How to Configure TLS for Apache APISIX

Security in one's information system has always been among the most critical Non-Functional Requirements. Transport Secure Layer, TLS, formerly SSL, is among its many pillars. In this post, I'll show how to configure TLS for the API Gateway. aka Apache APISIX TLS in a few words offers several capabilities: TLS Server authentication: the client is confident that the server it exchanges data with is the right one. It avoids sending data, which might be confidential, to the wrong actor Optional client authentication: the other way around, the server only allows clients whose identity can be verified Confidentiality: no third party can read the data exchanged between the client and the server Integrity: no third party can tamper with the data TLS works through certificates. A certificate is similar to an ID, proving the certificate's holder identity. Just like an ID, you need to trust who delivered it. Trust is established through a chain: if I trust Alice, who trusts Bob, who in turn trusts Charlie, who delivered the certificate, then I trust the latter. In this scenario, Alice is known as the . root certificate authority TLS authentication is based on public key cryptography. Alice generates a public key/private key pair and publishes the public key. If one encrypts data with the public key, only the private key that generated the public key can decrypt them. The other usage is for one to encrypt data with the private key and everybody with the public key to decrypt it, thus proving their identity. Finally, mutual TLS, mTLS, is the configuration of two-way TLS: server authentication to the client, as usual, but also the other way around, client authentication to the server. aka We now have enough understanding of the concepts to get our hands dirty. Generating certificates with cert-manager A couple of root Certificate Authorities are installed in browsers by default. That's how we can browse HTTPS websites safely, trusting that https://apache.org is the site they pretend to be. The infrastructure has no pre-installed certificates, so we must start from scratch. We need at least one root certificate. In turn, it will generate all other certificates. While it's possible to do every one manually, I'll rely on r in Kubernetes. As its name implies, cert-manager is a solution to manage certificates. cert-manage Installing it with Helm is straightforward: helm repo add jetstack https://charts.jetstack.io #1 helm install \ cert-manager jetstack/cert-manager \ --namespace cert-manager \ #2 --create-namespace \ #2 --version v1.11.0 \ --set installCRDs=true \ --set prometheus.enabled=false #3 Add the charts' repository Install the objects in a dedicated namespace Don't monitor, in the scope of this post We can make sure that everything works as expected by looking at the pods: kubectl get pods -n cert-manager cert-manager-cainjector-7f694c4c58-fc9bk 1/1 Running 2 (2d1h ago) 7d cert-manager-cc4b776cf-8p2t8 1/1 Running 1 (2d1h ago) 7d cert-manager-webhook-7cd8c769bb-494tl 1/1 Running 1 (2d1h ago) 7d cert-manager can sign certificates from multiple sources: HashiCorp Vault, Let's Encrypt, etc. To keep things simple: We will generate our dedicated root certificate, , i.e. Self-Signed We won't handle certificates rotation Let's start with the following: apiVersion: cert-manager.io/v1 kind: ClusterIssuer #1 metadata: name: selfsigned-issuer spec: selfSigned: {} --- apiVersion: v1 kind: Namespace metadata: name: tls #2 --- apiVersion: cert-manager.io/v1 kind: Certificate #3 metadata: name: selfsigned-ca namespace: tls spec: isCA: true commonName: selfsigned-ca secretName: root-secret issuerRef: name: selfsigned-issuer kind: ClusterIssuer group: cert-manager.io --- apiVersion: cert-manager.io/v1 kind: Issuer #4 metadata: name: ca-issuer namespace: tls spec: ca: secretName: root-secret Certificate authority that generates certificates cluster-wide Create a namespace for our demo Namespaced root certificate using the cluster-wide issuer. Only used to create a namespaced issuer Namespaced issuer. Used to create all other certificates in the post After applying the previous manifest, we should be able to see the single certificate that we created: kubectl get certificate -n tls NAME READY SECRET AGE selfsigned-ca True root-secret 7s The certificate