<commit_before>---
layout: post
title: Configuring mTLS in OpenShift with Ingress Controller Operator
date: 2021-11-16
type: post
published: true
status: publish
categories:
- OpenShift
tags: []
author: rcarrata
comments: true
---

How you can enable mTLS authentication with OpenShift with including Service Mesh, only using the Ingress Controller Operator?

How this is implemented in the Ingress Controller and in the OpenShift Routers / Haproxies? How are the benefits of implementing mTLS?

Let's dig in!

## 1. Overview

All of us heard about TLS but which protections and benefits provides?

TLS provides us with two primary protections:

* The first protection, is that TLS encrypts your traffic to protect it from eavesdropping.

* The second is that TLS authenticates the server to the client (and optionally the client to the server as well) with the use of signed certificates.

But by default TLS only validates the authenticity of the server and not of the client (application) which is sending the request.

We can use mutual TLS where both clients request certificates from the server to ensure the server is who it says it is, and the server requests certificates from the client to prove who it is as well.

When using mutual authentication, not only does the service side prove its identity by exposing a certificate, but also the clients prove their identity to the servers by exposing a client-side certificate.

This provides a higher level of security compared to normal TLS/HTTPS usage, where only the identity of the server is proven.

[![](/images/mtls-ingress.png "mtls ingress 0")]({{site.url}}/images/mtls-ingress.png)

From the version 4.9+ of OpenShift we can enable mTLS authentication in the Ingress Controller, and configure them to verify client certificates.

So this involves that, we don't need to be forced to use Service Mesh ONLY for enable the [mTLS authentication](https://rcarrata.com/istio/mtls-service-mesh/)

NOTE: Service Mesh it's marvelous tech that enables tons of other features, as you can discover in the blog post series, so please check them!.

The tests on this blog post are executed in a 4.9.4 OpenShift environment.

## 2. Ingress Operator and Ingress Controller in OpenShift

The Ingress Operator in OpenShift makes it possible for external clients to access your service by deploying and managing one or more HAProxy-based Ingress Controllers to handle routing.

You can use the Ingress Operator to route traffic by specifying OpenShift Container Platform Route and Kubernetes Ingress resources.

As we pointed out in the previous section, from the 4.9 version of OpenShift the [Ingress Controller can enable mTLS authentication](https://docs.openshift.com/container-platform/4.9/networking/ingress-operator.html#nw-mutual-tls-auth_configuring-ingress), and configure the Ingresses (based in Haproxy) to verify the client certificates.

Let's test it with a example and check how this feature can help us with our use cases.

But before to start testing out the mTLS in the Ingress Controller, we need to prepare some prerequisites, like generate CA certificates, client certificates, etc.

## 3. Creating the CA certificate

First we would need a CA certificate which can sign both the client and server certificates.

* So let's create our directory structure to store the CA certificate and key.

```sh
mkdir /tmp/mtls

cd /tmp/mtls

mkdir certs private
```

* Next create an index.txt and serial file to track the list of certificates signed by the CA certificate.

```sh
echo 01 > serial
touch index.txt
```

* Download the openssl.cnf as example:

```sh
wget https://raw.githubusercontent.com/rcarrata/ocp4-network-security/main/mtls-ingress-operator/openssl.cnf
```
<commit_msg>change the image<commit_after>---
layout: post
title: Configuring mTLS in OpenShift with Ingress Controller Operator
date: 2021-11-16
type: post
published: true
status: publish
categories:
- OpenShift
tags: []
author: rcarrata
comments: true
---

How you can enable mTLS authentication with OpenShift with including Service Mesh, only using the Ingress Controller Operator?

How this is implemented in the Ingress Controller and in the OpenShift Routers / Haproxies? How are the benefits of implementing mTLS?

Let's dig in!

## 1. Overview

All of us heard about TLS but which protections and benefits provides?

TLS provides us with two primary protections:

* The first protection, is that TLS encrypts your traffic to protect it from eavesdropping.

* The second is that TLS authenticates the server to the client (and optionally the client to the server as well) with the use of signed certificates.

But by default TLS only validates the authenticity of the server and not of the client (application) which is sending the request.

We can use mutual TLS where both clients request certificates from the server to ensure the server is who it says it is, and the server requests certificates from the client to prove who it is as well.

When using mutual authentication, not only does the service side prove its identity by exposing a certificate, but also the clients prove their identity to the servers by exposing a client-side certificate.

This provides a higher level of security compared to normal TLS/HTTPS usage, where only the identity of the server is proven.

[![](/images/mtls-ingress.png "mtls ingress 0")]({{site.url}}/images/mtls-ingress.png)

From the version 4.9+ of OpenShift we can enable mTLS authentication in the Ingress Controller, and configure them to verify client certificates.

So this involves that, we don't need to be forced to use Service Mesh ONLY for enable the [mTLS authentication](https://rcarrata.com/istio/mtls-service-mesh/)

NOTE: Service Mesh it's marvelous tech that enables tons of other features, as you can discover in the blog post series, so please check them!.

The tests on this blog post are executed in a 4.9.4 OpenShift environment.

## 2. Ingress Operator and Ingress Controller in OpenShift

The Ingress Operator in OpenShift makes it possible for external clients to access your service by deploying and managing one or more HAProxy-based Ingress Controllers to handle routing.

You can use the Ingress Operator to route traffic by specifying OpenShift Container Platform Route and Kubernetes Ingress resources.

As we pointed out in the previous section, from the 4.9 version of OpenShift the [Ingress Controller can enable mTLS authentication](https://docs.openshift.com/container-platform/4.9/networking/ingress-operator.html#nw-mutual-tls-auth_configuring-ingress), and configure the Ingresses (based in Haproxy) to verify the client certificates.

Let's test it with an example and check how this feature can help us with our use cases.

But before to start testing out the mTLS in the Ingress Controller, we need to prepare some prerequisites, like generate CA certificates, client certificates, etc.

## 3. Creating the CA certificate

First we would need a CA certificate which can sign both the client and server certificates.

* So let's create our directory structure to store the CA certificate and key.

```sh
mkdir /tmp/mtls

cd /tmp/mtls

mkdir certs private
```

* Next create an index.txt and serial file to track the list of certificates signed by the CA certificate.

```sh
echo 01 > serial
touch index.txt
```

* Download the openssl.cnf as example:

```sh
wget https://raw.githubusercontent.com/rcarrata/ocp4-network-security/main/mtls-ingress-operator/openssl.cnf
```
