Enforcing mTLS for specific HTTPRoutes in Kubernetes

Question

Pulumi · Accepted Answer

Enforcing mutual TLS (mTLS) for specific HTTPRoutes in a Kubernetes cluster is a strategy to improve the security of microservices communication. mTLS ensures that both the client and server are authenticated with each other, creating a secure channel. In Kubernetes, you can enforce mTLS by using a service mesh such as Istio or Linkerd. However, as per the search registry, Pulumi does not provide direct support for configuring mTLS through its high-level components.

To implement mTLS, you generally need to follow these steps within your cluster:

1. Install a service mesh in your Kubernetes cluster. A service mesh like Istio provides a way to configure mTLS with its Custom Resource Definitions (CRDs).
2. Configure your services to use the service mesh's sidecar proxies, which enforce mTLS.
3. Define policies or PeerAuthentication resources that specify the mTLS settings at the namespace or service level.
4. Define HTTPRoute resources to control the traffic routing and associate them with the mTLS-enabled services.

Below is a conceptual TypeScript program using Pulumi for Kubernetes, demonstrating the general approach of setting up a service mesh and configuring mTLS. Please note that this assumes that a service mesh has been set up beforehand, as Pulumi itself doesn't install service meshes.

```typescript
import * as k8s from "@pulumi/kubernetes";

// Create a namespace for your service (if not already existing).
const ns = new k8s.core.v1.Namespace("my-namespace", {
    metadata: { name: "my-namespace" }
});

// Example service with label selectors to be referenced in HTTPRoute.
const myService = new k8s.core.v1.Service("my-service", {
    metadata: {
        name: "my-service",
        labels: { "app": "my-app" },
        namespace: ns.metadata.name,
    },
    spec: {
        ports: [{ port: 80, targetPort: "http" }],
        selector: { "app": "my-app" },
    },
});

// PeerAuthentication resource to enable mTLS for the service.
const peerAuth = new k8s.apiextensions.CustomResource("my-peer-authentication", {
    apiVersion: "security.istio.io/v1beta1",
    kind: "PeerAuthentication",
    metadata: {
        name: "my-peer-authentication",
        namespace: ns.metadata.name,
    },
    spec: {
        mtls: {
            mode: "STRICT" // This enforces mTLS strictly for all the services in the namespace.
        },
    },
});

// HTTPRoute configuration will depend on the specific configuration
// of the service mesh being used. This could be VirtualService in Istio,
// or a different CRD in another service mesh.
// The details in this example may not align with an actual service mesh requirement.
const httpRoute = new k8s.apiextensions.CustomResource("my-http-route", {
    apiVersion: "networking.istio.io/v1alpha3",
    kind: "VirtualService",
    metadata: {
        name: "my-http-route",
        namespace: ns.metadata.name,
    },
    spec: {
        hosts: ["my-service"],
        http: [
            {
                route: [{
                    destination: {
                        host: "my-service",
                        port: { number: 80 },
                    },
                }],
                // Additional route configuration could include:
                // - match conditions
                // - retries
                // - fault injection
                // - CORS policies
                // - etc.
            },
        ],
    },
});

export const namespaceName = ns.metadata.name;
export const serviceName = myService.metadata.name;
```

This sample demonstrates how you might configure resources in Kubernetes with a service mesh installed to enforce mTLS. Remember that the actual resources and their configurations will vary depending on the service mesh and its CRDs.

- `Namespace`: A namespace where your service and mTLS policies will be created.
- `Service`: A Kubernetes Service that defines how to access the pods in your deployment.
- `PeerAuthentication`: An Istio CRD that specifies the mTLS settings at the namespace or service level.
- `VirtualService`: An Istio CRD that defines HTTP routes for services within the service mesh, which can reference mTLS settings.

Let's break down what this script does:
- It first creates a Kubernetes namespace if it does not already exist.
- Then, it defines a service inside that namespace. This service is what your clients will connect to.
- It creates a `PeerAuthentication` resource to enforce mTLS for all services within the chosen namespace.
- It creates a `VirtualService` which specifies the routing configuration for the service, using the Istio service mesh.

To execute this Pulumi code, you would need to have Pulumi installed and configured to communicate with your Kubernetes cluster and install the necessary service mesh in your cluster. The program assumes you have already performed these steps.

Please remember to adjust the specific configurations of resources like `PeerAuthentication` and `VirtualService` to fit the exact requirements of your environment and the service mesh you are using.