew LetsEncrypt certificates for public domain names, simply by adding a few lines to our Ingress definition!

In order for this to work correctly, a public domain name is required and should have an A record pointing to the external IP of the Nginx service.

For limiting to inside the cluster domain though ( svc.cluster.local ), you might need CoreDNS .

Answer 4

On Google Cloud you can make load balancer service internal, like this:

    annotations = {
      "cloud.google.com/load-balancer-type" = "Internal"
    }