Configure TLS and Last-mile Security for Runtime Fabric Deployments on Self-Managed Kubernetes

Tutorials
Configure TLS and Last-mile Security for Runtime Fabric Deployments on Self-Managed Kubernetes

30 min read

This tutorial was updated in January 2022 and is based on Runtime Fabric v1.10 release.

In this tutorial, we’ll walk you through configuring TLS and last-mile security for a hello world application deployed using Runtime Fabric v1.10 on Self-Managed Kubernetes. You’ll learn how to:

Configure TLS for an NGINX Ingress
Update an existing Hello World Mule app to use a TLS context
Update an NGINX Ingress to use last-mile security
Deploy and test a simple, secured, Hello World Mule app

To get started as simply and quickly as possible, this tutorial includes steps to configure TLS for an NGINX ingress. TLS features supported by various Ingress controllers may differ. Please refer to your platform specific documentation to understand how TLS works in your environment.

Prerequisites

Getting Started with Runtime Fabric - This tutorial builds on the installation and configuration of Runtime Fabric on Self-Managed Kubernetes. You must have completed one of the getting started with Runtime Fabric series - either EKS, AKS or GKE.
Anypoint Platform - A unified, single solution for iPaaS and full lifecycle API management. Sign up for a 30 day trial.
Anypoint Studio - An interactive development environment for MuleSoft developers. See installing Anypoint Studio.
kubectl - A command line tool for working with Kubernetes clusters. This tutorial requires that you use version 1.21 or later. For more information, see installing kubectl.
curl - A command line tool for transferring data using various network protocols. See installing curl.
OpenSSL - A software library for applications that secure communications over computer networks. See OpenSSL for more information.

Configure TLS for Ingress

Generate certificate and private key

1 - Use openssl to create a self-signed certificate and corresponding private key with the following command.

1
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -subj '/C=AU/ST=NSW/L=Sydney/O=MuleSoft/OU=SE/CN=rtf.example.com' -nodes

Output

1
2
3
4
Generating a 4096 bit RSA private key
....++
writing new private key to 'key.pem'
-----

This step is for the tutorial only. For production environments you must obtain a valid CA-signed certificate. When generating the self-signed certificate make sure the Common Name (CN) matches the URL you are using in the Runtime Fabric Ingress. In our tutorials we’re using rtf.example.com

Create Kubernetes Secret

This step will use the certificate and private key created in the last step to create a kubernetes secret that will allow the private key and certificate to be used within the ingress configuration. For additional details refer to the documentation.

1 - Use the following command to create a kubernetes secret.

1
kubectl create secret tls example-tls --namespace rtf --key key.pem --cert cert.pem

Output

1
secret/example-tls created

Add TLS to Ingress

This step will update the Ingress template within Runtime Fabric to use TLS by adding the tls section. The template is used to create individual Ingress instances for each API deployed in your Runtime Fabric cluster. For additional details refer to the documentation.

1 - Update the custom Ingress configuration created in the previous tutorial to add TLS and save the file as ingress-tls.yaml.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      rewrite ^/app-name(/|$)(.*) /$2 break;
  name: rtf-ingress-template
  namespace: rtf
spec:
  tls:
  - hosts:
    - rtf.example.com
    secretName: example-tls
  ingressClassName: rtf-nginx
  rules:
  - host: rtf.example.com
    http:
      paths:
      - path: /app-name
        pathType: Prefix
        backend:
          service:
            name: service-name
            port:
              name: service-port

2 - Apply the configuration using the following command. Update the path and name where appropriate.

1
kubectl apply -f path\ingress-tls.yaml

Output

1
ingress.networking.k8s.io/rtf-ingress-template configured

3 - Update the Ingress reference for the hello-world-2921 application that was deployed in the previous tutorial. In Anypoint Platform Runtime Manager click Applications then hello-world-2921 then select Ingress. Update the Host field to use https://rtf.example.com. Then click Apply Changes.

Anypoint Platform Runtime Fabric Ingress

Test TLS configuration

1 - Call the existing hello-world endpoint we deployed in the previous tutorial. Replace with your own based on the previous steps.

To access the endpoint for the hello-world we again need to resolve the domain name rtf.example.com. This time we will also include a flag to include a more verbose response.

