Securing Public Traffic with TLS Termination

Configure SSL/TLS termination at the load balancer level to ensure encrypted communication between external clients and your cluster infrastructure.

In this lesson, you will learn how to offload the heavy lifting of encryption from your application pods to the load balancer, ensuring secure transit for your users while keeping your internal services streamlined.

Understanding TLS Termination

When a user visits your application, their browser initiates a TLS handshake to encrypt the data. If your backend pods handle this process, they must spend valuable CPU cycles encrypting and decrypting every packet.

TLS Termination solves this by moving that cryptographic workload to the load balancer (the entry point of your cluster). When a user sends a request, the load balancer receives the encrypted traffic, decrypts it using an SSL certificate, and then forwards the plain HTTP request to your internal services. Because the traffic remains inside your private cluster network after the load balancer, the data is still secure without requiring your pods to manage complex certificate rotations or perform heavy decryption.

Configuring TLS at the Load Balancer

To implement this, you typically store your certificate and private key in a Kubernetes Secret. You then associate this secret with your Service (if your cloud provider supports it) or an Ingress resource.

Here is a conceptual example of how a service might be annotated to request a TLS-terminated load balancer from a cloud provider:

apiVersion: v1
kind: Service
metadata:
  name: my-app-service
  annotations:
    # Example annotation to attach a pre-created SSL cert to the LB
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:..."
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
spec:
  type: LoadBalancer
  ports:
  - port: 443
    targetPort: 80 # The LB decrypts the traffic and sends it to the container's HTTP port

By setting the targetPort to the cleartext port (80) of your container, you effectively "terminate" the TLS connection at the cloud load balancer. The load balancer handles the handshake, allowing your pods to focus entirely on application logic. This approach not only reduces resource consumption on your nodes but also centralizes certificate management, making it easier to rotate security credentials across your entire infrastructure.

Key Takeaway: TLS termination shifts the cryptographic burden to the load balancer, offloading CPU-intensive decryption from your application pods and simplifying certificate management across your cluster.