Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 0a7c28b

Browse files
jk464jk464
committedMay 8, 2024·
Enabled internal TLS between k8s pods by default
1 parent 80f80b4 commit 0a7c28b

11 files changed

+377
-10
lines changed
 

‎.github/workflows/e2e.yaml

+23-1
Original file line numberDiff line numberDiff line change
@@ -39,15 +39,37 @@ jobs:
3939
with:
4040
k3s-channel: ${{ matrix.k3s-channel }}
4141

42+
- name: Setup cert-manager
43+
run: |
44+
helm repo add jetstack https://charts.jetstack.io --force-update
45+
helm repo update
46+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.crds.yaml
47+
helm install \
48+
cert-manager jetstack/cert-manager \
49+
--namespace cert-manager \
50+
--create-namespace \
51+
--version v1.14.5
52+
4253
- name: Update stackstorm-ha chart dependencies
4354
run: |
4455
set -x
4556
helm dependency update
4657
58+
- name: Helm template test
59+
run: |
60+
openssl req -x509 -nodes -days 2 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=StackStorm CA"
61+
helm template --debug \
62+
--name-template stackstorm-ha . \
63+
--set "secret.ca.crt=$(cat tls.crt | base64 -w0)"
64+
--set "secret.ca.key=$(cat tls.key | base64 -w0)"
65+
4766
- name: Helm install
4867
run: |
68+
openssl req -x509 -nodes -days 2 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=StackStorm CA"
4969
helm install --timeout 15m0s --debug --wait \
50-
--name-template stackstorm-ha .
70+
--name-template stackstorm-ha . \
71+
--set "secret.ca.crt=$(cat tls.crt | base64 -w0)"
72+
--set "secret.ca.key=$(cat tls.key | base64 -w0)"
5173
5274
- name: Helm test
5375
run: |

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Changelog
22

33
## Development
4+
* Enable the use of TLS between all internal components (aside from Redis), and enable it by default (#401) (by @jk464)
45

56
## v1.1.0
67
* Fix syntax with ensure-packs-volumes-are-writable job (#403, #411) (by @skiedude)

‎templates/_helpers.tpl

+36
Original file line numberDiff line numberDiff line change
@@ -422,3 +422,39 @@ Create the custom env list for each deployment
422422
value: {{ $value | quote }}
423423
{{- end }}
424424
{{- end -}}
425+
426+
{{/*
427+
Set up values for Internal TLS
428+
*/}}
429+
{{- define "stackstorm-ha.internal_tls.cert_volume.mount" -}}
430+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
431+
- name: {{ .Values.st2.tls.secretName }}
432+
mountPath: {{ .Values.st2.tls.mountPath }}/
433+
readOnly: true
434+
{{- end }}
435+
{{- end -}}
436+
{{- define "stackstorm-ha.internal_tls.cert_volume.volume" -}}
437+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
438+
- name: {{ .Values.st2.tls.secretName }}
439+
secret:
440+
secretName: {{ .Values.st2.tls.secretName }}
441+
{{- end }}
442+
{{- end -}}
443+
444+
{{/*
445+
Define st2web ports
446+
*/}}
447+
{{- define "stackstorm-ha.st2web.http_port" -}}
448+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
449+
8080
450+
{{- else -}}
451+
80
452+
{{- end -}}
453+
{{- end -}}
454+
{{- define "stackstorm-ha.st2web.https_port" -}}
455+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
456+
8443
457+
{{- else -}}
458+
443
459+
{{- end -}}
460+
{{- end -}}

‎templates/ca.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if not ( .Values.st2.tls.certificate_issuer.existing ) -}}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: {{ .Values.st2.tls.certificate_issuer.name }}
7+
namespace: "{{ $.Release.Namespace }}"
8+
spec:
9+
ca:
10+
secretName: {{ .Values.st2.tls.certificate_issuer.name }}-tls
11+
---
12+
apiVersion: v1
13+
data:
14+
tls.crt: "{{ .Values.secret.ca.crt }}"
15+
tls.key: "{{ .Values.secret.ca.key }}"
16+
kind: Secret
17+
metadata:
18+
name: {{ .Values.st2.tls.certificate_issuer.name }}-tls
19+
namespace: "{{ $.Release.Namespace }}"
20+
type: kubernetes.io/tls
21+
{{- end -}}

