From 03c0abb182e7b302122986b59609a8c4d2761175 Mon Sep 17 00:00:00 2001
From: Jerome Petazzoni <jerome.petazzoni@gmail.com>
Date: Tue, 26 Oct 2021 19:50:36 +0200
Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20Update=20Ingress=20TLS=20s?=
 =?UTF-8?q?ection?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 slides/k8s/ingress-tls.md | 71 +++++++++++++++++++++++++++++++++++----
 1 file changed, 64 insertions(+), 7 deletions(-)

diff --git a/slides/k8s/ingress-tls.md b/slides/k8s/ingress-tls.md
index 6799e344..fe35d86a 100644
--- a/slides/k8s/ingress-tls.md
+++ b/slides/k8s/ingress-tls.md
@@ -96,6 +96,26 @@ class: extra-details
 
 ---
 
+## Choose your adventure!
+
+- We present 3 methods to obtain a certificate
+
+- We suggest that we use method 1 (self-signed certificate)
+
+  - it's the simplest and fastest method
+
+  - it doesn't rely on other components
+
+- You're welcome to try methods 2 and 3 (leveraging certbot)
+
+  - they're great if you want to understand "how the sausage is made"
+
+  - they require some hacks (make sure port 80 is available)
+
+  - they won't be used in production (cert-manager is better)
+
+---
+
 ## Method 1, self-signed certificate
 
 - Thanks to `openssl`, generating a self-signed cert is just one command away!
@@ -352,6 +372,22 @@ Remove `--test-cert` to get a production certificate.
 
 ---
 
+## `kubectl create ingress`
+
+- We can also create an Ingress using TLS directly
+
+- To do it, add `,tls=secret-name` to an Ingress rule
+
+- Example:
+  ```bash
+  kubectl create ingress hello \
+          --rule=hello.example.com/*=hello:80,tls=hello
+  ```
+
+- The domain will automatically be inferred from the rule
+
+---
+
 class: extra-details
 
 ## About the ingress controller
@@ -368,16 +404,17 @@ class: extra-details
 
 .exercise[
 
-- Edit the Ingress manifest, `~/container.training/k8s/ingress.yaml`
+- Add the `tls` section to an existing Ingress
 
-- Uncomment the `tls` section
+- If you need to see what the `tls` section should look like, you can:
 
-- Update the `secretName` and `hosts` list
+  - `kubectl explain ingress.spec.tls`
 
-- Create or update the Ingress:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/ingress.yaml
-  ```
+  - `kubectl create ingress --dry-run=client -o yaml ...`
+
+  - check `~/container.training/k8s/ingress.yaml` for inspiration
+
+  - read the docs
 
 - Check that the URL now works over `https`
 
@@ -397,6 +434,26 @@ class: extra-details
 
 - A very popular option is to use the [cert-manager](https://cert-manager.io/docs/) operator
 
+---
+
+## Security
+
+- Since TLS certificates are stored in Secrets...
+
+- ...It means that our Ingress controller must be able to read Secrets
+
+- A vulnerability in the Ingress controller can have dramatic consequences
+
+- See [CVE-2021-25742](https://github.com/kubernetes/ingress-nginx/issues/7837) for an example
+
+- This can be mitigated by limiting which Secrets the controller can access
+
+  (RBAC rules can specify resource names)
+
+- Downside: each TLS secret must explicitly be listed in RBAC
+
+  (but that's better than a full cluster compromise, isn't it?)
+
 ???
 
 :EN:- Ingress and TLS