JanssenProject / JanssenProject/jans

docs: add pathway for legacy enforce TLS between your NGINX Ingress controller and backend services

Open
#12,444 1 comment 0 reactions 1 assignee Claimed by @misba7 View on GitHub
area-documentation enhancement kind-feature
Dominant language
Java
Stars
648
Forks
174
Avg merge
1d 18h
Merged PRs (30d)
110

Description

### Check Backend Services
- For testing purposes generate certificates: backend pods need TLS certificates. Use tools like openssl or cfssl to create your own CA and sign server certificates for testing purposes.

- Important: The server certificate's Common Name (CN) or Subject Alternative Name (SAN) must match the Kubernetes service name (e.g., my-service.my-namespace.svc.cluster.local).

- Create Secrets: Store the server certificate (tls.crt) and private key (tls.key) in a standard Kubernetes secret of type kubernetes.io/tls. ( this gets automatically created)

- Configure Pods: all services must be configured to use this certificate and key to serve traffic over an HTTPS port (e.g., 8443).The service port also needs to be changed to 8443 instead of 8080. The TLS key and crt is already loaded in the javastore inside the services so there shouldn't be a need to load it inside the pods.

### Create a CA Secret for NGINX if doing TLS with verification

```
kubectl create secret generic my-ca-secret --from-file=ca.crt=/path/to/your/ca.crt
```

#### Ingress changes

```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: jans-auth-server
annotations:
# --- Backend TLS Configuration with TLS without verification---
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/proxy-ssl-verify: “off”
nginx.ingress.kubernetes.io/proxy-ssl-name: "my-backend-service.default.svc.cluster.local”
# —- Backend TLS configuration with TLS with verification
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/proxy-ssl-verify: “on"
nginx.ingress.kubernetes.io/proxy-ssl-ca-secret: "default/my-ca-secret"
nginx.ingress.kubernetes.io/proxy-ssl-name: "my-backend-service.default.svc.cluster.local”
backend:
service:
name: auth-server
port:
number: 8443
# --- Other typical annotations —
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.