<p>I have a kubernetes cluster in a corporate environment, where all HTTPS traffic is <em>man-in-the-middled</em> and the certificates are replaced with the company owns. Right now, all the applications running on the cluster get the Company's certificates injected by rebuilding the Docker image or by mounting them from a secret and adding them to the local store. This is painful and makes it harder to just use public helm charts and docker images without modifying them.</p>
<p>For example, I'm running jenkins on the cluster, which tries to install plugins from <code>https://updates.jenkins-ci.org/</code>. This would normally fail in my case with a SSL exception, unless I add the certficates to the Jenkins keystore.</p>
<p>I was wondering if there's a way to set this up at the cluster level,
So that there's <em>some</em> component that deals with this and the applications can then access the internet normally, without being aware of the whole certificate situation?</p>
<p>My thoughts were:</p>
<ul>
<li>A cluster proxy pod, that all the applications then use.</li>
<li>Some ambassador container on each pod, that the apps connect to</li>
</ul>
<p>I would imagine I'm not the only one in this situation but couldn't find a generic solution for this.</p>

Chirlo
<p>You could have a look at <a href="https://istio.io/latest/" rel="nofollow noreferrer">istio</a>. It's a service mesh that uses sidecar proxies to (beside other things) take over responsibility for encrypting traffic between applications.</p>
<p>The proxies use the concept of mutual TLS (mTLS), where all connections inside the mesh are encrypted out-of-the-box. The applications them-self don't have to bother with certificates and can send messages in plain text.</p>
<p>Istio also provides a mechanism to <a href="https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/" rel="nofollow noreferrer">migrate to mTLS</a>, so you can include your applications into the mesh one by one, switch to mTLS and disable your own certification overhead.</p>
<p>You can set everything up with your own PKI so you're still using your companies certificates. Also you get a bunch of other features like enhanced observability, canary deployments, on the fly token based authentication/authorization and more.</p>
