github.com/nginxinc/kubernetes-ingress@v1.12.5/examples-of-custom-resources/egress-mtls/README.md (about)

     1  # Egress MTLS
     2  
     3  In this example, we deploy a secure web application, configure load balancing for it via a VirtualServer, and apply an Egress MTLS policy.
     4  
     5  ## Prerequisites
     6  
     7  1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/) instructions to deploy the Ingress Controller.
     8  1. Save the public IP address of the Ingress Controller into a shell variable:
     9      ```
    10      $ IC_IP=XXX.YYY.ZZZ.III
    11      ```
    12  1. Save the HTTP port of the Ingress Controller into a shell variable:
    13      ```
    14      $ IC_HTTP_PORT=<port number>
    15      ```
    16  
    17  ## Step 1 - Deploy a Secure Web Application
    18  The application requires clients to use TLS and present a client TLS certificate which it will verify.
    19  
    20  Create the application deployment, service and secret:
    21  ```
    22  $ kubectl apply -f secure-app.yaml
    23  ```
    24  
    25  ## Step 2 - Deploy the Egress MLTS Secret
    26  
    27  Create a secret with the name `egress-mtls-secret` that will be used for authentication to application:
    28  ```
    29  $ kubectl apply -f egress-mtls-secret.yaml
    30  ```
    31  
    32  ## Step 3 - Deploy the Trusted CA Secret
    33  
    34  Create a secret with the name `egress-trusted-ca-secret` that will be used to verify the certificate of the application:
    35  ```
    36  $ kubectl apply -f egress-trusted-ca-secret.yaml
    37  ```
    38  
    39  ## Step 4 - Deploy the Egress MTLS Policy
    40  
    41  Create a policy with the name `egress-mtls-policy` that references the secrets from the previous steps:
    42  ```
    43  $ kubectl apply -f egress-mtls.yaml
    44  ```
    45  
    46  ## Step 5 - Configure Load Balancing
    47  
    48  Create a VirtualServer resource for the web application:
    49  ```
    50  $ kubectl apply -f virtual-server.yaml
    51  ```
    52  
    53  Note that the VirtualServer references the policy `egress-mtls-policy` created in Step 4.
    54  
    55  ## Step 6 - Test the Configuration
    56  
    57  Access the secure backend with the following command:
    58  ```
    59  $ curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT/
    60  hello from pod secure-app-8cb576989-7hdhp
    61  ```