‎templates/certificate.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: {{ .Values.st2.tls.secretName }}
7+
labels:
8+
app: stackstorm
9+
heritage: {{.Release.Service | quote}}
10+
release: {{.Release.Name | quote}}
11+
chart: {{ replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name }}
12+
spec:
13+
secretName: {{ .Values.st2.tls.secretName }}
14+
dnsNames:
15+
- "*.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}"
16+
{{ include "stackstorm-ha.mongodb-nodes" $ | splitList "," | toYaml | indent 4 }}
17+
ipAddresses:
18+
- "127.0.0.1"
19+
renewBefore: 360h # 15d
20+
privateKey:
21+
rotationPolicy: Always
22+
algorithm: RSA
23+
size: 3072
24+
issuerRef:
25+
name: {{ .Values.st2.tls.certificate_issuer.name }}
26+
kind: Issuer
27+
group: cert-manager.io
28+
{{- end -}}

‎templates/configmaps_st2-conf.yaml

+41
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,49 @@ data:
1111
# The order of merging: st2.conf < st2.docker.conf < st2.user.conf
1212
st2.docker.conf: |
1313
[auth]
14+
{{- if .Values.rabbitmq.tls.enabled }}
15+
api_url = https://{{ .Release.Name }}-st2api:9111/
16+
{{- else }}
1417
api_url = http://{{ .Release.Name }}-st2api:9101/
18+
{{- end -}}
19+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
20+
use_ssl = True
21+
key = {{ .Values.st2.tls.mountPath }}/tls.key
22+
cert = {{ .Values.st2.tls.mountPath }}/tls.crt
23+
debug = False
24+
enable = True
25+
{{- else }}
26+
use_ssl = False
27+
{{- end }}
28+
1529
[system_user]
1630
user = {{ .Values.st2.system_user.user }}
1731
ssh_key_file = {{ tpl .Values.st2.system_user.ssh_key_file . }}
1832
{{- if index .Values "redis" "enabled" }}
33+
1934
[coordination]
2035
url = redis://{{ template "stackstorm-ha.redis-password" $ }}{{ template "stackstorm-ha.redis-nodes" $ }}
2136
{{- end }}
2237
{{- if index .Values "rabbitmq" "enabled" }}
38+
2339
[messaging]
40+
{{- if .Values.rabbitmq.tls.enabled }}
41+
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5671{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
42+
{{- else }}
2443
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5672{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
44+
{{- end -}}
2545
{{- end }}
2646
{{- if index .Values "mongodb" "enabled" }}
47+
{{- if .Values.rabbitmq.tls.enabled }}
48+
ssl = True
49+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
50+
ssl_cert_reqs = optional
51+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
52+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
53+
{{- else }}
54+
ssl = False
55+
{{- end }}
56+
2757
[database]
2858
{{- if index .Values "mongodb" "auth" "enabled" }}
2959
host = mongodb://{{ template "stackstorm-ha.mongodb-nodes" $ }}/{{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}?authSource={{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}&replicaSet={{ index .Values "mongodb" "replicaSetName" }}
@@ -36,10 +66,21 @@ data:
3666
port = {{ index .Values "mongodb" "service" "port" }}
3767
{{- end }}
3868
{{- if ne "disable" (default "" .Values.st2.datastore_crypto_key) }}
69+
{{- if .Values.mongodb.tls.enabled }}
70+
ssl = True
71+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
72+
ssl_cert_reqs = optional
73+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
74+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
75+
{{- else }}
76+
ssl = False
77+
{{- end }}
78+
3979
[keyvalue]
4080
encryption_key_path = /etc/st2/keys/datastore_key.json
4181
{{- end }}
4282
{{- if .Values.st2.rbac.enabled }}
83+
4384
[rbac]
4485
enable = True
4586
backend = default

‎templates/configmaps_st2-urls.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,18 @@ metadata:
77
description: StackStorm service URLs, used across entire st2 cluster
88
labels: {{- include "stackstorm-ha.labels" (list $ "st2") | nindent 4 }}
99
data:
10+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
11+
ST2_AUTH_URL: https://{{ .Release.Name }}-st2auth:9100/
12+
{{- else }}
1013
ST2_AUTH_URL: http://{{ .Release.Name }}-st2auth:9100/
14+
{{- end }}
15+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
16+
ST2_API_URL: https://{{ .Release.Name }}-st2api:9111/
17+
{{- else }}
1118
ST2_API_URL: http://{{ .Release.Name }}-st2api:9101/
19+
{{- end }}
20+
{{- if and .Values.st2.tls.enabled .Values.st2stream.tls.enabled }}
21+
ST2_STREAM_URL: https://{{ .Release.Name }}-st2stream:9112/
22+
{{- else }}
1223
ST2_STREAM_URL: http://{{ .Release.Name }}-st2stream:9102/
24+
{{- end }}

‎templates/deployments.yaml

+115-4
Large diffs are not rendered by default.

