Securing cluster access with mTLS client certificates

Distributed
,
1

Hello,

I have setup dask-kubernetes operator on k8s, and everything is working fine, but I have some problems exposing the scheduler outside of k8s to our company VPN.

The scheduler uses raw TCP, so I can simply expose the port through a k8s LoadBalancer or Traefik proxy. But then it is open to the whole network.

I would like to configure the scheduler to only accept clients signed by a certain CA, and keep all other (scheduler ↔ worker) traffic be unencrypted. Is something like this possible with the current cluster configuration options?

Thank you

2

Hi,

I’ll let @jacobtomlinson answer to this, but I’m under the impression that it is more a Kubernetes configuration than anything else. I don’t think you can do it by configuring dask-kubernetes.

3

This isn’t really related to dask-kubernetes. In distributed we support encrypting connections with mTLS regardless of how you deploy it, however I think it is all-or-nothing so if you enable it then then worker<>scheduler communication will be encrypted too.