Pod-to-pod mTLS

Mutual Transport Layer Security (mTLS) can be used to secure inter-pod traffic within the Instabase cluster.

Unsupported ports

The following ports, primarily used for metrics scraping, are not encrypted even when pod-to-pod mTLS is enabled (as of release 23.04).

Enabling pod to pod mTLS

To enable pod-to-pod mTLS in your Instabase cluster:

1. Create a Kubernetes secret called mesh-manager-tls that contains your key and certificates used for mTLS. See the following example:

apiVersion: v1
kind: Secret
metadata:
  name: mesh-manager-tls
  namespace: ${ib.namespace}
type: kubernetes.io/tls
data:
  ca.crt: {{CA certificate}}
  tls.key: {{TLS key}}
  tls.crt: {{TLS certificate}}

1. Make the following changes to the mesh-manager-config ConfigMap:

   • Set the mtls > enabled value to true.

   • Increase the version number by one. For example, if the current version number is 25, set the new version to 26. This enables the service mesh to pick up the key and certificates created in the previous step.

   • Set trust_domain to match the domain/subdomain covered by your tls.crt. For example, if your certificate covers the domain *.instabase.com, then set your trust_domain value to instabase.com.

See the following example:

apiVersion: v1
kind: ConfigMap
metadata:
  name: mesh-manager-config
  namespace: ${ib.namespace}
data:
  config.yaml: |-
    version: {n+1}
    mtls:
      enabled: true
    trust_domain: instabase.com
    ...
    ...