<p>Moving from VMs to Kubernetes.</p>

<p>We are running our services on multiple VMs. Services are running on multiple VMs and have VIP in front of them. Clients will be accessing VIP and VIP will be routing traffic to services. Here, we use SSL cert for VIP and VIP to VM also using HTTPS. </p>

<p>Here the service will be deployed into VM with a JKS file. This JKS file will have a cert for exposing HTTPS and also to communicate with SSL enabled database.</p>

<p>How to achieve the same thing in Kubernetes cluster? Need HTTPS for VIP and services and also for communication to SSL enabled database from service.</p>

<p>Depends on the platform where you running Kubernetes (on-premises, AWS, GKE, GCE etc.) you have several ways to do it, but I will describe a solution which will work on all platforms - Ingress with HTTPS termination on it.</p>

<p>So, in Kubernetes you can provide access to your application inside a cluster using <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> object. It can provide load balancing, HTTPS termination, routing by path etc. In most of the cases, you can use Ingress controller based on <a href="https://github.com/kubernetes/ingress-nginx" rel="nofollow noreferrer">Nginx</a>. Also, it providing TCP load balancing and SSL Passthrough if you need it.</p>

<p>For providing routing from users to your services, you need:</p>

<ol>
<li>Deploy your application as a combination of <a href="https://kubernetes.io/docs/concepts/workloads/pods/pod/" rel="nofollow noreferrer">Pods</a> and <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Service</a> for them.</li>
<li>Deploy <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress controlle</a>r, which will manage your Ingress objects.</li>
<li>Create a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">secret</a> for your certificate.</li>
<li>Create an <code>Ingress</code> object with will point to your service with TLS settings for ask Ingress to use your <code>secret</code> with your certificate, like that:</li>
</ol>

<p><code>
spec:
  tls:
    hosts:
    - foo.bar.com
    secretName: foo-secret
</code></p>

<ol start="5">
<li>Now, when you call the <code>foo.bar.com</code> address, Ingress with using FQDN-based routing and provide HTTPS connection between your client and pods in a cluster using a <code>service</code> object, which knows where exactly your pod is. You can read how it works <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#what-is-ingress" rel="nofollow noreferrer">here</a> and <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">here</a>.</li>
</ol>

<p>What about encrypted communication between your services inside a cluster - you can use the same scheme with <code>secrets</code> for providing SSL keys to all your services and setup Service to use HTTPS endpoint of an application instead of HTTP. Technically it is same as using <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/" rel="nofollow noreferrer">https upstream</a> in installations without Kubernetes, but all configuration for Nginx will be provided automatically based on your <code>Service</code> and <code>Ingress</code> objects configuration.</p>
