<p>My architecture looks like this:</p>
<p><a href="https://i.stack.imgur.com/vxm5o.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vxm5o.jpg" alt="enter image description here" /></a></p>
<p>Here, the HTTPS requests first go to the route53 service for DNS resolution. Route53 forwards the request to the <a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/service/nlb/" rel="nofollow noreferrer">Network Load balancer</a>. This service redirects the traffic to HAProxy pods running inside a Kubernetes cluster.</p>
<p>The HAProxy servers are required to read a specific request header and based on its value, it will route the traffic to backend. To keep things simple, I have kept a single K8 Backend cluster, but assume that there are more than 1 such backend cluster running.</p>
<p>Considering this architecture:</p>
<ul>
<li>What is the best place to perform <a href="https://security.stackexchange.com/questions/20803/how-does-ssl-tls-work">TLS termination</a>? Should we do it at NLB (green box) or implement it at HAProxy (Orange box)?</li>
<li>What are the advantages and disadvantages of each scenario?</li>
</ul>

<p>As you are using the NLB you can achieve <strong>End to end</strong> HTTPS also however it forces the service also to use.</p>
<p>You can terminate at the LB level if you have multiple <strong>LB</strong> backed by clusters, leveraging the <strong>AWS cert manage</strong> with <strong>LB</strong> will be an easy way to manage the multiple setups.</p>
<p>There is no guarantee that if anyone that enters in your network won't be able to exploit a bug capable of intercepting traffic between services, Software Defined Network(SDN) in your VPC is secure and protects from spoofing but no guarantee.</p>
<p>So there is an advantage if you use <strong>TLS/SSL</strong> inside the VPC also.</p>
