Amazon EKS clusters gain TLS encryption with ACM Private CA

Amazon Web Services (AWS) has introduced enhanced security features for its Amazon Elastic Kubernetes Service (EKS), allowing for the implementation of TLS encryption. This update enables end-to-end encryption for traffic originating from a client and terminating at an Ingress controller server within an EKS cluster.

The solution leverages an open-source plugin for cert-manager that integrates with AWS Private CA. This provides a more secure alternative for certificate authority management in Kubernetes environments compared to cert-manager's default method, which stores private keys in plaintext in server memory. This approach aids customers with regulatory requirements for auditing CA operations and controlling access.

The implementation details show the configuration of an NGINX Ingress controller on Amazon EKS. An AWS Network Load Balancer (NLB) is configured in front of the controller to handle HTTPS traffic, with certificates issued by ACM Private CA.

Amazon EKS is a managed service designed to simplify the deployment and operation of Kubernetes on AWS without the need for users to manage the Kubernetes control plane. Cert-manager is a widely adopted open-source tool for managing TLS certificates within Kubernetes clusters.