<p>I'm setting up an 
 <strong><code>EKS</code></strong> cluster on <strong><code>AWS</code></strong> and I want to secure all the data in flight in the Kuberentes cluster (and also between EKS and external systems but thats out of scope here).</p>

<p>In Kubernetes are different protocols in use between the different pods, mainly <strong><code>Rest/HTTP</code></strong> but also communication between <strong><code>microservice-pods with a KafkaBroker</code></strong> and JDBC between <strong><code>microservice-pods and database pods</code></strong> (Zalando Postgres), between a <strong><code>filebeat-pod and elasticsearch</code></strong>, ...</p>

<p>I see several options but I don't like any of them.</p>

<ul>
<li>Encrypt every communication individually --> too much work. operational nightmare</li>
<li>Istio or LinkerD --> Works only for Http and gRPC, not for KafkaCommunication. Heavy ControlPlane.</li>
<li>a CNI like WeaveNet --> no support for SecurityGroups, FlowLogs, ACLs</li>
</ul>

<p>Are there better alternatives?
Would you recommend any of these options?</p>

christian
<p>One possible solution could be using a <a href="https://medium.com/@santhoz/nginx-sidecar-reverse-proxy-for-performance-http-to-https-redirection-in-kubernetes-dd9dbe2fd0c7" rel="nofollow noreferrer">nginx sidecar reverse proxy</a>  on all your pods to capture all outbound traffic in conjunction with nginx's <a href="https://chrislea.com/2014/03/20/using-proxy-protocol-nginx/" rel="nofollow noreferrer">proxy_protocol</a> directive to operate with ELBs and other load balancers. </p>

<p>You can accomplish this by modifying the iptables (or whatever SDN/pattern you choose to use in your setup) to force all outbound traffic into the reverse proxy instead of sending it out to the internet. You then use directives within <code>proxy_protocol</code> to <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream/" rel="nofollow noreferrer">force all upstream TCP connections to use SSL</a> using a certificate defined by the reverse proxy for encryption.</p>

<p>This should work for the protocols you defined since they're all based on TCP.</p>
