How can I set up an mTLS forward proxy to an external site in a Helm chart?

Setting up an mTLS (mutual TLS) forward proxy to an external site using a Helm chart involves several steps. Here's a comprehensive guide:

1. Choose a Proxy Solution:

- Select a proxy server that supports mTLS. Popular options include NGINX, HAProxy, and Envoy. For this example, let's consider using NGINX.

2. Prepare Certificates:

- You'll need the following certificates:

- Client Certificate and Key: Used by the proxy to authenticate with the external site.

- CA Certificate: The Certificate Authority certificate that signed the external site's certificate.

- Store these certificates as Kubernetes secrets. For example:

kubectl create secret tls client-certs --cert=client.crt --key=client.key
kubectl create secret generic ca-cert --from-file=ca.crt=ca.crt

3. Create a Helm Chart:

- Create a new Helm chart or modify an existing one. The chart should include:

- A deployment for the NGINX proxy.

- A service to expose the proxy.

- Configuration for NGINX to handle mTLS.

4. Configure NGINX in the Helm Chart:

- In your Helm chart's `values.yaml`, define the necessary configurations:

nginx:
  image: nginx:latest
  config:
    server:
      listen 80;
      location / {
        proxy_pass https://external-site.com;
        proxy_ssl_certificate /etc/nginx/certs/client.crt;
        proxy_ssl_certificate_key /etc/nginx/certs/client.key;
        proxy_ssl_trusted_certificate /etc/nginx/certs/ca.crt;
        proxy_ssl_verify on;
        proxy_ssl_protocols TLSv1.2 TLSv1.3;
      }


5. Create a ConfigMap for NGINX Configuration:

- Create a ConfigMap to store the NGINX configuration. This can be done in your Helm chart's `templates` directory.

6. Mount Secrets and ConfigMap:

- In your deployment definition, mount the secrets and ConfigMap as volumes:

volumes:
  - name: client-certs
    secret:
      secretName: client-certs
  - name: ca-cert
    secret:
      secretName: ca-cert
  - name: nginx-config
    configMap:
      name: nginx-config
volumeMounts:
  - name: client-certs
    mountPath: /etc/nginx/certs
  - name: ca-cert
    mountPath: /etc/nginx/certs
  - name: nginx-config
    mountPath: /etc/nginx/conf.d


7. Deploy the Helm Chart:

- Deploy your Helm chart using `helm install`. Ensure that the proxy is running and accessible.

8. Test the Proxy:

- Send a request through the proxy to the external site. Verify that the mTLS handshake is successful.

By following these steps, you can set up an mTLS forward proxy to an external site using a Helm chart. Remember to adjust the configurations based on your specific requirements and the proxy solution you choose.

Learn more about this