Kubernetes Endpoint with SSL

7/17/2019

Is it possible to use SSL in Endpoint?

I have an Azure Database for MySQL, which requires an SSL certificate for connection. I use the following: https://www.digicert.com/CACerts/BaltimoreCyberTrustRoot.crt.pem

On Kubernetes I have run a NodeJS Pod which communicate to MySQL by an Endpoint like that:

kind: Service
apiVersion: v1
metadata:
  name: mysql-remote
spec:
  ports:
  - protocol: TCP
    port: 3306
    targetPort: 3306
---

kind: Endpoints
apiVersion: v1
metadata:
  name: mysql-remote
subsets:
  - addresses:
      - ip: xx.xxx.xxx.xx
    ports:
      - port: 3306

My deplomyent.yaml file looks like that:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nodejs
spec:
  replicas: 2
  template:
    metadata:
      labels:
        app: nodejs
    spec:
      nodeSelector:
        "beta.kubernetes.io/os": linux
      containers:
      - name: nodejs
        image: xxx
        ports:
        - containerPort: 80
          name: nodejs
        env:
        - name: HOST
          value: "mysql-remote"
        - name: USER
          valueFrom:
            secretKeyRef:
              name: nodejssecret
              key: username
        - name: PASSWORD
          valueFrom:
            secretKeyRef:
              name: nodejssecret
              key: password

First I tried to mount the certificate as a Volume to NodeJS. That looks very awkward if I use for example 10 different Applications. Is there an easy way to use the SSL?

-- Nico Schuck
kubernetes

1 Answer

8/9/2019

Review the Security on Azure Kubernetes Service (AKS) part in deploying-a-stateful-application-on-azure-kubernetes-service-aks article.

The idea is to create secter from BaltimoreCyberTrustRoot.crt.pem cert and use it in the deployment

- name: database__connection__ssl
             valueFrom:
               secretKeyRef:
                 name: ssl-cert
                 key: BaltimoreCyberTrustRoot.crt.pem
-- VKR
Source: StackOverflow