Chapter 5. Securing a service network

Procedure

1. Create the service network router with a Kubernetes network policy:

   $ skupper init --create-network-policy

   Copy to Clipboard Toggle word wrap

2. Check the site status:

   $ skupper status

   Copy to Clipboard Toggle word wrap

   The output should be similar to the following:

   Skupper enabled for namespace 'west'. It is not connected to any other sites.

   Copy to Clipboard Toggle word wrap

Procedure

1. Deploy your backend service.

2. Expose your backend deployment on the service network, enabling TLS.

   For example, if you want to expose a TCP service:

   $ skupper expose deployment <deployment-name> --port 443 --enable-tls

   Copy to Clipboard Toggle word wrap

   Enabling TLS creates the necessary certificates required for TLS backends and stores them in a secret named skupper-tls-<deployment-name>.

3. Modify the backend deployment to include the generated certificates, for example:

   ...
       spec:
         containers:
         ...
           command:
           ...
           - "/certs/tls.key"
           - "/certs/tls.crt"
           ...
           volumeMounts:
           ...
           - mountPath: /certs
             name: certs
             readOnly: true
         volumes:
         - name: index-html
           configMap:
             name: index-html
         - name: certs
           secret:
             secretName: skupper-tls-<deployment-name>

   Copy to Clipboard Toggle word wrap

   Each site creates the necessary certificates required for TLS clients and stores them in a secret named skupper-service-client.

4. Modify the frontend deployment to include the generated certificates, for example:

   spec:
     template:
       spec:
         containers:
         ...
           volumeMounts:
           - name: certs
             mountPath: /tmp/certs/skupper-service-client
         ...
         volumes:
         - name: certs
           secret:
             secretName: skupper-service-client

   Copy to Clipboard Toggle word wrap
5. Test calling the service from a TLS enabled frontend.