K8SNIff - End-to-End Encryption Till the Pod [A]
summary
A small Go binary called K8SNIff parses the TLS ClientHello SNI and does layer-3 forwarding to route encrypted connections straight to pods so pods retain client certificates for mTLS and API-server streaming. It runs on a node port (example binds 8443), uses Kubernetes Ingress resources to map hostnames to services, avoids terminate-and-reencrypt latency and works without cloud load balancers. Loodse uses it in production and a customer adopted it a month later; code is at https://github.com/kubermatic/kubermatic/k8sniff.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:29Kubernetes networking TLS issues
- 3:39Ingress controller limitations
- 5:47K8SNIff TLS to pod
- 8:58Live demo K8SNIff
- 13:18K8SNIff architecture deployment
- 15:26Use cases beyond HTTP
- 17:12Other applications feedback
- 19:00K8SNIff find contribute
- 20:03Extending K8SNIff custom
- 21:05Q&A
related talks
34mFrom Kubelet to Istio: Kubernetes Network Security Demystified
05mLightning Talk: Troubleshooting Envoy K8s Containers with Ksniff
33mBuilding a Secure, Multi-Protocol and Multi-Tenant Cluster for Internet-Facing Services [A]
38mImproving Secure Pod-to-Pod Communication Within Kubernetes Using...
42mSecuring Kubernetes Workloads with Istio Service Mesh
35mEmissary + Linkerd: A Guide to End-to-end Encryption for your Cluster
34mKinD, nGinx Ingress Controller & Secured gRPC server
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks