kubernetes - Consul Terminating Gateway - caFile

Question

I'm using Consul in a Kuberntes cluster on AWS and am trying to migrate my terminating gateway to a AWS RDS instance to use a TLS verification on the upstream service.

For Non TLS verified config I have the following which works great

---
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
  name: terminating-gateway
spec:
  services:
    - name: mydb
---
apiVersion: v1
kind: Pod
metadata:
  name: testdb
  labels:
    role: test
    app: testdb
  annotations:
    "consul.hashicorp.com/connect-inject": "true"
    "consul.hashicorp.com/connect-service-upstreams": "mydb:1234"
spec:
  containers:
    - name: testdb
      image: jbergknoff/postgresql-client
....
  restartPolicy: Never

However, if I change to

apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
  name: terminating-gateway
spec:
  services:
    - name: mydb
      caFile: /etc/ssl/rds.pem

I get a generic connection error while trying to connect to the database. Is there something else I need to do to enable TLS verification between consul and the external RDS service?

P.S. I downloaded RDS combined CA file and put a copy on each node in the cluster in at the following path /etc/ssl/rds.pem

question from:https://stackoverflow.com/questions/65908904/consul-terminating-gateway-cafile

Answer 1

Waitting for answers