Support serve HTTPS without external SSL termination

treeverse / lakeFS

lakeFS - Data version control for your data lake | Git for data

https://docs.lakefs.io

Apache License 2.0

4.48k stars 359 forks source link

Support serve HTTPS without external SSL termination #5321

Closed nopcoder closed 1 year ago

nopcoder commented 1 year ago

Enabling TLS support for lakeFS

arielshaqed commented 1 year ago

I do not believe that lakeFS should support TLS termination. It is creeping featurism, and it will not lead to increased security.

What is the use-case for this? It must be...

A single lakeFS server -- otherwise admins should put the cert on the load balancer; AND
Open to the Internet -- otherwise admins should use VPCs / VLANs / whatever is available on their cloud;
A well-secured lakeFS server machine.

Is this is worth the added complexity and support?

nopcoder commented 1 year ago

https://lakefs.slack.com/archives/C016726JLJW/p1677102782579979
secure communication using local certificate - as the same case for not having to setup nginx for small environment or local development.
using secure cookies our of the box
agree that for any cloud production environment I will opt for SSL termination by the load-balancer and not by the service itself.

nopcoder commented 1 year ago

@arielshaqed I think have the code support such option has low complexity and have more benefits than having to setup another component to enable secure communication.

nopcoder commented 1 year ago

@arielshaqed agree that this feature will probably be used for local development or very small setup. But it will help any local development that require secure communication over running another service to handle the ssl termination.

arielshaqed commented 1 year ago

We cannot progress on this discussion. I'm in the minority here so I will remove my objections. Let's just document it clearly, preferably with a howto?

THANKS!