On Sun, Mar 13, 2016 at 11:36 PM, Nishadi Kirielle <[email protected]> wrote:
> Hi all, > Currently I'm working on configuring HAProxy load balancing support for > app cloud. > In checking the session affinity functionality in kuberenetes, I have > verified the load balancing of http traffic with HAProxy. It could be done > using kubernetes contribution repo, 'service loadbalancer' [1]. > > In order to check the load balancing with https traffic the taken approach > is SSL termination.In the scenario of app cloud, kubernetes cluster is not > directly exposed and the load balancer exists within the cluster. Thus the > communication between the application servers and the load balancer happens > internally. Although SSL termination ends the secure connection at the load > balancer, due to the above mentioned reasons, SSL termination seems to be a > better solution. The reason for the use of SSL termination over SSL pass > through is because of the complexity of handling a separate SSL certificate > for each server behind the load balancer in the case of SSL pass through. > > -1 for this approach, IMO this has a major security risk. Let me explain the problem. If we offload SSL at the service load balancer, all traffic beyond the load balancer will use HTTP and the message content will be visible to anyone on network inside K8S. Which means someone can simply start a container in K8S and trace all HTTP traffic going through. Thanks In configuring load balancing with SSL termination, I had to customize > kubernetes haproxy.conf file template of service loadbalancer repo to > support SSL termination. > > In order to provide SSL termination, the kubernetes services have to be > annotated with > serviceloadbalancer/lb.sslTerm: "true" > > The default approach in load balancing with service load balancer repo is > based on simple fan out approach which uses context path to load balance > the traffic. As we need to load balance based on the host name, we need to > go with the name based virtual hosting approach. It can be achieved via the > following annotation. > serviceloadbalancer/lb.Host: "<host-name>" > > Any suggestions on the approach taken are highly appreciated. > > Thank you > > [1]. > https://github.com/kubernetes/contrib/tree/master/service-loadbalancer > > -- *Imesh Gunaratne* Senior Technical Lead WSO2 Inc: http://wso2.com T: +94 11 214 5345 M: +94 77 374 2057 W: http://imesh.io Lean . Enterprise . Middleware
_______________________________________________ Dev mailing list [email protected] http://wso2.org/cgi-bin/mailman/listinfo/dev
