I am currently working on the topic AKS behind a WAF. We already have an AKS running. The requests are already secured by the WAF. Now I would like to encrypt the connection from WAF to AKS and the services in AKS via TLS. How can I achieve this?
When you want to intercept connection from Azure Application Gateway to the underlying AKS services it might be possible to achieve using Ingress Controller, therefore it will be working as Ingress service by exposing Kubernetes services. Generally, Ingress controller runs as a pod within the AKS cluster and distributes network traffic to Kubernetes Pods.
There are a few most known Ingress controllers:
NGINX Ingress Controller , as @Charles Xu - MSFT mentioned in the comments. Provides a flexible methods for the configuration via annotations,
ConfigMapsand Custom templates. Supports TLS termination with your own managed TLS certificates or third party issuers like Let's Encrypt.
Traefik can be used as an Ingress controller for a Kubernetes cluster, therefore can be implemented on AKS; you can look at this guide and use it as the tutorial for installation. Traefik designed with a similar approach for managing configuration as NGINX Ingress Controller, also supports TLS termination.
Istio represents itself as a product for traffic management, load balancing, service-to-service authentication, monitoring, etc.; brings most of the advantages for services residing on Cloud platforms. Istio has a concepts of Service mesh to describe microservices network and connections between different services inside. Despite the basic Ingress Controller resource, Istio offers its own component Istio Gateway for the network traffic and routing purposes. Istio supports TLS termination as well as mutual TLS authentication between sidecars.