Enabling SSL

In this recipe, you will learn how to enable SSL for Marathon to protect eavesdropping on Marathon communication.

Getting ready

First, we need to create a place for our Java keystore:

mkdir -p /etc/marathon/ssl
cd /etc/marathon/ssl

Then, put the keystore password into the environment variable. We will need it later:

export MARATHON_SSL_KEYSTORE_PASSWORD=jks_pass

Generate the keystore. In this example, we will use self-signed certificates but if you can issue an organization-wide trusted certificate, it would be better to use that. With self- signed certificates, most browsers will mark the Marathon UI and API as dangerous and there is a chance that somebody will create a man-in-the-middle attack:

keytool -keystore marathon.jks -deststorepass $MARATHON_SSL_KEYSTORE_PASSWORD -alias marathon -genkey -keyalg RSA

How to do it...

Finally, save the Marathon keystore configuration:

cat << EOF > /etc/default/marathon
MARATHON_SSL_KEYSTORE_PATH=/etc/marathon/ssl/marathon.jks
MARATHON_SSL_KEYSTORE_PASSWORD...