Enable TLS to the Gatekeeper

As a best practice, it is recommended that you configure the Corsha Gatekeeper with HTTPS. This will help to prevent the Corsha Cred from being intercepted and encrypts downstream client data.

note

Corsha uses x509 certificates for TLS

If the tlsTermination is not enabled, the Gatekeeper will not terminate SSL, and will expect all incoming traffic to be un-encrypted.

TLS Validation

The Gatekeeper is also able to do TLS validation when trustedCAs is configured. Multiple CAs can be provided to the Gatekeeper configuration. For a Helm Deployment, one or multiple trusted CA certificates can be provided by configuring them inline. For a Docker deployment, one or multiple CA certificates can be provided by copying them into the CA file at the filepath configured for trustedCAs.

Using Self-Signed Certificates

In order to use self-signed certificates with the Gatekeeper, trustedCAs must be configured.

TLS Termination

The Corsha Gatekeeper can be configured to perform TLS termination at the Gatekeeper. To enable TLS termination, add the following to either the proxy-config.yaml file for a Docker deployment or to the values.yaml for a Helm deployment.

http:
  tlsTermination:
    enabled: true

note

If you are using an ingress controller, you may need to configure SSL passthrough to allow TLS termination at the Gatekeeper. For example, to configure SSL passthrough for an NGINX ingress controller, add the following ingress annotation to the values.yaml for a Helm deployment of the Gatekeeper.

ingress:
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"

Docker Deployment Configuration

Once you have a server key pair, you simply need to configure the http.proxies[].tls.cert and http.proxies[].tls.key values in the proxy-config.yaml file. Set the trustedCAs value to do TLS validation at the Gatekeeper. To enable TLS termination at the Gatekeeper, set http.tlsTermination.enabled: true:

http:
  tlsTermination:
    enabled: true
  listenPort: 8080
  proxies:
    - name: service
      domain: service.com
      tls:
        cert: /etc/pki/tls/private/cert.crt
        key: /etc/pki/tls/private/cert.key
      upstream:
        host: "api-internal"
        port: 80
        protocol: HTTP

trustedCAs: /etc/pki/ca-trust/source/anchors/ca-bundle.pem

Helm Deployment Configuration

Set the http.proxies[].tls.cert and http.proxies[].tls.key values in the values.yaml file with inline certs and set http.tlsTermination.enabled to true to enable TLS Termination. Configure trustedCAs to do TLS validation at the Gatekeeper.

If you would like to configure the server key pair and trusted CAs in an encrypted format instead, see the Proxy Secret Configuration instructions.

http:
  tlsTermination:
    enabled: true
  listenPort: 8080
  proxies:
    - name: service
      domain: service.com
      tls:
        cert: |
            -----BEGIN CERTIFICATE-----
            <omitted>
            -----END CERTIFICATE-----
        key: |
            -----BEGIN CERTIFICATE-----
            <omitted>
            -----END CERTIFICATE-----
      upstream:
        host: "api-internal"
        port: 80
        protocol: HTTP

trustedCAs: |
    -----BEGIN CERTIFICATE-----
    <omitted>
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    <omitted>
    -----END CERTIFICATE-----

Instead of providing an http.proxies[].tls.cert and http.proxies[].tls.key, the Gatekeeper Helm configuration can also use an existing Kubernetes TLS secret. To do this, create a Kubernetes TLS secret in the namespace the Gatekeeper will deploy into with the server key pair. Note this option is not available for the trustedCAs.

kubectl -n <gatekeeper-namespace> create secret tls <secret-name> \
  --cert=path/to/cert/file \
  --key=path/to/key/file

Then reference the secret in the values.yaml file:

http:
  listenPort: 8080
  proxies:
    - name: service
      domain: service.com
      tls:
        existingSecret: "<secret-name>"
      upstream:
        host: "api-internal"
        port: 80
        protocol: HTTP