‎templates/jobs.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ spec:
5151
{{- end }}
5252
{{- end }}
5353
volumeMounts:
54+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
5455
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
5556
- name: st2-rbac-roles-vol
5657
mountPath: /opt/stackstorm/rbac/roles/
@@ -65,6 +66,7 @@ spec:
6566
# TODO: Find out default resource limits for this specific service (#5)
6667
#resources:
6768
volumes:
69+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
6870
{{- include "stackstorm-ha.st2-config-volume" . | nindent 8 }}
6971
- name: st2-rbac-roles-vol
7072
configMap:
@@ -143,7 +145,11 @@ spec:
143145
- 'sh'
144146
- '-c'
145147
- >
148+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
149+
until nc -z -w 2 {{ .Release.Name }}-st2api 9111 && echo st2api ready;
150+
{{- else }}
146151
until nc -z -w 2 {{ .Release.Name }}-st2api 9101 && echo st2api ready;
152+
{{- end }}
147153
do sleep 2;
148154
done
149155
# Sidecar container for generating st2client config with st2 username & password pair and sharing produced file with the main container
@@ -163,6 +169,7 @@ spec:
163169
name: {{ . }}
164170
{{- end }}
165171
volumeMounts:
172+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
166173
- name: st2client-config-vol
167174
mountPath: /root/.st2/
168175
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
@@ -196,6 +203,7 @@ spec:
196203
name: {{ . }}
197204
{{- end }}
198205
volumeMounts:
206+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
199207
- name: st2client-config-vol
200208
mountPath: /root/.st2/
201209
- name: st2-apikeys-vol
@@ -208,6 +216,7 @@ spec:
208216
# TODO: Find out default resource limits for this specific service (#5)
209217
#resources:
210218
volumes:
219+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
211220
- name: st2client-config-vol
212221
emptyDir:
213222
medium: Memory
@@ -289,6 +298,7 @@ spec:
289298
name: {{ . }}
290299
{{- end }}
291300
volumeMounts:
301+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
292302
- name: st2client-config-vol
293303
mountPath: /root/.st2/
294304
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
@@ -323,6 +333,7 @@ spec:
323333
name: {{ . }}
324334
{{- end }}
325335
volumeMounts:
336+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
326337
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
327338
- name: st2client-config-vol
328339
mountPath: /root/.st2/
@@ -336,6 +347,7 @@ spec:
336347
# TODO: Find out default resource limits for this specific service (#5)
337348
#resources:
338349
volumes:
350+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
339351
{{- include "stackstorm-ha.st2-config-volume" . | nindent 8 }}
340352
- name: st2client-config-vol
341353
emptyDir:
@@ -418,6 +430,7 @@ spec:
418430
{{- end }}
419431
command: {{- toYaml $.Values.jobs.preRegisterContentCommand | nindent 8 }}
420432
volumeMounts:
433+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
421434
{{- include "stackstorm-ha.overrides-config-mounts" . | nindent 8 }}
422435
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
423436
{{- include "stackstorm-ha.pack-configs-volume-mount" . | nindent 8 }}
@@ -447,6 +460,7 @@ spec:
447460
{{- end }}
448461
{{- end }}
449462
volumeMounts:
463+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
450464
{{- include "stackstorm-ha.overrides-config-mounts" . | nindent 8 }}
451465
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
452466
{{- include "stackstorm-ha.packs-volume-mounts-for-register-job" . | nindent 8 }}
@@ -458,6 +472,7 @@ spec:
458472
# TODO: Find out default resource limits for this specific service (#5)
459473
#resources:
460474
volumes:
475+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
461476
{{- include "stackstorm-ha.overrides-configs" . | nindent 8 }}
462477
{{- include "stackstorm-ha.st2-config-volume" . | nindent 8 }}
463478
{{- include "stackstorm-ha.packs-volumes" . | nindent 8 }}
@@ -567,6 +582,7 @@ spec:
567582
echo DONE
568583
569584
volumeMounts:
585+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
570586
{{- include "stackstorm-ha.packs-volume-mounts" $ | nindent 8 }}
571587
{{/* do not include the pack-configs-volume-mount helper here */}}
572588
- name: st2-pack-configs-vol
@@ -575,6 +591,7 @@ spec:
575591
# TODO: Find out default resource limits for this specific job (#5)
576592
#resources:
577593
volumes:
594+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
578595
{{- include "stackstorm-ha.packs-volumes" $ | nindent 8 }}
579596
{{- if $.Values.st2.packs.volumes.configs }}
580597
{{/* do not include the pack-configs-volume helper here */}}
@@ -659,6 +676,7 @@ spec:
659676
name: {{ . }}
660677
{{- end }}
661678
volumeMounts:
679+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
662680
- name: st2client-config-vol
663681
mountPath: /root/.st2/
664682
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
@@ -693,6 +711,7 @@ spec:
693711
volumeMounts:
694712
- name: st2client-config-vol
695713
mountPath: /root/.st2/
714+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
696715
{{- include "stackstorm-ha.overrides-config-mounts" $ | nindent 8 }}
697716
{{- include "stackstorm-ha.st2-config-volume-mounts" $ | nindent 8 }}
698717
{{- include "stackstorm-ha.packs-volume-mounts-for-register-job" $ | nindent 8 }}
@@ -708,6 +727,7 @@ spec:
708727
- name: st2client-config-vol
709728
emptyDir:
710729
medium: Memory
730+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
711731
{{- include "stackstorm-ha.overrides-configs" $ | nindent 8 }}
712732
{{- include "stackstorm-ha.st2-config-volume" $ | nindent 8 }}
713733
{{- include "stackstorm-ha.packs-volumes" $ | nindent 8 }}

