Friday, August 25, 2017

Nginx Sidecar for TLS/SSL Termination on Kubernetes

The Sidecar

We have a requirement to force encrypted communication between all kubernetes pods running within our Google Container Engine (GKE) cluster. TLS termination can be done a number of ways within GKE using an ingress, but if we're to achieve encrypted pod to pod traffic, we need something within each pod to make this happen.

We decided to use an nginx process to perform our TLS termination, and configured it as a reverse proxy within each of our application pods. A depiction of the traffic flow is below.

Traffic arrives at the edge of the cluster in its encrypted state. Kubernetes routes traffic to the application pod based on a kubernetes service configuration. The nginx container is listening on 443, so it receives the traffic, terminates SSL, and proxies the request to our application container over localhost:8080.

(For more details on how networking works within Google Container Engine, please watch this great video from Google Cloud Next '17)

This nginx sidecar is a similar technique used in more sophisticated sidecars such as Lyft's Envoy and Google's Cloud Endpoints Extensible Service Proxy. We felt it was a good place to start without involving those frameworks (we're not there yet).

You can find a working implementation of this technique here:


This work was inspired by the following articles, how-to's and tools


  1. Lucky Club Casino site and login | Lucky Club Casino
    Lucky Club is a brand new social club created in 2017. Lucky Club is the first social club created by a community of casino players from all over the world.

  2. Las Vegas Casinos 2021 | JT Hub
    What you need to know 파주 출장샵 about Las Vegas Casinos 2021 - 당진 출장안마 Las Vegas Casinos the state of Nevada, and not 영천 출장샵 all 상주 출장샵 of the states 경상남도 출장마사지 allow online gambling.

  3. Merkur Gold Strike Safety Razor - FEBCASINO
    Merkur's Gold Strike Safety Razor, Merkur Platinum Edge Plated Finish, German, Gold-Plated, Satin Chrome Finish. Merkur has a more aggressive looking,

  4. iMyFone Filme Crack is a super easy-to-use video creation tool to create professional-looking videos. It provides you with plentiful effect .Gilisoft Video Editor Registration Code

  5. This article discusses useful ideas to ensure that|to ensure that} your CNC Machined prototypes have one of the best machining floor end possible. Type I – includes the creation of a thin layer on the metallic floor with utilization of} chromic acid. Material thickness, bending method, and bend angle typically affect the k-factor. These variables might make it troublesome to calculate k-factor accurately. The process is accurately repeatable and cost-effective with purposes ranging from medical to aerospace to interest lovers. Assembling the workpiece into the final design, typically by utilizing high precision machining other previously processed workpieces.

  6. Blow your family members out of the water this holiday season with these 25 best luxurious gift 우리카지노 ideas for the women in your life. Australia’s financial crimes watchdog AUSTRAC has ordered an audit of main sportsbooks Sportsbet and Bet365 to evaluate their compliance with anti-money laundering and counter-terrorism financing guidelines. According to info announced by AUSTRAC this week, its actions are outcome of|the outcomes of}... SJM additionally operates Casino Oceanus at Jai Alai, linked on to the Macau Outer Harbour Ferry Terminal. The adjoining Jai Alai complex includes Jai Alai Hotel and multiple of} restaurants.