Skip to content

Commit ead2b4c

Browse files
yruchinyruchin
authored
Merge pull request #138 from synthesized-io/internal-tls-improvements
Internal TLS improvements
2 parents 2fc25dd + c086ce6 commit ead2b4c

File tree

3 files changed

+83
-12
lines changed

3 files changed

+83
-12
lines changed

‎charts/governor/templates/_helpers.tpl‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{{/*
22
Envoy sidecar container template
3-
Usage: {{ include "governor.tlsInternal.sidecar" (dict "componentName" "api" "config" .Values.api "tlsInternal" .Values.envoy "hasHttpPort" true "hasGrpcPort" true) }}
3+
Usage: {{ include "governor.tlsInternal.sidecar" (dict "componentName" "api" "config" .Values.api "tlsInternal" .Values.tlsInternal "hasHttpPort" true "hasGrpcPort" true) }}
44
*/}}
55
{{- define "governor.tlsInternal.sidecar" -}}
66
- name: envoy-sidecar
@@ -46,6 +46,9 @@ Usage: {{ include "governor.tlsInternal.sidecar" (dict "componentName" "api" "co
4646
- name: tls-certs
4747
mountPath: /etc/envoy/certs
4848
readOnly: true
49+
- name: ca-cert
50+
mountPath: /etc/envoy/ca
51+
readOnly: true
4952
{{- end }}
5053

5154
{{/*
@@ -54,13 +57,17 @@ Usage: {{ include "governor.tlsInternal.initContainer" . }}
5457
*/}}
5558
{{- define "governor.tlsInternal.initContainer" -}}
5659
- name: wait-for-certs
57-
image: busybox:1.36
60+
{{/*
61+
We use the same image as the main sidecar, because convenience images such as 'busybox' might
62+
not be readily available in the target environment.
63+
*/}}
64+
image: "{{ .Values.tlsInternal.image.repository }}:{{ .Values.tlsInternal.image.tag }}"
5865
command:
5966
- /bin/sh
6067
- -c
6168
- |
6269
echo "Waiting for TLS certificates..."
63-
while [ ! -f /etc/envoy/certs/tls.crt ] || [ ! -f /etc/envoy/certs/tls.key ]; do
70+
while [ ! -f /etc/envoy/certs/tls.crt ] || [ ! -f /etc/envoy/certs/tls.key ] || [ ! -f /etc/envoy/ca/ca.crt ]; do
6471
echo "Certificates not ready, waiting..."
6572
sleep 2
6673
done
@@ -69,11 +76,14 @@ Usage: {{ include "governor.tlsInternal.initContainer" . }}
6976
- name: tls-certs
7077
mountPath: /etc/envoy/certs
7178
readOnly: true
79+
- name: ca-cert
80+
mountPath: /etc/envoy/ca
81+
readOnly: true
7282
{{- end }}
7383

7484
{{/*
7585
Envoy volumes template
76-
Usage: {{ include "governor.tlsInternal.volumes" (dict "componentName" "api" "config" .Values.api "tlsInternal" .Values.envoy) }}
86+
Usage: {{ include "governor.tlsInternal.volumes" (dict "componentName" "api" "config" .Values.api "tlsInternal" .Values.tlsInternal) }}
7787
*/}}
7888
{{- define "governor.tlsInternal.volumes" -}}
7989
- name: envoy-config
@@ -82,6 +92,19 @@ Usage: {{ include "governor.tlsInternal.volumes" (dict "componentName" "api" "co
8292
- name: tls-certs
8393
secret:
8494
secretName: {{ .config.name }}-tls
95+
- name: ca-cert
96+
secret:
97+
{{- if .tlsInternal.certificates.ca.bundled }}
98+
secretName: {{ .config.name }}-tls
99+
items:
100+
- key: ca.crt
101+
path: ca.crt
102+
{{- else }}
103+
secretName: {{ .tlsInternal.certificates.ca.secretName }}
104+
items:
105+
- key: {{ .tlsInternal.certificates.ca.key }}
106+
path: ca.crt
107+
{{- end }}
85108
{{- end }}
86109

87110
{{/*
@@ -120,7 +143,7 @@ transport_socket:
120143
common_tls_context:
121144
validation_context:
122145
trusted_ca:
123-
filename: /etc/envoy/certs/ca.crt
146+
filename: /etc/envoy/ca/ca.crt
124147
{{- end }}
125148

