I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their
Ingress controller. The certificates are
GoogleManagedCertificates. I'm fine with traffic past the load balancer and traffic within the cluster.
But what about traffic from the load balancer to the GKE
NodePort? Although this traffic is within the Google network, this is technically public traffic. And it's currently unencrypted. While trying to add a (valid) certificate for the service behind the load balancer, it blurred the responsibilities between the load balancer and service. To be fair, there is a firewall rule to permit communication between these 2.
What are best practices here?
- Leave things as is?
- Set up another round of TLS termination for every exposed k8s service?
- Is there a simple way to get the google managed load balancer to communicate via private IP?
Here's a diagram: