HPCC-27274 Document Remote DFS Client Certificates#20956
HPCC-27274 Document Remote DFS Client Certificates#20956g-pan wants to merge 2 commits intohpcc-systems:candidate-10.2.xfrom
Conversation
|
NB: generated a .md file as well, suitable for DevDocs if desired. |
JamesDeFabia
left a comment
JamesDeFabia
left a comment
There was a problem hiding this comment.
A couple of comments inline
|
|
||
| <sect2 id="DFSClientCerts-Overview"> | ||
| <title>Overview</title> | ||
| <para>By default, dafilesrv pods in HPCC containerized deployments use internal certificates for pod-to-pod encryption. To allow secure access from external clients (e.g., remote ECL IDE, dfuplus, or custom tools), you must configure dafilesrv to require and validate client certificates signed by a trusted CA.</para> |
|
|
||
| <sect2 id="DFSClientCerts-Overview"> | ||
| <title>Overview</title> | ||
| <para>By default, dafilesrv pods in HPCC containerized deployments use internal certificates for pod-to-pod encryption. To allow secure access from external clients (e.g., remote ECL IDE, dfuplus, or custom tools), you must configure dafilesrv to require and validate client certificates signed by a trusted CA.</para> |
There was a problem hiding this comment.
Certificate Authority (CA)
|
Jira Issue: https://hpccsystems.atlassian.net//browse/HPCC-27274 Jirabot Action Result: |
Signed-off-by: Panagiotatos <greg.panagiotatos+copilot@lexisnexisrisk.com>
|
|
||
| <sect2 id="DFSClientCerts-ClientConfig"> | ||
| <title>Step 4: Configure External Clients</title> | ||
| <para>Configure your external client (e.g., dfuplus, ECL IDE, or custom application) to use the client certificate and key, and to trust the CA certificate. For example, with <emphasis>dfuplus</emphasis>:</para> |
There was a problem hiding this comment.
For consistency, capitalize DFUPlus like line 866
jakesmith
left a comment
jakesmith
left a comment
There was a problem hiding this comment.
@g-pan - see a few comments, but I for one am confused by these steps and what it's trying to document.
The process of setting up certificate issues in a k8s setup at least, does not involve manually defining manifest like this, it is handed by the cert-manager.
This README is relevant: https://github.com/hpcc-systems/HPCC-Platform/blob/master/helm/examples/certmanager/README.md
This document is under ContainerizedHPCC.. but what are the goals?
There is typically no need to access the DFS service directly unless it is inconnectnig with another environment .. (but docs mention dfuplus, ECL IDE .. I'm not sure of their relevance).
If inter environment DFS connectivity, is it k8s to k8s, bm->k8s, k8s->bm, all of the those.
There are different steps involved.
This is relevant for DFS from BM: https://hpccsystems.atlassian.net/browse/HPCC-30412 (and associated step-by-step notes in https://hpccsystems.atlassian.net/browse/HPCC-27688)
|
|
||
| <sect2 id="DFSClientCerts-Overview"> | ||
| <title>Overview</title> | ||
| <para>By default, dafilesrv pods in HPCC containerized deployments use internal certificates for pod-to-pod encryption. To allow secure access from external clients (e.g., remote ECL IDE, DFUPlus, or custom tools), you must configure dafilesrv to require and validate client certificates signed by a trusted Certificate Authority (CA).</para> |
There was a problem hiding this comment.
this feels confusing .. why does ECL IDE or DFUPLus .. need direct physical access to dafilesrv's (direct-access version in cloud deployment) ?
|
|
||
| <sect1 id="DFSClientCerts" role="nobrk"> | ||
| <title>Configuring DFS Client Certificates for Secure External Access</title> | ||
| <para>This section describes how to configure HPCC Systems<superscript>®</superscript> to require and validate client certificates for external DFS (dafilesrv) access, using Kubernetes, cert-manager, and mTLS.</para> |
There was a problem hiding this comment.
for external DFS (dafilesrv) access
that's misleading.. DFS isn't just dafilesrv .. DFS is logical file access. The physical data may be accessed via mounts and storge accounts (it is typically in cloud envs)..
|
|
||
| <sect2 id="DFSClientCerts-GenerateCA"> | ||
| <title>Step 1: Create a Certificate Authority (CA)</title> | ||
| <para>Use <emphasis role="strong">cert-manager</emphasis> to create a CA in your Kubernetes cluster. For example:</para> |
There was a problem hiding this comment.
this process is not familiar to me...
I think part of the confusion (mine too) is .. is this trying to document the setup for Bare Metal, for a k8s setup, for both at same time?
Signed-off-by: Panagiotatos <greg.panagiotatos+copilot@lexisnexisrisk.com>
Type of change:
Checklist:
Smoketest:
Testing:
Successful Unit Testing: https://github.com/g-pan/github-action-dev-build/actions/runs/21866214565