JanssenProject / JanssenProject/jans
docs: add pathway for legacy enforce TLS between your NGINX Ingress controller and backend services
- Dominant language
- Java
- Stars
- 648
- Forks
- 174
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
### Check Backend Services
- For testing purposes generate certificates: backend pods need TLS certificates. Use tools like openssl or cfssl to create your own CA and sign server certificates for testing purposes.
- Important: The server certificate's Common Name (CN) or Subject Alternative Name (SAN) must match the Kubernetes service name (e.g., my-service.my-namespace.svc.cluster.local).
- Create Secrets: Store the server certificate (tls.crt) and private key (tls.key) in a standard Kubernetes secret of type kubernetes.io/tls. ( this gets automatically created)
- Configure Pods: all services must be configured to use this certificate and key to serve traffic over an HTTPS port (e.g., 8443).The service port also needs to be changed to 8443 instead of 8080. The TLS key and crt is already loaded in the javastore inside the services so there shouldn't be a need to load it inside the pods.
### Create a CA Secret for NGINX if doing TLS with verification
```
kubectl create secret generic my-ca-secret --from-file=ca.crt=/path/to/your/ca.crt
```
#### Ingress changes
```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: jans-auth-server
annotations:
# --- Backend TLS Configuration with TLS without verification---
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/proxy-ssl-verify: “off”
nginx.ingress.kubernetes.io/proxy-ssl-name: "my-backend-service.default.svc.cluster.local”
# —- Backend TLS configuration with TLS with verification
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/proxy-ssl-verify: “on"
nginx.ingress.kubernetes.io/proxy-ssl-ca-secret: "default/my-ca-secret"
nginx.ingress.kubernetes.io/proxy-ssl-name: "my-backend-service.default.svc.cluster.local”
backend:
service:
name: auth-server
port:
number: 8443
# --- Other typical annotations —
```
Contributor guide
Assessment
This issue has not been assessed yet.