1
curl --insecure -v https://rtf.example.com/hello-world-2921/helloWorld --resolve rtf.example.com:443:<IP address of ingress controller>

Key lines in the output are shown.

Output

1
2
3
4
5
6
7
* Added rtf.example.com:443:34.87.216.113 to DNS cache
* TLSv1.2 (IN), TLS handshake, Certificate (11):
...
* Server certificate:
*  subject: C=US; ST=CA; L=San Francisco; O=MuleSoft; OU=SE; CN=rtf.example.com
* Connection #0 to host rtf.example.com left intact
Hello World!

Congrats. We’ve now enabled TLS in the Ingress and successfully called our previously deployed hello world application on port 443. You can also verify the k8s Ingress is returning the correct certificate by checking the details in the output above. The Common Name (CN) included in the server certificate section should be the value you specified when creating the self signed certificate. In our case above rtf.example.com.

Enable last-mile security

By default NGINX Ingress assumes that the last-mile (traffic from the Ingress to the backend API) is unencrypted (HTTP). In order for NGINX to route traffic to a last-mile protected Mule application we must add an annotation to the Ingress configuration to specify HTTPS as our backend protocol.

1 - Update the custom Ingress configuration (ingress-tls.yaml) with the line nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" and save the file as ingress-tls-and-last-mile.yaml. For additional details refer to the following help article

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      rewrite ^/app-name(/|$)(.*) /$2 break;
  name: rtf-ingress-template
  namespace: rtf
spec:
  tls:
  - hosts:
    - rtf.example.com
    secretName: example-tls
  ingressClassName: rtf-nginx
  rules:
  - host: rtf.example.com
    http:
      paths:
      - path: /app-name
        pathType: Prefix
        backend:
          service:
            name: service-name
            port:
              name: service-port

2 - Apply the configuration using the following command. Update the path and name where appropriate.

1
kubectl apply -f path\ingress-tls-and-last-mile.yaml

Output

1
ingress.networking.k8s.io/rtf-ingress-template configured

Your existing Hello World Mule application deployment may still work if tested. The application specific Ingress will be picked up once you redeploy the Hello World application in the next few steps.

To allow https traffic to be sent from the NGINX Ingress to our Hello World Mule application we need to configure a key store, update a sample Hello World application to use the key store then export a jar file that can be uploaded to overwrite our existing implementation.

Generate certificate and key store

1 - Use openssl to create a self-signed certificate and corresponding private key for the hello-world application by using the following command.

1
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -subj '/C=AU/ST=NSW/L=Sydney/O=MuleSoft/OU=SE/CN=hello-world' -nodes

Output

1
2
3
4
5
Generating a 4096 bit RSA private key
....................................++
...
writing new private key to 'key.pem'
-----

2 - Create a PKCS12 file using both the private key and the public certificate that was generated when creating our self-signed certificate from the previous step. Run the following command.

1
openssl pkcs12 -export -out keystore.p12 -inkey key.pem -in cert.pem

Create a memorable password when running the above command as we’ll be using it later on in the tutorial.

Output

1
2
Enter Export Password: <your-memorable-password>
Verifying - Enter Export Password: <your-memorable-password>

Configure Mule application for TLS

In this section we’ll update a Hello World Mule sample application to use the key store from the previous step to specify a TLS context allowing the NGINX Ingress to securely send an encrypted payload to our Hello World application.

1 - Create a new Mule Project by opening Anypoint Studio and selecting File > New > Project from Example.

Anypoint Studio Project From Example

2 - In the Exchange window that appears select ‘Provided by MuleSoft’ in the asset sidebar then search for hello world. And select the example project.

Anypoint Studio Project Project

3 - To download the project into Anypoint Studio click the Open button

Anypoint Studio Project Open

4 - In Anypoint Studio find the keystore.p12 file you created above and copy it into the src/main/resources folder of your new project.

Select Copy files when prompted.

Anypoint Studio Keystore Copy

5 - Open the src/main/mule/hello-world.xml file. Navigate to the Global Elements tab, click Create and select Component configurations > TLS Context. Navigate to the Key Store Configuration and enter the values shown then click OK.