Disabling TLS

[FabioAntunes]

Hey folks, is there a way to disable tls on the pod level? I want my aws load balancer to be responsible for the tls, terminating the tls and inside the cluster I just want to use http.

[JoshVanL]

Hi @FabioAntunes, disabling secure serving is not an option. You will need to either enable TCP pass through on your load balancer, or instead allow TLS communication from the LB -> Proxy.

[FabioAntunes]

Thanks for the quick response, if disabling TLS is not an option is there a way to make this work with traefik?

I'm getting the following:

http: TLS handshake error from 10.50.58.251:49444: remote error: tls: bad certificate

That IP address is from one of my traefik pods. Any clues?

Thanks in advance

[JoshVanL]

Sorry for the slow reply!

You'll need to add the serving CA that kube-oidc-proxy is using, as a trusted CA to traefik.

[tete17]

Hey @JoshVanL can I get a clarification.

You mentioned that disabling tls is not an option. Did you mean it is currently supported by the project, because the flags/options haven't been implemented or is it because there is an underlying technical reason the api can't be exposed through pure http (other than security of course) for an external proxy to handle tls like @FabioAntunes mentions. I think that case is a pretty typical scenario

[artazar]

+1 for this option it would be nice to use it with https ingress and terminate ssl on upper level