Contact Us 1-800-596-4880
  1. Homepage
  2. Omni Gateway (1.14)
  3. Configuring Omni Gateway
  4. Configuring Managed Omni Gateway

  5. Configuring Inbound TLS for Managed Omni Gateway

Configuring Inbound TLS for Managed Omni Gateway

How you configure inbound TLS for Managed Omni Gateway depends on where you deploy the gateway:

Configure Inbound TLS on CloudHub 2.0

For Managed Omni Gateway deployed on CloudHub 2.0, the CloudHub 2.0 space manages the inbound TLS.

To configure a TLS context for the private space you’re deploying your Managed Omni Gateway to, see Configuring Domains and Certificates (TLS Context) for a Private Space. You can’t edit the TLS context for a shared space.

Configuring a TLS context for your private space means all APIs deployed to Managed Omni Gateways in the private space are HTTPS and secure.

Configure Inbound TLS on Runtime Fabric on OpenShift

For Managed Omni Gateway deployed on Runtime Fabric on OpenShift, terminate external TLS at an OpenShift route and re-encrypt traffic to the gateway. This configuration uses two TLS connections:

  1. The external client connects to the OpenShift route, which presents the cluster wildcard certificate.

  2. The OpenShift route connects to Managed Omni Gateway, which presents its internal certificate. The route validates this certificate by using the destination CA certificate.

You must configure both of these resources together:

  • An HTTPRouteTemplate resource with reencrypt TLS termination, which configures the OpenShift route.

  • A PolicyBinding resource for the tls-inbound policy, which configures HTTPS on the APIs.

If you configure only the route template, the route can’t connect to the APIs over HTTPS. If you configure only the policy binding, external clients don’t connect to the gateway through the route with the cluster wildcard certificate.

Don’t create the OpenShift Route resource directly. Instead, create an HTTPRouteTemplate resource. The Runtime Fabric agent renders the template into the Route resource and keeps it reconciled.

Before You Begin

Before configuring inbound TLS for Managed Omni Gateway on Runtime Fabric, make sure that you have:

  • A Managed Omni Gateway deployed to Runtime Fabric. See Deploy a Managed Omni Gateway.

  • The cluster wildcard certificate and private key, in PEM format.

  • The CA certificate that signs the internal certificate of Managed Omni Gateway, in PEM format.

Create the Route Template

  1. Create a YAML file with an HTTPRouteTemplate resource:

    apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: omni-ingress-reencrypt
  namespace: rtf
spec:
  baseEndpoints:
    - https://<public-hostname>/
  resources: |
    apiVersion: route.openshift.io/v1
    kind: Route
    metadata:
      name: {{ .ResourceName }}
      namespace: {{ .Namespace }}
    spec:
      host: {{ .Host }}
      path: {{ .Path }}
      to:
        kind: Service
        name: {{ .Service.Name }}
  tls:
    termination: reencrypt
    key: <cluster-wildcard-key-PEM>
    certificate: <cluster-wildcard-cert-PEM>
    caCertificate: <issuing-CA-chain-PEM>
    destinationCACertificate: <omni-gateway-CA-PEM>

    Set the tls parameters as described in TLS Parameters.

  2. Apply the resource:

    oc apply -f <file-name>.yaml

Configure HTTPS on the APIs

The reencrypt route connects to the gateway over HTTPS, so the APIs on Managed Omni Gateway must also serve HTTPS. To configure HTTPS on the APIs, bind the tls-inbound policy to them. You must apply this binding in addition to the HTTPRouteTemplate resource that you create in Create the Route Template.

  1. Create a YAML file with a PolicyBinding resource.

    To apply HTTPS to all APIs on the gateway, use a Selector target with no labels:

    apiVersion: gateway.mulesoft.com/v1alpha1
kind: PolicyBinding
metadata:
  name: tls-inbound-all-apis
  namespace: <omni-gateway-namespace>
  labels:
    rtf.mulesoft.com/target-id: <omni-gateway-id>
spec:
  targetRef:
    kind: Selector
    selector:
      kind: ApiInstance
  policyRef:
    name: tls-inbound
  config:
    # TLS inbound parameters

    Replace <omni-gateway-namespace> with the namespace of the Managed Omni Gateway and <omni-gateway-id> with the gateway ID from Runtime Manager.

    For the parameters that you can set in config, see Transport Layer Security Policy - Inbound.

  2. Apply the resource:

    oc apply -f <file-name>.yaml

Verify the Inbound TLS Configuration

After you apply both resources, run the following command from outside the cluster:

curl -v https://<public-hostname>

The TLS handshake completes and the response presents the cluster wildcard certificate, not the internal *.svc.cluster.local certificate of the gateway.

TLS Parameters

In the HTTPRouteTemplate resource that you create in Create the Route Template, set tls using these parameters:

Parameter Required or Optional Description

termination

Required

Set to reencrypt.

key

Required

Private key of the cluster wildcard certificate.

certificate

Required

Cluster wildcard certificate that the route presents to external clients.

caCertificate

Optional

CA chain that issued the cluster wildcard certificate.

destinationCACertificate

Required

CA certificate that signs the internal certificate of Managed Omni Gateway. The route uses this CA to validate the gateway.

See Also