‎templates/services.yaml

+14-2
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,11 @@ spec:
4848
{{- end }}
4949
ports:
5050
- protocol: TCP
51+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
52+
port: 9111
53+
{{- else }}
5154
port: 9101
55+
{{- end }}
5256

5357
---
5458
kind: Service
@@ -74,7 +78,11 @@ spec:
7478
{{- end }}
7579
ports:
7680
- protocol: TCP
81+
{{- if and .Values.st2.tls.enabled .Values.st2stream.tls.enabled }}
82+
port: 9112
83+
{{- else }}
7784
port: 9102
85+
{{- end }}
7886

7987
---
8088
kind: Service
@@ -99,8 +107,12 @@ spec:
99107
{{- end }}
100108
{{- end }}
101109
ports:
102-
- protocol: TCP
103-
port: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary 443 80 }}
110+
{{- $https_port := include "stackstorm-ha.st2web.https_port" . }}
111+
{{- $http_port := include "stackstorm-ha.st2web.http_port" . }}
112+
- name: st2web
113+
protocol: TCP
114+
port: {{ if and .Values.st2.tls.enabled .Values.st2web.tls.enabled -}}{{ $https_port }}{{- else -}}{{ $http_port }}{{- end }}
115+
targetPort: {{ if and .Values.st2.tls.enabled .Values.st2web.tls.enabled -}}{{ $https_port }}{{- else -}}{{ $http_port }}{{- end }}
104116

105117
{{ if .Values.st2chatops.enabled -}}
106118
---

‎values.yaml

+66-3
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,11 @@ st2:
9696
[api]
9797
allow_origin = '*'
9898
# fixes no replicaset found bug;
99+
99100
[database]
100101
# Connection and server selection timeout (in ms).
101102
connection_timeout = 5000
102103
103-
104104
#Override Definitions can be added here.
105105
#https://docs.stackstorm.com/latest/packs.html#overriding-pack-defaults
106106
overrides: {}
@@ -296,6 +296,15 @@ st2:
296296
# roles:
297297
# - "admin"
298298

299+
# Controls configuring TLS between internal inter-pod communications
300+
tls:
301+
enabled: true
302+
secretName: "internal-tls"
303+
mountPath: "/etc/ssl/internal"
304+
certificate_issuer:
305+
existing: false
306+
name: stackstorm-issuer
307+
299308
##
300309
## Default SecurityContext for pods and containers.
301310
## Overrides available for st2web, st2actionrunner, st2sensorcontainer, st2client pods, and custom packs images.
@@ -380,7 +389,19 @@ st2web:
380389
securityContext: {} # NB: nginx requires some capabilities, drop ALL will cause issues.
381390
# mount extra volumes on the st2web pod(s) (primarily useful for k8s-provisioned secrets)
382391
## Note that Helm templating is supported in 'mount' and 'volume'
383-
extra_volumes: []
392+
extra_volumes:
393+
- name: st2-cert
394+
mount:
395+
mountPath: "/etc/ssl/st2/"
396+
readOnly: true
397+
volume:
398+
secret:
399+
secretName: "{{ .Release.Name }}-stackstorm-tls"
400+
items:
401+
- key: tls.crt
402+
path: st2.crt
403+
- key: tls.key
404+
path: st2.key
384405
# see examples under st2actionrunner.extra_volumes
385406
# User-defined st2web config with custom settings to replace default config.js
386407
# See https://github.com/StackStorm/st2web#connecting-to-st2-server for more info
@@ -392,6 +413,9 @@ st2web:
392413
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
393414
postStartScript: ""
394415
preStopSleep: "10"
416+
# Use TLS on HTTP connections to st2web (i.e. between pod and ingress)
417+
tls:
418+
enabled: true
395419