126149
{{/*

‎charts/governor/templates/certificates.yaml‎

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,21 @@ spec:
1414
privateKey:
1515
algorithm: {{ .Values.tlsInternal.certificates.privateKey.algorithm }}
1616
size: {{ .Values.tlsInternal.certificates.privateKey.size }}
17+
encoding: {{ .Values.tlsInternal.certificates.privateKey.encoding }}
1718
usages:
1819
- server auth
1920
- client auth
21+
{{- if .Values.api.tlsInternal.certificate }}
22+
{{- with .Values.api.tlsInternal.certificate.commonName }}
23+
commonName: {{ . }}
24+
{{- end }}
25+
{{- end }}
2026
dnsNames:
21-
- {{ .Values.api.name }}
22-
- {{ .Values.api.name }}.{{ .Release.Namespace }}
23-
- {{ .Values.api.name }}.{{ .Release.Namespace }}.svc
27+
{{- if and .Values.api.tlsInternal.certificate .Values.api.tlsInternal.certificate.dnsNames }}
28+
{{- toYaml .Values.api.tlsInternal.certificate.dnsNames | nindent 4 }}
29+
{{- else }}
2430
- {{ .Values.api.name }}.{{ .Release.Namespace }}.svc.cluster.local
31+
{{- end }}
2532
issuerRef:
2633
name: {{ .Values.tlsInternal.certificates.issuerRef.name }}
2734
kind: {{ .Values.tlsInternal.certificates.issuerRef.kind }}
@@ -40,14 +47,21 @@ spec:
4047
privateKey:
4148
algorithm: {{ .Values.tlsInternal.certificates.privateKey.algorithm }}
4249
size: {{ .Values.tlsInternal.certificates.privateKey.size }}
50+
encoding: {{ .Values.tlsInternal.certificates.privateKey.encoding }}
4351
usages:
4452
- server auth
4553
- client auth
54+
{{- if .Values.front.tlsInternal.certificate }}
55+
{{- with .Values.front.tlsInternal.certificate.commonName }}
56+
commonName: {{ . }}
57+
{{- end }}
58+
{{- end }}
4659
dnsNames:
47-
- {{ .Values.front.name }}
48-
- {{ .Values.front.name }}.{{ .Release.Namespace }}
49-
- {{ .Values.front.name }}.{{ .Release.Namespace }}.svc
60+
{{- if and .Values.front.tlsInternal.certificate .Values.front.tlsInternal.certificate.dnsNames }}
61+
{{- toYaml .Values.front.tlsInternal.certificate.dnsNames | nindent 4 }}
62+
{{- else }}
5063
- {{ .Values.front.name }}.{{ .Release.Namespace }}.svc.cluster.local
64+
{{- end }}
5165
issuerRef:
5266
name: {{ .Values.tlsInternal.certificates.issuerRef.name }}
5367
kind: {{ .Values.tlsInternal.certificates.issuerRef.kind }}
@@ -66,10 +80,20 @@ spec:
6680
privateKey:
6781
algorithm: {{ .Values.tlsInternal.certificates.privateKey.algorithm }}
6882
size: {{ .Values.tlsInternal.certificates.privateKey.size }}
83+
encoding: {{ .Values.tlsInternal.certificates.privateKey.encoding }}
6984
usages:
7085
- client auth
86+
{{- if .Values.agent.tlsInternal.certificate }}
87+
{{- with .Values.agent.tlsInternal.certificate.commonName }}
88+
commonName: {{ . }}
89+
{{- end }}
90+
{{- end }}
7191
dnsNames:
72-
- {{ .Values.agent.name }}
92+
{{- if and .Values.agent.tlsInternal.certificate .Values.agent.tlsInternal.certificate.dnsNames }}
93+
{{- toYaml .Values.agent.tlsInternal.certificate.dnsNames | nindent 4 }}
94+
{{- else }}
95+
- {{ .Values.agent.name }}.{{ .Release.Namespace }}.svc.cluster.local
96+
{{- end }}
7397
issuerRef:
7498
name: {{ .Values.tlsInternal.certificates.issuerRef.name }}
7599
kind: {{ .Values.tlsInternal.certificates.issuerRef.kind }}

‎charts/governor/values.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,19 @@ tlsInternal:
2121
privateKey:
2222
algorithm: ECDSA
2323
size: 256
24+
encoding: PKCS8
2425
# Duration of certificates
2526
duration: 8760h # 1 year
2627
# Renew before expiry
2728
renewBefore: 720h # 30 days
29+
# CA certificate for upstream TLS validation.
30+
# By default, ca.crt is read from a separate secret (e.g. copied from the CA
31+
# or provided by an external PKI). Set bundled=true to fall back to using
32+
# the ca.crt that cert-manager bundles into each per-component TLS secret.
33+
ca:
34+
bundled: false
35+
secretName: "internal-ca-cert"
36+
key: "ca.crt"
2837
# Port mappings for Envoy listeners
2938
ports:
3039
# Envoy admin port (for health checks)
@@ -78,6 +87,11 @@ api:
7887
type: ClusterIP
7988
port: 80
8089
grpcPort: 50055
90+
tlsInternal:
91+
certificate:
92+
# commonName: governor-api
93+
# dnsNames:
94+
# - governor-api.governor.svc.cluster.local
8195

8296
front:
8397
name: governor-front
@@ -107,6 +121,11 @@ front:
107121
service:
108122
type: ClusterIP
109123
port: 80
124+
tlsInternal:
125+
certificate:
126+
# commonName: governor-front
127+
# dnsNames:
128+
# - governor-front.governor.svc.cluster.local
110129

111130
agent:
112131
name: governor-agent
@@ -135,6 +154,11 @@ agent:
135154
mountPath: /app/rocksdb
136155
claimName: agent-pvc
137156
size: 10Gi
157+
tlsInternal:
158+
certificate:
159+
# commonName: governor-agent
160+
# dnsNames:
161+
# - governor-agent.governor.svc.cluster.local
138162

139163
director:
140164
name: governor-director

0 commit comments

Comments
 (0)