Hi everyone.
I was trying to research about how to implement SSL on the traffic between my clients and the containers that I host on my server.
Basically, my plan was to use upstream SSL in HAProxy to attempt to achieve this, but in order for that to work, each individual container on my server needs to be able to decrypt SSL. I do not think that is possible and that every container has the necessary libraries for it. This puts a halt on my idea for upstream encryption of traffic from my reverse-proxy to my containers.
With that said, ChatGPT suggested I use Kubernetes with a service mesh like Istio. The idea was intriguing so I started to read about it; but before I dive head-first into using k3s (TBH it’s overkill for my setup), is there any way to implement server-side encryption with podman containers and a reverse-proxy?
After writing all of this, I think I’m missing the point about a reverse-proxy being an SSL termination endpoint, but if my question makes sense to you, please let me know your thoughts!
Thanks!
if I’m understanding your question correct, you are trying to use tls on containers that may not have tls libraries?
there are two ways to that. one is to rebuild every container by yourself modifying its services to contain tls. the other is to use a pod. you put your service container and a reverse proxy into the same pod, setup that reverse proxy correctly as an edge proxy terminating tls, and expose only the reverse proxy’s port. that way, it will just look like a service with tls enabled.
since you are considering tls for everyone, I assume that you don’t care about overheads. adding a reverse proxy in front of every container is like 10-50MB of additional memory, and it won’t matter on modern systems.
Thank you, this is an excellent idea. I will probably not run a pod for every container (technically I can, since Netavark is supported for rootless containers in Podman 4.0), but I will definitely have a few pods on my system, where I can definitely use a reverse-proxy for every pod. Just need to figure out how I can automate it.
Thanks again
The mesh proxy would work, but it’s not easy to configure and for somewhat little benefit, especially if they’re all running on the same box. The way that’d work is, NGINX would talk to the mesh proxy which would encrypt it to the other mesh proxy for the target container, and then it would talk to the container unencrypted again. You talk to 3 containers and still end up unencrypted.
Unless you want TLS between nodes and containers, you can skip the intermediate step and have NGINX talk directly to the containers plaintext. That’s why it’s said to do TLS termination: the TLS session ends at that reverse proxy.
Thanks. As another commenter mentioned, I’m planning to deploy a reverse proxy for every pod. I’m hoping this is OK
Why not just run a reverse proxy container on the server hosting the rest?
That’s what I’m doing, but I would have liked encrypted communications between the other containers and the proxy too
But why?
I do not prefer to not have much, if any unencrypted traffic on my network
The traffic between containers should not be done over your normal network, you should set up a private network between containers. That way it won’t matter if it’s not encrypted.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL k8s Kubernetes container management package
5 acronyms in this thread; the most compressed thread commented on today has 9 acronyms.
[Thread #264 for this sub, first seen 6th Nov 2023, 14:30] [FAQ] [Full list] [Contact] [Source code]
