Introduction

Securing communication over the internet is a crucial aspect of deploying applications in the cloud. Google Kubernetes Engine (GKE) and Kubernetes provide various methods to implement SSL/TLS to ensure secure communication between clients and services. In this article, we will explore how to enforce SSL for Kubernetes Ingress on GKE, providing a detailed step-by-step guide along with technical explanations and examples.

What is Kubernetes Ingress?

Kubernetes Ingress is an API object that manages external access to the services within a cluster, typically via HTTP and HTTPS. It can be configured to provide load balancing, SSL termination, and name-based virtual hosting.

Prerequisites

Before diving in, ensure that you meet these prerequisites:

• A Google Cloud Platform (GCP) account
• A GKE cluster
• The kubectl command-line tool configured to communicate with your cluster
• A domain name pointed to your Ingress's IP address
• An SSL certificate for your domain

SSL/TLS Overview

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols that provide encryption for data transferred over a network. Enforcing SSL/TLS ensures that data exchanged with your services is encrypted and secure from potential intercept or tampering threats.

Enforcing SSL in Kubernetes Ingress

Step 1: Obtain an SSL Certificate

1. Use Let's Encrypt: A popular method for obtaining SSL certificates is using Let's Encrypt, a free Certificate Authority.
2. Use Google-managed SSL Certificates: GKE simplifies SSL management by allowing you to use Google-managed certificates.

Step 2: Configure Ingress with SSL Certificate

Example: Using a Google-managed SSL Certificate

1. Create a ManagedCertificate Resource

1apiVersion: networking.gke.io/v1
2kind: ManagedCertificate
3metadata:
4  name: example-certificate
5spec:
6  domains:
7    - yourdomain.com

1. Apply the ManagedCertificate Resource

kubectl apply -f managed-cert.yaml

1. Create an Ingress Resource

The Ingress resource is configured to use the previously created ManagedCertificate:

1apiVersion: networking.k8s.io/v1
2kind: Ingress
3metadata:
4  name: example-ingress
5  annotations:
6    networking.gke.io/managed-certificates: "example-certificate"
7spec:
8  rules:
9  - host: yourdomain.com
10    http:
11      paths:
12      - path: /
13        pathType: Prefix
14        backend:
15          service:
16            name: example-service
17            port:
18              number: 80

1. Apply the Ingress Resource

kubectl apply -f ingress.yaml

Step 3: Verify SSL Enforcement

• Access your domain (e.g., https://yourdomain.com) to verify that the SSL/TLS encryption is active.
• Use tools like curl or a browser to inspect TLS details.

Step 4: Redirect HTTP to HTTPS

To ensure all traffic is encrypted, redirect HTTP traffic to HTTPS:

1apiVersion: networking.k8s.io/v1
2kind: Ingress
3metadata:
4  name: example-ingress
5  annotations:
6    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
7spec:
8  tls:
9  - hosts:
10    - yourdomain.com
11    secretName: example-tls-secret
12  rules:
13  - host: yourdomain.com
14    http:
15      paths:
16      - path: /
17        pathType: Prefix
18        backend:
19          service:
20            name: example-service
21            port:
22              number: 80

Step 5: Test the Setup

After applying the configurations, test to ensure that:

• The HTTPS site is loading with a valid certificate.
• HTTP requests are being redirected to HTTPS.

Summary Table

Below is a summary of key points for enforcing SSL with GKE Ingress:

Additional Considerations

• Certificate Renewal: Automate the renewal process for SSL certificates using Let's Encrypt certbot or similar tools.
• Monitoring: Implement monitoring to alert for SSL/TLS expiration or issues.
• Security Best Practices: Regularly update Kubernetes and adhere to best-practice guidelines for securing GKE clusters.

By following this guide, you should be able to enforce SSL/TLS encryption effectively on Kubernetes Ingress, ensuring secure access to your services hosted on GKE.