TLS Support? #605

New issue

Open

opened 2023-07-27 11:19:04 +00:00 by defintielyInterested · 2 comments

defintielyInterested commented

2023-07-27 11:19:04 +00:00

I understand that the cookbook explains that there aren't any plans to support TLS in garage, but I have a use-case that I think needs TLS support baked into garage to function securely.

I am running a k8s cluster where certain services are backed by MinIO (currently) by referencing the internal DNS address of the service (e.g. minio.minio.svc.cluster.local). MinIO here is using a self-signed TLS cert trusted by the cluster (generated using cert-manager) so that this internal traffic is encrypted. I don't see a simple way (without having to install a full-blown service mesh with mutual TLS) to secure this traffic if garage does not support TLS encryption itself, as my reverse proxy (which does mutual TLS between itself and upstream services) sits as an ingress provider and is skipped internally.

Do you think that this use-case is common enough to warrant at least adding TLS support to garage?

I understand that the [cookbook](https://garagehq.deuxfleurs.fr/documentation/cookbook/encryption/#http-api-endpoints-provided-by-garage-are-in-clear-text) explains that there aren't any plans to support TLS in garage, but I have a use-case that I think needs TLS support baked into garage to function securely. I am running a k8s cluster where certain services are backed by MinIO (currently) by referencing the internal DNS address of the service (e.g. minio.minio.svc.cluster.local). MinIO here is using a self-signed TLS cert trusted by the cluster (generated using cert-manager) so that this internal traffic is encrypted. I don't see a simple way (without having to install a full-blown service mesh with mutual TLS) to secure this traffic if garage does not support TLS encryption itself, as my reverse proxy (which does mutual TLS between itself and upstream services) sits as an ingress provider and is skipped internally. Do you think that this use-case is common enough to warrant at least adding TLS support to garage?

maximilien commented

2023-07-27 14:35:24 +00:00

Owner

You could bundle a simple nginx/haproxy/apache/(insert your reverse proxy here) sidecar with each garage pod, and have that sidecar perform the TLS termination. Said sidecar would then be exposed at the K8s service level. This would however require a custom helm chart.

lx commented

2023-09-05 15:12:20 +00:00

Owner

There was a discussion on the Matrix channel a while ago, we try to keep Garage as lightweight as possible so ideally we would avoid implementing TLS directly in Garage, but if someone does it in a way such that it can be disabled at compile-time (using a feature flag), we would merge that code.

👀 1