kubernetes: set Https on LoadBalancer service

0
votes

I've read everywhere that to set Https to access a kubernetes cluster you need to have an Ingress and not simply a LoadBalancer service which also exposes the cluster outside.

My question is pretty theoretical: if an Ingress (and it is) is composed of a LoadBalancer service, a Controller (a deployment/pod of an nginx image for example) and a set of Rules (in order to correctly proxy the incoming requests inside the cluster), why can't we set Https in front of a LoadBalancer instead of an Ingress?

As title of exercise I've built the three components separately by myself (a LoadBalancer, a Controller/API Gateway with some Rules): these three together already get the incoming requests and proxy them inside the cluster according to specific rules so, I can say, I have built an Ingress by myself. Can't I add https to this structure and do I need to set a redundant part (a k8s Ingress) in front of the cluster?

1
nginxkuberneteshttpskubernetes-ingress
You are asking regarding local env or some cloud environments? - PjoterS
both, regarding kubernetes in general - Alex Mawashi

1 Answers

2
votes

Not sure if I fully understood your question.

In Kubernetes you are exposing you cluster/application using service, which is well described here. Good compare of all services can be found in this article.

When you are creating service type LoadBalancer it creates L4 LoadBalancer. L4 is aware of information like source IP:port and destination IP:port, but don't have any information about application layer (Layer 7). HTTP/HTTPS LoadBalancers are on Layer 7, so they are aware of application. More information about Load Balancing can be found here.

Layer 4-based load balancing to direct traffic based on data from network and transport layer protocols, such as IP address and TCP or UDP port

Layer 7-based load balancing to add content-based routing decisions based on attributes, such as the HTTP header and the uniform resource identifier

Ingress is something like LoadBalancer with L7 support.

The Ingress is a Kubernetes resource that lets you configure an HTTP load balancer for applications running on Kubernetes, represented by one or more Services. Such a load balancer is necessary to deliver those applications to clients outside of the Kubernetes cluster.

Ingress also provides many advantages. For example if you have many services in your cluster you can create one LoadBalancer and Ingress which will be able to redirect traffic to proper service and allows you to cut costs of creating a few LoadBalancers.

In order for the Ingress resource to work, the cluster must have an ingress controller running.

The Ingress controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources. The load balancer can be a software load balancer running in the cluster or a hardware or cloud load balancer running externally. Different load balancers require different Ingress controller implementations. In the case of NGINX, the Ingress controller is deployed in a pod along with the load balancer.

There are many Ingress Controllers, but the most popular is Nginx Ingress Controller

So my answer regarding:

why can't we set Https in front of a LoadBalancer instead of an Ingress?

It's not only about securing your cluster using HTTPS but also many capabilities and features which Ingress provides.

Very good documentation regarding HTTP(S) Load Balancing can be found on GKE Docs.