infrastructure is ready; let's look at Apache APISIX. Quick overview of a sample Apache APISIX architecture is an API Gateway. By default, it stores its configuration in , a distributed key-value store - the same one used by Kubernetes. Note that in real-world scenarios, we should set up etcd clustering to improve the resiliency of the solution. For this post, we will limit ourselves to a single etcd instance. Apache APISIX etcd Apache APISIX offers an admin API via HTTP endpoints. Finally, the gateway forwards calls from the client to an upstream. Here's an overview of the architecture and the required certificates: Let's start with the foundational bricks: etcd and Apache APISIX. We need two certificates: one for etcd, in the server role, and one for Apache APISIX, as the etcd client. Let's set up certificates from our namespaced issuer: apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: etcd-server #1 namespace: tls spec: secretName: etcd-secret #2 isCA: false usages: - client auth #3 - server auth #3 dnsNames: - etcd #4 issuerRef: name: ca-issuer #5 kind: Issuer --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: apisix-client #6 namespace: tls spec: secretName: apisix-client-secret isCA: false usages: - client auth emailAddresses: - apisix@apache.org #7 issuerRef: name: ca-issuer #5 kind: Issuer Certificate for etcd Kubernetes name, see below Secret Usages for this certificate Kubernetes name, see below Service Reference the previously namespaced issuer created earlier Certificate for Apache APISIX as a client of etcd Mandatory attribute for clients After applying the above manifest, we can list the certificates in the namespace: tls kubectl get certificates -n tls NAME READY SECRET AGE selfsigned-ca True root-secret 8m59s //1 apisix-client True apisix-client-secret 8m22s //2 etcd-server True etcd-secret 8m54s //2 Previously created certificate Newly-created certificates signed by selfsigned-ca cert-manager's Certificates So far, we have created objects, but we didn't explain what they are. Indeed, they are simple Kubernetes CRD s provided by cert-manager. Certificate Under the cover, cert-manager creates a Kubernetes from a . It manages the whole lifecycle, so deleting a deletes the bounded . The attribute in the above manifest sets the name. Secret Certificate Certificate Secret secretName Secret kubectl get secrets -n tls NAME TYPE DATA AGE apisix-client-secret kubernetes.io/tls 3 35m etcd-secret kubernetes.io/tls 3 35m root-secret kubernetes.io/tls 3 35m Let's look at a , , : Secret e.g. apisix-client-secret kubectl describe apisix-client-secret -n tls Name: apisix-client-secret Namespace: tls Labels: controller.cert-manager.io/fao=true Annotations: cert-manager.io/alt-names: cert-manager.io/certificate-name: apisix-client cert-manager.io/common-name: cert-manager.io/ip-sans: cert-manager.io/issuer-group: cert-manager.io/issuer-kind: Issuer cert-manager.io/issuer-name: ca-issuer cert-manager.io/uri-sans: Type: kubernetes.io/tls Data ==== ca.crt: 1099 bytes tls.crt: 1115 bytes tls.key: 1679 bytes A created by a provides three attributes: Secret Certificate : The certificate itself tls.crt : The private key tls.key : The signing certificate in the certificate chain, , ca.crt i.e. root-secret/tls.crt Kubernetes encodes content in base 64. To get any of the above in plain text, one should decode it, : Secret e.g. kubectl get secret etcd-secret -n tls -o jsonpath='{ .data.tls\.crt }' | base64 -----BEGIN CERTIFICATE----- MIIDBjCCAe6gAwIBAgIQM3JUR8+R0vuUndjGK/aOgzANBgkqhkiG9w0BAQsFADAY MRYwFAYDVQQDEw1zZWxmc2lnbmVkLWNhMB4XDTIzMDMxNjEwMTYyN1oXDTIzMDYx NDEwMTYyN1owADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMQpMj/0 giDVOjOosSRRKUwTzl1Wo2R9YYAeteOW3fuMiAd+XaBGmRO/+GWZQN1tyRQ3pITM ezBgogYAUUNcuqN/UAsgH/JM58niMjZdjRKn4+it94Nj1e24jFL4ts2snCn7FfKJ 3zRtY9tyS7Agw3tCwtXV68Xpmf3CsfhPmn3rGdWHXyYctzAZhqYfEswN3hxpJZxR YVeb55WgDoPo5npZo3+yYiMtoOimIprcmZ2Ye8Wai9S4QKDafUWlvU5GQ65VVLzH PEdOMwbWcwiLqwUv889TiKiC5cyAD6wJOuPRF0KKxxFnG+lHlg9J2S1i5sC3pqoc i0pEQ+atOOyLMMECAwEAAaNkMGIwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUF BwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU2ZaAdEficKUWPFRjdsKSEX/l gbMwEgYDVR0RAQH/BAgwBoIEZXRjZDANBgkqhkiG9w0BAQsFAAOCAQEABcNvYTm8 ZJe3jUq6f872dpNVulb2UvloTpWxQ8jwXgcrhekSKU6pZ4p9IPwfauHLjceMFJLp