Enable TLS on load balancer

StreamNative Platform supports enabling TLS with AWS Certificate Manager (ACM). When you want to perform TLS termination at the load balancer, you can use certificates with ACM. ACM handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys that protect your AWS websites and applications.

The load balancer offloads traffic to the backend service via TCP protocols.

• One load balancer for Pulsar proxy with ports 6651/443
  • The DNS name is data.pulsar.example.local
• One load balancer for nginx ingress controller with port 443
  • The DNS name is admin.pulsar.example.local
• One load balancer for istio ingress( to KoP brokers ) with port 9093
  • The DNS name is messaging.pulsar.example.local

To use certificates with ACM, complete the following steps.

1. Request a public certificate from ACM for the following domain names, and get the Amazon Resource Names (ARNs) for the certificate.

   *.pulsar.example.local
   

2. In the YAML file, enable domain, configure the annotations, and use the ARN obtained above as shown.

   tls:
     enabled: false
     proxy:
       enabled: false
   
   # Domain requested from External DNS
   domain:
     enabled: true
     suffix: pulsar.example.local
   
   # Ingresses for exposing Pulsar services
   ingress:
     proxy:
       enabled: true
       external_domain: data.pulsar.example.local
       type: LoadBalancer
       tls:
         enabled: true
       annotations:
         external-dns.alpha.kubernetes.io/hostname: 'data.pulsar.example.local'
         service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
         service.beta.kubernetes.io/aws-load-balancer-type: nlb
         service.beta.kubernetes.io/aws-load-balancer-ssl-cert: '[ARN OF THE CERT]'
         # Enable this if the service is only accessed from the Amazon Virtual Private Cloud (Amazon VPC).
         #service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0
       extraSpec:
         externalTrafficPolicy: Local
   # Ingresses for exposing monitoring/management services publicly
   controller:
     enabled: true
     annotations:
       external-dns.alpha.kubernetes.io/hostname: 'admin.pulsar.example.local'
       service.beta.kubernetes.io/aws-load-balancer-ssl-cert: '[ARN OF THE CERT]'
       service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
     extraSpec:
       externalTrafficPolicy: Local
     # flag whether to terminate the tls at the loadbalancer level
     tls:
       termination: true
   control_center:
     enabled: true
     tls:
       enabled: true
     # Set external domain for the load balancer of the ingress controller
     external_domain: admin.pulsar.example.local
     external_domain_scheme: https://
   

3. Apply the changes by restarting the Pulsar proxy.

   helm upgrade -f /path/to/your/file.yaml <release_name> streamnative/sn-platform -n <k8s_namespace>