TLS configuration for Kubernetes

This page describes how to configure Transport Layer Security (TLS) for ADS deployments on Kubernetes (K8s). For non-Kubernetes environments, see Configure TLS. TLS protects communication between ADS and the remote domain endpoint, as well as outbound connections to other services.

Overview

ADS on Kubernetes supports two TLS modes for domain connections:

Mode	Description
One-way TLS	ADS validates the server's certificate. The server does not authenticate the client.
Mutual TLS (mTLS)	Both ADS and the server authenticate each other using certificates.

In addition to domain-connection TLS, you can configure a JVM-level truststore that applies to all outbound connections from ADS, not just the domain connection.

Choose the approach that matches your security requirements:

• Use one-way TLS when you only need ADS to verify the identity of the remote endpoint.
• Use mutual TLS when the remote endpoint also needs to verify the identity of ADS.
• Use the JVM truststore approach when ADS needs to trust certificates from a private or internal Certificate Authority (CA) that is not included in the default JVM truststore, across all outbound connections.

Configure one-way TLS (server certificate)

In one-way TLS, ADS validates the server's certificate. Use this approach when the remote domain endpoint uses TLS and you want ADS to verify the server's identity.

If the remote domain endpoint uses TLS, copy your truststore.jks file into kubernetes/charts before running helm install.

Add the following flags to your helm install command:

-f ads/values-fetch-domain-from-adm-tls.yaml \
--set truststoreValue=$(cat truststore.jks | base64 -w 0) \
--set secret.truststorePassword=<your_truststore_password>

Configure mutual TLS (mTLS)

In mutual TLS, both ADS and the server authenticate each other. Use this approach when the remote endpoint requires client certificate authentication.

Add the following flags to your helm install command:

-f ads/values-fetch-domain-from-adm-tls.yaml \
-f ads/values-fetch-domain-from-adm-two-way-tls.yaml \
--set truststoreValue=$(cat truststore.jks | base64 -w 0) \
--set keystoreValue=$(cat keystore.jks | base64 -w 0) \
--set secret.truststorePassword=<your_truststore_password> \
--set secret.keystorePassword=<your_keystore_password>

note

When you combine token-based authentication with mutual TLS, also add -f ads/values-fetch-domain-from-adm-token-auth-tls.yaml and include the truststoreTokenValue, keystoreTokenValue, secret.truststoreTokenPassword, and secret.keystoreTokenPassword flags. See Configure TLS for full details.

JVM truststore

Use this approach to supply a custom truststore directly to the JVM using Kubernetes Secrets and environment variables. Unlike the one-way and mutual TLS options above (which configure a truststore for the domain connection only), this approach sets the truststore at the JVM level and applies to all outbound connections from ADS.

This is useful when ADS needs to trust certificates from a private or internal CA that the default JVM truststore does not include.

1. Create a Kubernetes Secret with your truststore:

   kubectl create secret generic ads-jvm-truststore-secret \
     --from-file=jvm-truststore.jks=/path/to/your/truststore.jks \
     --from-literal=truststore-password=<your_truststore_password>

2. Create values-jvm-tls.yaml with the following content:

   volumes:
     JVM_TRUSTSTORE_VOLUME:
       - name: ads-jvm-truststore-volume
         secret:
           secretName: ads-jvm-truststore-secret
   
   volumeMounts:
     JVM_TRUSTSTORE_VOLUME:
       - name: ads-jvm-truststore-volume
         mountPath: /jvm-truststore.jks
         subPath: jvm-truststore.jks
         readOnly: true
   
   env:
     JAVAX_NET_SSL_TRUSTSTORE_PASSWORD:
       - name: JAVAX_NET_SSL_TRUSTSTORE_PASSWORD
         valueFrom:
           secretKeyRef:
             name: ads-jvm-truststore-secret
             key: truststore-password
     JAVA_TOOL_OPTIONS:
       - name: JAVA_TOOL_OPTIONS
         value: "-Djavax.net.ssl.trustStore=/jvm-truststore.jks -Djavax.net.ssl.trustStorePassword=$(JAVAX_NET_SSL_TRUSTSTORE_PASSWORD)"

3. Add the following flag to your helm install command:

   -f ads/values-jvm-tls.yaml

Configure TLS for ADS endpoints

To enable TLS on the ADS server endpoints (for example, to serve ADS over HTTPS), see Configure TLS. That configuration applies to all deployment methods and is not specific to Kubernetes.

See also

• Deploy on Kubernetes