NLB or HAProxy - Better way to perform SSL termination?

Question

My architecture looks like this:

Here, the HTTPS requests first go to the route53 service for DNS resolution. Route53 forwards the request to the Network Load balancer . This service redirects the traffic to HAProxy pods running inside a Kube.netes cluster.

The HAProxy servers are required to read a specific request header and based on its value, it will route the traffic to backend. To keep things simple, I have kept a single K8 Backend cluster, but assume that there are more than 1 such backend cluster running.

Considering this architecture:

• What is the best place to perform TLS termination ? Should we do it at NLB (green box) or implement it at HAProxy (Orange box)?
• What are the advantages and disadvantages of each scenario?

Answer 1

As you are using the NLB you can achieve End to end HTTPS also however it forces the service also to use.

You can terminate at the LB level if you have multiple LB backed by clusters, leveraging the AWS cert manage with LB will be an easy way to manage the multiple setups.

There is no guarantee that if anyone that enters in your.network won't be able to exploit a bug capable of intercepting traffic between services, Software Defined Network(SDN) in your VPC is secure and protects from spoofing but no guarantee.

So there is an advantage if you use TLS/SSL inside the VPC also.