<p>How does EKS need to be configured to enable TLS/SSL between pods and external services such as RDS and MSK?</p>
<p>I could only find information on encrypting Kubernetes in-cluster traffic, but not for external traffic.</p>

AndCode
<p>All traffic exchanged between these Nitro instances is automatically encrypted with TLS, see <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit" rel="nofollow noreferrer">encryption in transit</a>. All AWS API service endpoints use TLS 1.2 (minimum), see <a href="https://aws.amazon.com/blogs/security/faster-aws-cloud-connections-with-tls-1-3/" rel="nofollow noreferrer">AWS cloud connections with TLS</a>. For RDS, you will need to download the certificate bundle for the RDS database you're using, add it as a Kubernetes Secret, and reference that secret in your Pod. See this <a href="https://paulbellamy.com/2017/07/connecting-to-postgres-rds-instances-from-ecs-with-ssl" rel="nofollow noreferrer">post</a> for additional details. I'm less familiar with Kafka and TLS, but it seems doable. According to the documentation, you'll need to add a certificate to your client's trust store, see <a href="https://docs.aws.amazon.com/msk/latest/developerguide/msk-authentication.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/msk/latest/developerguide/msk-authentication.html</a>.</p>
