[FEATURE REQUEST] allow enabling / disabling tls ciphers per service

[mmiller1]

Is this possible currently? I don't see any mention in the docs, but we run some legacy services that have many clients requiring less secure ciphers, but we would rather not enable these for services where it's not required.

Thanks

[pieterlange]

Not technically possible (inherent to the protocol), but you can run a separate nginx ingress pool using https://github.com/kubernetes/ingress-nginx#annotation-ingressclass and expose this pool on a separate Service (type: LoadBalancer)

[aledbf]

@mmiller1 is not possible per service but yes per host (server_name in nginx)
http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
This is not supported right now but you can use the server-snippet annotation to achieve this
Like this:

ingress.kubernetes.io/server-snippet: |
  ssl_ciphers "your ciphers";

Keep in mind that this will affect all the paths in the host (possible multiple services)

[mmiller1]

Thanks @aledbf this is exactly what I needed

[pieterlange]

Sorry, I somehow misread you were trying to switch TLS protocol versions.. and i was not aware nginx was able to switch ciphers per vhost!

You risk specifying invalid (per TLS/SSL version) ciphers though (so this should probably be checked by the controller if this is implemented as annotation)