TLS Termination: Load Balancer vs Sidecar vs In-App
Three patterns we evaluated for mTLS between services — latency, ops burden, and cert rotation.
Internal service mesh was overkill. We still needed TLS between gateway and upstream services.
Options
| Pattern | Termination | Cert rotation | Added latency |
|---|---|---|---|
| LB (ALB/NLB) | Edge only | ACM auto | ~0.5ms |
| Sidecar (nginx) | Per pod | Manual / cert-manager | ~1ms |
| In-app (Kestrel) | App process | cert-manager secret mount | ~0.3ms |
Decision
- Public traffic: ALB termination, ACM certs
- Gateway → internal APIs: cert-manager + nginx sidecar on upstream pods
- East-west later: deferred mesh until service count exceeds 20
Cert rotation runbook: cert-manager Certificate CR with 30-day renew window, alert 7 days before expiry.
tls , mTLS , architecture · Kubernetes , Nginx