396420
# https://docs.stackstorm.com/reference/ha.html#st2auth
397421
# Multiple st2auth processes can be behind a load balancer in an active-active configuration.
@@ -432,6 +456,9 @@ st2auth:
432456
## Note that Helm templating is supported in 'mount' and 'volume'
433457
extra_volumes: []
434458
# see examples under st2actionrunner.extra_volumes
459+
# Use TLS on HTTP connections to st2auth (i.e. between pod and ingress, and inter-pod)
460+
tls:
461+
enabled: true
435462

436463
# https://docs.stackstorm.com/reference/ha.html#st2api
437464
# Multiple st2api process can be behind a load balancer in an active-active configuration.
@@ -472,6 +499,9 @@ st2api:
472499
## Note that Helm templating is supported in 'mount' and 'volume'
473500
extra_volumes: []
474501
# see examples under st2actionrunner.extra_volumes
502+
# Use TLS on HTTP connections to st2api (i.e. between pod and ingress, and inter-pod)
503+
tls:
504+
enabled: true
475505

476506
# https://docs.stackstorm.com/reference/ha.html#st2stream
477507
# Multiple st2stream process can be behind a load balancer in an active-active configuration.
@@ -512,6 +542,9 @@ st2stream:
512542
## Note that Helm templating is supported in 'mount' and 'volume'
513543
extra_volumes: []
514544
# see examples under st2actionrunner.extra_volumes
545+
# Use TLS on HTTP connections to st2stream (i.e. between pod and ingress, and inter-pod)
546+
tls:
547+
enabled: true
515548

516549
# https://docs.stackstorm.com/reference/ha.html#st2rulesengine
517550
# Multiple st2rulesengine processes can run in active-active with only connections to MongoDB and RabbitMQ. All these will share the TriggerInstance load and naturally pick up more work if one or more of the processes becomes unavailable.
@@ -1050,6 +1083,13 @@ mongodb:
10501083
arbiter:
10511084
enabled: false
10521085
resources: {}
1086+
tls:
1087+
enabled: true
1088+
replicaset:
1089+
existingSecrets:
1090+
- internal-tls
1091+
- internal-tls
1092+
- internal-tls
10531093

10541094
##
10551095
## RabbitMQ configuration (3rd party chart dependency)
@@ -1067,6 +1107,10 @@ rabbitmq:
10671107
forceBoot: true
10681108
# Authentication Details
10691109
auth:
1110+
tls:
1111+
enabled: true
1112+
existingSecret: "internal-tls"
1113+
# Fail over to username admin if LDAP is down:
10701114
username: admin
10711115
# TODO: Use default random 10 character password, but need to fetch this string for use by downstream services
10721116
password: 9jS+w1u07NbHtZke1m+jW4Cj
@@ -1097,7 +1141,9 @@ rabbitmq:
10971141
# As RabbitMQ enabled prometheus operator monitoring by default, disable it for non-prometheus users
10981142
metrics:
10991143
enabled: false
1100-
1144+
tls:
1145+
enabled: true
1146+
existingSecret: "internal-tls"
11011147
##
11021148
## Redis HA configuration (3rd party chart dependency)
11031149
##
@@ -1133,6 +1179,13 @@ redis:
11331179
usePassword: false
11341180
metrics:
11351181
enabled: false
1182+
tls:
1183+
enabled: true
1184+
authClients: false
1185+
certificatesSecret: internal-tls
1186+
certFilename: tls.crt
1187+
certKeyFilename: tls.key
1188+
certCAFilename: ca.crt
11361189

11371190
##
11381191
## Settings to be applied to all stackstorm-ha pods
@@ -1168,3 +1221,13 @@ external-dns:
11681221
aws:
11691222
zoneType: "public"
11701223
domainFilters: []
1224+
1225+
##
1226+
## Image details for ghostunnel
1227+
##
1228+
ghostunnel:
1229+
image:
1230+
name: ghostunnel
1231+
repository: ghostunnel
1232+
tag: v1.6.0
1233+
pullPolicy: IfNotPresent

0 commit comments

Comments
 (0)
Please sign in to comment.