Enable Mutual TLS

Applicable to both Classic and Federated modes

To enable mutual TLS (mTLS) for Portworx Backup, ensure that you perform the following actions:

Enable mTLS using Istio

1. Install Istio on the cluster where you deploy Portworx Backup with the following parameters set to true:

   meshConfig.defaultConfig.holdApplicationUntilProxyStarts=true
   values.pilot.env.ENABLE_NATIVE_SIDECARS=true

2. Label Portworx Backup deployed namespace:

• Istio sidecar mode:

  kubectl label namespace <pxb-namespace> istio-injection=enabled --overwrite

  This command labels <pxb-namespace> to inject sidecar proxy required for mTLS.

  Here <pxb-namespace> is the namespace where you have deployed Portworx Backup.

  note

  After labeling the namespace, existing Portworx Backup pods must be restarted for Istio injection to take effect. Run the following commands to restart both the Deployments and StatefulSets so that all pods pick up the injection:

  kubectl rollout restart deployment -n <pxb-namespace>
  kubectl rollout restart statefulset -n <pxb-namespace>

  Without this restart, mTLS does not apply to already-running pods.

• Istio ambient mode:

  kubectl label namespace <pxb-namespace> istio.io/dataplane-mode=ambient --overwrite

  For OpenShift cluster only, run the following command to enable host routing:

  oc patch network.operator/cluster --type merge -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"routingViaHost":true}}}}}'

  caution

  When multiple applications are configured to use the same base path (such as /), Istio cannot determine which service should handle incoming traffic. To avoid routing conflicts during the px-backup deployment, update the hostname using the istio.hostName helm parameter. For more information, see Configure a dedicated hostname for Portworx Backup UI with Istio section. You can perform these steps either before or after the installation of Portworx Backup, depending on your setup. This configuration is applicable for Istio sidecar mode only.

3. Enforce strict mTLS for the Portworx Backup namespace. Labeling or enrolling the namespace enables the mesh, but by default Istio uses PERMISSIVE mode, which still accepts plaintext traffic. To require mTLS, apply a PeerAuthentication policy in STRICT mode:

   apiVersion: security.istio.io/v1
   kind: PeerAuthentication
   metadata:
     name: default
     namespace: <pxb-namespace>
   spec:
     mtls:
       mode: STRICT

4. Verify that authenticated encryption is active before you proceed:

   # In sidecar mode, every Portworx Backup pod should show 2/2 (app + istio-proxy) in the READY column
   kubectl get pods -n <pxb-namespace>
   
   # With istioctl installed, confirm mTLS is enforced for a workload
   istioctl x describe pod <pxb-pod-name> -n <pxb-namespace>

   The STRICT PeerAuthentication policy, combined with injected proxies (a 2/2 ready count in sidecar mode) and an istioctl report showing mTLS enforced, confirms that traffic is encrypted and authenticated. Do not continue until mTLS is verified.

Enable mTLS using Linkerd

note

Linkerd is not supported on OpenShift (OCP). Use Istio for mTLS on OpenShift clusters.

To enable mTLS for Portworx Backup when using the Linkerd service mesh, perform the following steps:

1. Install linkerd with the following parameter set to true:

   proxyInit.runAsRoot=true

2. Annotate Portworx Backup deployed namespace to inform Linkerd to inject linkerd-proxy required for mTLS:

   kubectl annotate ns <pxb-namespace> linkerd.io/inject=enabled

3. Annotate the namespace for Kubernetes native sidecar support so that Linkerd sidecar proxy container can run and shut down gracefully without causing any issues:

   kubectl annotate ns <pxb-namespace> config.alpha.linkerd.io/proxy-enable-native-sidecar=true