title: Https certificates and Kubernetes (EKS)
body: <p>I would like to secure my web application running on Kubernetes (EKS). All the nodes attached to the cluster are running on private subnets.</p>
  
  <p>I have one front-end service and a dozen back-end services.</p>
  
  <p>The front-end service is a pod running a container which is running on port 80. It is configured to be attached to an ELB which is only accepting traffic from 443 with an https certificate.</p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: service_name
    labels:
      app: service_name
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: xxxxxxxxxx
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
  spec:
    ports:
      - port: 443 # Exposed port
        targetPort: 80 # Container port
    selector:
       app: service_name
    type: LoadBalancer
  </code></pre>
  
  <p>The back-end services are pods running containers also running on port 80. None of them have been configured to be accessible from outside the cluster. Back-end services talk to each other by pointing to <a href="http://service_name" rel="nofollow noreferrer">http://service_name</a> (NOT https) as I configured them with this template:</p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: service_name
  spec:
    ports:
      - port: 80 # Exposed port
        targetPort: 80 # Container port
    selector:
       app: service_name
  </code></pre>
  
  <p>It all works but is it sufficient?</p>
  
  <p>Should the front-end/back-end containers use certificate/443 too with a wildcard https certificate? Should this configuration be done inside the container or on the services' configurations?</p>