TLS encryption is one of the basic requirements of having a secure system. Ambassador Edge Stack automatically enables TLS termination/HTTPs , making TLS encryption easy and centralizing TLS termination for all of your services in Kubernetes.
While this automatic certificate management in Ambassador Edge Stack helps simply TLS configuration in your cluster, the Open-Source Emissary-ingress still requires you provide your own certificate to enable TLS.
The following will walk you through the process of enabling TLS with a
self-signed certificate created with the
Note these instructions also work if you would like to provide your own certificate to Ambassador Edge Stack.
This guide requires you have the following installed:
We first need to create a listener to tell Emissary which port will be using the HTTPS protocol
OpenSSL is a tool that allows us to create self-signed certificates for opening
a TLS encrypted connection. The
openssl command below will create a
create a certificate and private key pair that Emissary-ingress can use for TLS
Create a private key and certificate.
The above command will create a certificate and private key with the common name
ambassador. Since this certificate is self-signed and only used for testing, the other information requested can be left blank.
cert.pemfiles were created
Emissary-ingress dynamically loads TLS certificates by reading them from
Kubernetes secrets. Use
kubectl to create a
tls secret to hold the pem
files we created above.
Now that we have stored our certificate and private key in a Kubernetes secret
tls-cert, we need to tell Emissary-ingress to use this certificate
for terminating TLS on a domain. A
Host is used to tell Emissary-ingress which
certificate to use for TLS termination on a domain.
Create the following
Host to have Emissary-ingress use the
Secret we created
above for terminating TLS on all domains.
Note: If running multiple instances of Emissary-ingress in one cluster remember to include the
ambassador_id property in the
Host configured above with
Emissary-ingress is now configured to listen for TLS traffic on port
terminate TLS using the self-signed certificate we created.
We can now send encrypted traffic over HTTPS.
First, make sure the Emissary-ingress service is listening on
443 and forwarding
8443. Verify this with
If the output to the
kubectl command is not similar to the example above,
edit the Emissary-ingress service to add the
After verifying Emissary-ingress is listening on port 443, send a request to your backend service with curl:
Note: Since we are using a self-signed certificate, you must set the
flag in curl to disable hostname validation.
This guide walked you through how to enable basic TLS termination in Emissary-ingress using a self-signed certificate for simplicity.
While a self-signed certificate is a simple and quick way to get Emissary-ingress to terminate TLS, it should not be used by production systems. In order to serve HTTPS traffic without being returned a security warning, you will need to get a certificate from an official Certificate Authority like Let's Encrypt.
cert-manager provides a simple
way to manage certificates from Let's Encrypt. See our documentation for more
information on how to use
cert-manager with Emissary-ingress
Emissary-ingress exposes configuration for many more advanced options around TLS termination, origination, client certificate validation, and SNI support. See the full TLS reference for more information.