t2eDi5fSQ1upeqXOofeyKSYjjyA/aVf1zMI8ReCCQtQuAVYyJWBlNLc3XMMecbcp JLGtd/OAZnKDeYYkUX7cJ2wN6Wl/wGLM2lxsqDhEHEZwvGL0DmsdHw7hzSjdVmxs 0Qgkh4jVbNUKdBok5U9Ivr3P1xDPaD/FqGFyM0ssVOCHxtPxhOUA/m3DSr6klfEF McOfudZE958bChOrJgVrUnY3inR0J335bGQ1luEp5tYwPgyD9dG4MQEDD3oLwp+l +NtTUqz8WVlMxQ== -----END CERTIFICATE----- Configuring mTLS between etcd and APISIX With the certificates available, we can now configure mutual TLS between etcd and APISIX. Let's start with etcd: apiVersion: v1 kind: Pod metadata: name: etcd namespace: tls labels: role: config spec: containers: - name: etcd image: bitnami/etcd:3.5.7 ports: - containerPort: 2379 env: - name: ETCD_TRUSTED_CA_FILE #1 value: /etc/ssl/private/ca.crt - name: ETCD_CERT_FILE #2 value: /etc/ssl/private/tls.crt - name: ETCD_KEY_FILE #3 value: /etc/ssl/private/tls.key - name: ETCD_ROOT_PASSWORD value: whatever - name: ETCD_CLIENT_CERT_AUTH #4 value: "true" - name: ETCD_LISTEN_CLIENT_URLS value: https://0.0.0.0:2379 volumeMounts: - name: ssl mountPath: /etc/ssl/private #5 volumes: - name: ssl secret: secretName: etcd-secret #5 Set the trusted CA Set the certificate Set the private key Require clients to pass their certificate, hence ensuring mutual authentication Mount the previously generated secret in the container for access Now, it's Apache APISIX's turn: apiVersion: v1 kind: ConfigMap #1 metadata: name: apisix-config namespace: tls data: config.yaml: >- apisix: ssl: ssl_trusted_certificate: /etc/ssl/certs/ca.crt #2 deployment: etcd: host: - https://etcd:2379 tls: cert: /etc/ssl/certs/tls.crt #2 key: /etc/ssl/certs/tls.key #2 admin: allow_admin: - 0.0.0.0/0 https_admin: true #3 admin_api_mtls: admin_ssl_cert: /etc/ssl/private/tls.crt #3 admin_ssl_cert_key: /etc/ssl/private/tls.key #3 admin_ssl_ca_cert: /etc/ssl/private/ca.crt #3 --- apiVersion: v1 kind: Pod metadata: name: apisix namespace: tls labels: role: gateway spec: containers: - name: apisix image: apache/apisix:3.2.0-debian ports: - containerPort: 9443 #4 - containerPort: 9180 #5 volumeMounts: - name: config #1 mountPath: /usr/local/apisix/conf/config.yaml subPath: config.yaml - name: ssl #6 mountPath: /etc/ssl/private - name: etcd-client #7 mountPath: /etc/ssl/certs volumes: - name: config configMap: name: apisix-config - name: ssl #6,8 secret: secretName: apisix-server-secret - name: etcd-client #7,8 secret: secretName: apisix-client-secret Apache APISIX doesn't offer configuration via environment variables. We need to use a that mirrors the regular file ConfigMap config.yaml Configure authentication for etcd client Configure authentication for the Admin API server Regular HTTPS port Admin HTTPS port Certificates for server authentication Certificates for client authentication Two sets of certificates are used, one for server authentication for the Admin API and regular HTTPS, and one for client authentication for etcd. At this point, we can apply the above manifests and see the two pods communicating. When connecting, Apache APISIX sends its certificate via HTTPS. Because an authority signs the certificate that etcd trusts, it allows the connection. apisix-client I've omitted the definition for brevity's sake, but you can check them in the associated . Service GitHub repo NAME READY STATUS RESTARTS AGE apisix 1/1 Running 0 179m etcd 1/1 Running 0 179m Client access Now that we've set up the basic infrastructure, we should test accessing it with a client. We will use our faithful , but any client that allows configuring certificates should work, , httpie. curl e.g The first step is to create a dedicated certificate-key pair for the client: apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: curl-client namespace: tls spec: secretName: curl-secret isCA: false usages: - client auth emailAddresses: - curl@localhost.dev issuerRef: name: ca-issuer kind: Issuer requires a path to the certificate file instead of the content. We can go around this limitation through the magic of zsh: the syntax allows the creation of a temporary file. If you're using another shell, you'll need to find the equivalent syntax or download the files manually. curl =( ... ) Let's query the Admin API for all existing routes. This simple command allows checking that Apache APISIX is connected to etcd, and it can read its configuration from there. curl --resolve 'admin:32180:127.0.0.1' https://admin:32180/apisix/admin/routes \ #1 --cert =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.crt }' | base64 -d) \ #2 --key =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.key }' | base64 -d) \ #2 --cacert =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.ca\.crt }' | base64 -d) \ #2 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' avoids polluting one's file. will translate to , but the query is sent to inside the Kubernetes cluster, thus using the correct --resolve /etc/hosts curl admin localhost admin Service Get the required data inside the , decode it, and use it as a temporary file Secret If everything works, and it should, the result should be the following: {"total":0,"list":[]} No routes are available so far because we have yet to create any. TLS with upstreams Last but not least, we should configure TLS for upstreams. In the following, I'll use a simple instance that responds with static content. Use it as an illustration for more complex upstreams. nginx The first step, as always, is to generate a dedicated for the upstream. I'll skip how to do it as we already created a few. I call it and its , unimaginatively, . We can now use the latter to secure nginx: Certificate upstream-server Secret upstream-secret apiVersion: v1 kind: ConfigMap #1 metadata: name: nginx-config namespace: tls data: nginx.conf: >- events { worker_connections 1024; } http { server { listen 443 ssl; server_name upstream; ssl_certificate /etc/ssl/private/tls.crt; #2 ssl_certificate_key /etc/ssl/private/tls.key; #2 root /www/data; location / { index index.json; } } } --- apiVersion: v1 kind: Pod metadata: name: upstream namespace: tls labels: role: upstream spec: containers: - name: upstream image: nginx:1.23-alpine ports: - containerPort: 443 volumeMounts: - name: config mountPath: /etc/nginx/nginx.conf #1 subPath: nginx.conf - name: content mountPath: /www/data/index.json #3 subPath: index.json - name: ssl #2 mountPath: /etc/ssl/private volumes: - name: config configMap: name: nginx-config - name: ssl #2 secret: secretName: upstream-secret - name: content #3 configMap: name: nginx-content nginx doesn't allow configuration via environment variables; we need to use the approach ConfigMap Use the key-certificate pair created via the Certificate Some static content unimportant in the scope of this post The next step is to create the route with the help of the Admin API. We prepared everything in the previous step; now we can use the API: curl --resolve 'admin:32180:127.0.0.1' https://admin:32180/apisix/admin/routes/1 \ --cert =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.crt }' | base64 -d) \ #1 --key =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.key }' | base64 -d) \ #1 --cacert =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.ca\.crt }' | base64 -d) \ #1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d "{ \"uri\": \"/\", \"upstream\": { \"scheme\": \"https\", #2 \"nodes\": { \"upstream:443\": 1 }, \"tls\": { \"client_cert\": \"$(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.crt }' | base64 -d)\", #3 \"client_key\": \"$(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.key }' | base64 -d)\" #3 } } }" Client auth for Admin API, as above Use HTTPS for the upstream Configure key-certificate pair for the route. Apache APISIX stores the data in etcd and will use them when you call the route. Alternatively, you can keep the pair as a dedicated object and use the newly-created reference (just like for upstreams). It depends on how many routes the certificate needs. For more information, check the SSL endpoint Finally, we can check it works as expected: curl --resolve 'upstream:32443:127.0.0.1' https://upstream:32443/ \ --cert =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.crt }' | base64 -d) \ --key =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.tls\.key }' | base64 -d) \ --cacert =(kubectl get secret curl-secret -n tls -o jsonpath='{ .data.ca\.crt }' | base64 -d) And it does: { "hello": "world" } Conclusion In this post, I've described a working Apache APISIX architecture and implemented mutual TLS between all the components: etcd and APISIX, client and APISIX, and finally, client and upstream. I hope it will help you to achieve the same. The complete source code for this post can be found on . GitHub Also published on on March 19th, 2023 A Java Geek