{"action":"created","issue":{"url":"https://api.github.com/repos/deis/deis/issues/4611","labels_url":"https://api.github.com/repos/deis/deis/issues/4611/labels{/name}","comments_url":"https://api.github.com/repos/deis/deis/issues/4611/comments","events_url":"https://api.github.com/repos/deis/deis/issues/4611/events","html_url":"https://github.com/deis/deis/issues/4611","id":111294106,"number":4611,"title":"Encrypt the router<->container link","user":{"login":"sbuss","id":494522,"avatar_url":"https://avatars.githubusercontent.com/u/494522?v=3","gravatar_id":"","url":"https://api.github.com/users/sbuss","html_url":"https://github.com/sbuss","followers_url":"https://api.github.com/users/sbuss/followers","following_url":"https://api.github.com/users/sbuss/following{/other_user}","gists_url":"https://api.github.com/users/sbuss/gists{/gist_id}","starred_url":"https://api.github.com/users/sbuss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbuss/subscriptions","organizations_url":"https://api.github.com/users/sbuss/orgs","repos_url":"https://api.github.com/users/sbuss/repos","events_url":"https://api.github.com/users/sbuss/events{/privacy}","received_events_url":"https://api.github.com/users/sbuss/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/deis/deis/labels/production-team","name":"production-team","color":"c7def8"},{"url":"https://api.github.com/repos/deis/deis/labels/security","name":"security","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"krancour","id":1821014,"avatar_url":"https://avatars.githubusercontent.com/u/1821014?v=3","gravatar_id":"","url":"https://api.github.com/users/krancour","html_url":"https://github.com/krancour","followers_url":"https://api.github.com/users/krancour/followers","following_url":"https://api.github.com/users/krancour/following{/other_user}","gists_url":"https://api.github.com/users/krancour/gists{/gist_id}","starred_url":"https://api.github.com/users/krancour/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krancour/subscriptions","organizations_url":"https://api.github.com/users/krancour/orgs","repos_url":"https://api.github.com/users/krancour/repos","events_url":"https://api.github.com/users/krancour/events{/privacy}","received_events_url":"https://api.github.com/users/krancour/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-10-13T23:40:09Z","updated_at":"2016-01-22T00:33:39Z","closed_at":null,"body":"Deis should support encrypting the router<->container hop.\r\n\r\nMy company's services must be HIPAA compliant. That means that we can't have any unencrypted personal health information (PHI) ever hitting the wire. Currently we're using Deis for internal tools with a strict no-PHI policy, but we'd like to open up usage to teams that do handle PHI.\r\n\r\nUnfortunately, the mullet VIP (TLS in the front, party in the back) that Deis uses by default makes this impossible.\r\n\r\nGiven the current architecture of Deis, I think the only two options are:\r\n\r\n1. Terminate TLS in the router, but make a new TLS connection to a container, which requires:\r\n    1. Add support for setting `https` for `proxy_pass`'s protocol, depending on an app's config\r\n    2. Allow configuring a self-signed cert for the routers to trust OR let Deis generate and inject private keys into containers, which Deis is pre-configured to trust\r\n2. Only Terminate TLS in the container, which requires:\r\n    1. Add support for setting `https` for `proxy_pass`'s protocol, depending on an app's config\r\n    2. Configure routing affinity to allow TLS sessions to be set up and used correctly\r\n\r\nAre there any plans for encrypting the final hop in the works?\r\n\r\nNote that in #deis @Joshua-Anderson suggested \"It could be interesting v2 feature. The k8s proxy could rencrypt traffic and then expose the keys to app containers.\""},"comment":{"url":"https://api.github.com/repos/deis/deis/issues/comments/173761264","html_url":"https://github.com/deis/deis/issues/4611#issuecomment-173761264","issue_url":"https://api.github.com/repos/deis/deis/issues/4611","id":173761264,"user":{"login":"bacongobbler","id":1360539,"avatar_url":"https://avatars.githubusercontent.com/u/1360539?v=3","gravatar_id":"","url":"https://api.github.com/users/bacongobbler","html_url":"https://github.com/bacongobbler","followers_url":"https://api.github.com/users/bacongobbler/followers","following_url":"https://api.github.com/users/bacongobbler/following{/other_user}","gists_url":"https://api.github.com/users/bacongobbler/gists{/gist_id}","starred_url":"https://api.github.com/users/bacongobbler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bacongobbler/subscriptions","organizations_url":"https://api.github.com/users/bacongobbler/orgs","repos_url":"https://api.github.com/users/bacongobbler/repos","events_url":"https://api.github.com/users/bacongobbler/events{/privacy}","received_events_url":"https://api.github.com/users/bacongobbler/received_events","type":"User","site_admin":false},"created_at":"2016-01-22T00:33:39Z","updated_at":"2016-01-22T00:33:39Z","body":"ping @krancour, what's the status on e2e https in v2? :)"}}