Need help in configuring a simple TLS/SSL within k8s cluster for pod to pod communication over https

user_16091092 0
Viewed 807

Need help on how to configure TLS/SSL on k8s cluster for internal pod to pod communication over https. Able to curl http://servicename:port over http but for https i am ending up with NSS error on client pod.

I generated a self signed cert with CN=*.svc.cluster.local (As all the services in k8s end with this) and i am stuck on how to configure it on k8s.

Note: i exposed the main svc on 8443 port and i am doing this in my local docker desktop setup on windows machine.

  1. No Ingress --> Because communication happens within the cluster itself.
  2. Without any CRD(custom resource definition) cert-manager
tls1.2 docker-desktop kubernetes openssl ssl-certificate
1 Answers

You can store your self-signed certificate inside the secret of Kubernetes and mount it to the volume of the pod.

If you don't want to use the CRD or cert-manager you can use the native Kubernetes API to generate the Certificate which will be trusted by all the pods by default.

https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/

managing the self singed certificate across all pods and service might be hard I would suggest using the service mesh. Service mesh encrypts the network traffic using the mTLS.

https://linkerd.io/2.10/features/automatic-mtls/#:~:text=By%20default%2C%20Linkerd%20automatically%20enables,TLS%20connections%20between%20Linkerd%20proxies.

Mutual TLS between service to service communication managed by the Side car containers in case of service mesh.

https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/

in this case, No ingress required and no cert-manager required.

user_55258240
Related