=============
Nginx Sidecar
=============

Blueprint: https://blueprints.launchpad.net/openstack-helm/+spec/nginx-sidecar

Problem Description
===================

In a secured deployment, TLS certificates are used to protect the transports
amongst the various components.  In some cases, this requires additional
mechanism to handle TLS offloading and to terminate the connection gracefully:

* services do not handle TLS offloading and termination,
* services whose native handling of TLS offloading and termination cause major
  performance impact, for example, eventlet.

Proposed Change
===============

This specification proposes to add a nginx sidecar container to the
pod for service that requires the tls offloading. The nginx can be used
to handle the TLS offoading and terminate the TLS connection, and routes
the traffic to the service via localhost (127.0.0.1).

Security Impact
---------------

This enhances the system's security design by allowing pods with services that
cannot natively manage TLS to secure the traffic to the service pod.

Performance Impact
------------------

There is no significant performance impact as the traffic will be locally
routed (via 127.0.0.1) and may potentially improve performance for services
whose native TLS handling is inefficient.

Alternatives
------------

* Instead of using nginx, haproxy can be used instead.

Implementation
==============

Assignee(s)
-----------

Primary assignee:
  Pete Birley <pete@port.direct>

Work Items
----------

* Update ``helm toolkit`` to provide snippet to create the nginx sidecar
  container for the services that require it.
* Update service charts to use the updated ``helm toolkit``.
* Update relevant Documentation.

Testing
=======

The testing will be performed by the OpenStack-Helm gate to demonstrate
the sidecar container correctly routes traffic to the correct services.

Documentation Impact
====================

OpenStack-Helm documentation will be updated to indicate the usage of the
nginx sidecar.