Merge pull request #43 from barkhachoithani/feature/CLD-278

CLD-278: Enable Intra-Cluster Network Traffic Encryption (XDQP)

Author: barkhachoithani

README.md

@@ -272,6 +272,14 @@ kubectl logs pod/terminated-host-pod-name
 ```
 
 If you are permanently removing the host from the MarkLogic cluster, once the pod is terminated, follow standard MarkLogic administrative procedures using the administrative UI or APIs to remove the MarkLogic host from the cluster. Also, because Kubernetes keeps the Persistent Volume Claims and Persistent Volumes around until they are explicitly deleted, you must manually delete them using the Kubernetes APIs before attempting to scale the hosts in the StatefulSet back up again.
+
+### Enabling SSL over XDQP
+
+To enable SSL over XDQP, set the `enableXdqpSsl` to true either in the values.yaml file or using the `--set` flag. All communications to and from hosts in the cluster will be secured. When this setting is on, default SSL certificates will be used for XDQP encryption.
+
+Note: To enable other XDQP/SSL settings like `xdqp ssl allow sslv3`, `xdqp ssl allow tls`, `xdqp ssl ciphers`, use MarkLogic REST Management API. See the MarkLogic documentation [here](https://docs.marklogic.com/REST/management).
+
+
 # Access the MarkLogic Server
 
 ## Service
@@ -385,7 +393,10 @@ This table describes the list of available parameters for Helm Chart.
 | `nameOverride`                       | String to override the app name                                                                                | `""`                                 |
 | `fullnameOverride`                   | String to completely replace the generated name                                                                | `""`                                 |
 | `auth.adminUsername`                 | Username for default MarkLogic Administrator                                                                   | `admin`                              |
-| `auth.adminPassword`                 | Password for default MarkLogic Administrator                                                                   | `admin`                              |
+| `auth.adminPassword`                 | Password for default MarkLogic Administrator                                                                   | `admin`     
+| `bootstrapHostName`                 | Host name of MarkLogic bootstrap host                                                                | `""`   
+| `group.name`               | group name for joining MarkLogic cluster                                                                    | `Default`                              |
+| `group.enableXdqpSsl`                 | SSL encryption for XDQP                                                                   | `true`                         |
 | `affinity`                           | Affinity property for pod assignment                                                                           | `{}`                                 |
 | `nodeSelector`                       | nodeSelector property for pod assignment                                                                       | `{}`                                 |
 | `persistence.enabled`                | Enable MarkLogic data persistence using Persistence Volume Claim (PVC). If set to false, EmptyDir will be used | `true`                               |

charts/templates/configmap.yaml

@@ -14,6 +14,8 @@ data:
   MARKLOGIC_FQDN_SUFFIX: {{ include "marklogic.headlessURL" . }}
   MARKLOGIC_INIT: "true"
   MARKLOGIC_JOIN_CLUSTER: "true"
+  MARKLOGIC_GROUP: {{ .Values.group.name }}
+  XDQP_SSL_ENABLED: {{ quote .Values.group.enableXdqpSsl }}
 ---
 {{- if .Values.logCollection.enabled }}
 apiVersion: v1

charts/templates/statefulset.yaml

@@ -43,8 +43,8 @@ spec:
               log "Error: [initContainer] Bootstrap host $MARKLOGIC_BOOTSTRAP_HOST not found, exiting Init container."
               exit 1
             fi
-            GROUP_CFG_TEMPLATE='{"group-name":"%s"}'
-            GROUP_CFG=$(printf "$GROUP_CFG_TEMPLATE" "$MARKLOGIC_GROUP")
+            GROUP_CFG_TEMPLATE='{"group-name":"%s", "xdqp-ssl-enabled":"%s"}'
+            GROUP_CFG=$(printf "$GROUP_CFG_TEMPLATE" "$MARKLOGIC_GROUP" "$XDQP_SSL_ENABLED") 
             GROUP_RESP_CODE=`curl --anyauth -m 20 -s -o /dev/null -w "%{http_code}" -X GET http://${MARKLOGIC_BOOTSTRAP_HOST}:8002/manage/v2/groups/${MARKLOGIC_GROUP} --anyauth --user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD}`
             if [[ ${GROUP_RESP_CODE} -eq 200 ]]; then
               log "Info: [initContainer] Skipping creation of group $MARKLOGIC_GROUP as it already exists on the MarkLogic cluster." 
@@ -64,8 +64,6 @@ spec:
               [ $i -eq 5 ] && exit 1
             done
         env: 
-        - name: MARKLOGIC_GROUP
-          value: {{ .Values.group.name }}
         - name: MARKLOGIC_ADMIN_USERNAME
           valueFrom:
             secretKeyRef:
@@ -105,8 +103,6 @@ spec:
                   secretKeyRef:
                     name: {{ include "marklogic.fullname" . }}
                     key: password
-            - name: MARKLOGIC_GROUP
-              value: {{ .Values.group.name }}
             - name: POD_NAME
               valueFrom:
                 fieldRef:
@@ -152,8 +148,8 @@ spec:
                         sleep 5s
                       done
                       
-                      GROUP_CFG_TEMPLATE='{"group-name":"%s"}'
-                      GROUP_CFG=$(printf "$GROUP_CFG_TEMPLATE" "$MARKLOGIC_GROUP")
+                      GROUP_CFG_TEMPLATE='{"group-name":"%s", "xdqp-ssl-enabled":"%s"}'
+                      GROUP_CFG=$(printf "$GROUP_CFG_TEMPLATE" "$MARKLOGIC_GROUP" "$XDQP_SSL_ENABLED") 
                       
                       log "Info: [poststart] Updating Default group on cluster"
                       curl --anyauth -m 20 -s -X PUT -H "Content-type: application/json" -d "${GROUP_CFG}" http://${MARKLOGIC_BOOTSTRAP_HOST}:8002/manage/v2/groups/Default/properties --user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD}

charts/values.yaml

@@ -10,11 +10,12 @@ terminationGracePeriod: 120
 group:
   # the group name of the current Marklogic Helm Deployment
   name: Default
+  # xdqp encryption for intra cluster network traffic
+  enableXdqpSsl: true
 
 # The name of the host to join. If not provided, the deployment is a bootstrap host.
 bootstrapHostName: ""
 
-
 # Marklogic image parameters
 image:
   repository: marklogicdb/marklogic-db