Skip to content

Commit 0e8bc77

Browse files
jk464jk464
committed
Enabled internal TLS between k8s pods by default
1 parent 496fc58 commit 0e8bc77

15 files changed

+416
-18
lines changed

‎.circleci/config.yml

+11
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,17 @@ jobs:
3434
- run:
3535
name: Create new K8s cluster
3636
command: minikube start --vm-driver=docker --memory 8192 --cpus 4 --kubernetes-version=<< parameters.kubernetes-version >>
37+
- run:
38+
name: Setup cert-manager
39+
command: |
40+
helm repo add jetstack https://charts.jetstack.io --force-update
41+
helm repo update
42+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.crds.yaml
43+
helm install \
44+
cert-manager jetstack/cert-manager \
45+
--namespace cert-manager \
46+
--create-namespace \
47+
--version v1.14.5
3748
- run:
3849
name: Update stackstorm-ha chart dependencies
3950
command: helm dependency update

‎.github/workflows/e2e.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,17 @@ jobs:
3939
with:
4040
k3s-channel: ${{ matrix.k3s-channel }}
4141

42+
- name: Setup cert-manager
43+
run: |
44+
helm repo add jetstack https://charts.jetstack.io --force-update
45+
helm repo update
46+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.crds.yaml
47+
helm install \
48+
cert-manager jetstack/cert-manager \
49+
--namespace cert-manager \
50+
--create-namespace \
51+
--version v1.14.5
52+
4253
- name: Update stackstorm-ha chart dependencies
4354
run: |
4455
set -x

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
## Development
44
* Updated our tests/unit to support newer versions of `unittests` - for now bumping to `v0.4.4` as `v0.5.0` has a bug that impacts us (see helm-unittest/helm-unittest#329), but testing around the bug shows `v0.5.x` should also "just work" (#414) (by @jk464)
5+
* Enable the use of TLS between all internal components (aside from Redis), and enable it by default (#401) (by @jk464)
56

67
## v1.1.0
78
* Fix syntax with ensure-packs-volumes-are-writable job (#403, #411) (by @skiedude)

‎Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ dependencies:
3333
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
3434
condition: rabbitmq.enabled
3535
- name: mongodb
36-
version: 10.0.1
36+
version: 13.18.5
3737
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
3838
condition: mongodb.enabled
3939
- name: external-dns

‎templates/_helpers.tpl

+52-1
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ Reduce duplication of the st2.*.conf volume details
199199

200200
{{- define "stackstorm-ha.init-containers-wait-for-db" -}}
201201
{{- if index .Values "mongodb" "enabled" }}
202-
{{- $mongodb_port := (int (index .Values "mongodb" "service" "port")) }}
202+
{{- $mongodb_port := (int (index .Values "mongodb" "service" "ports" "mongodb")) }}
203203
- name: wait-for-db
204204
image: {{ template "stackstorm-ha.utilityImage" . }}
205205
imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -422,3 +422,54 @@ Create the custom env list for each deployment
422422
value: {{ $value | quote }}
423423
{{- end }}
424424
{{- end -}}
425+
426+
{{/*
427+
Generate CA
428+
*/}}
429+
{{- define "stackstorm-ha.internal_tls.ca" }}
430+
data:
431+
{{- if (default false ((($.Values.secret).ca))) }}
432+
tls.crt: "{{ .Values.secret.ca.crt }}"
433+
tls.key: "{{ .Values.secret.ca.key }}"
434+
{{- else }}
435+
{{- $ca := genCA "StackStorm CA" 365 }}
436+
tls.crt: "{{ $ca.Cert | b64enc}}"
437+
tls.key: "{{ $ca.Key | b64enc}}"
438+
{{- end -}}
439+
{{- end -}}
440+
441+
{{/*
442+
Set up values for Internal TLS
443+
*/}}
444+
{{- define "stackstorm-ha.internal_tls.cert_volume.mount" -}}
445+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
446+
- name: {{ .Values.st2.tls.secretName }}
447+
mountPath: {{ .Values.st2.tls.mountPath }}/
448+
readOnly: true
449+
{{- end }}
450+
{{- end -}}
451+
{{- define "stackstorm-ha.internal_tls.cert_volume.volume" -}}
452+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
453+
- name: {{ .Values.st2.tls.secretName }}
454+
secret:
455+
secretName: {{ .Values.st2.tls.secretName }}
456+
{{- end }}
457+
{{- end -}}
458+
459+
{{/*
460+
Define st2web ports
461+
*/}}
462+
{{- define "stackstorm-ha.st2web.http_port" -}}
463+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
464+
8080
465+
{{- else -}}
466+
80
467+
{{- end -}}
468+
{{- end -}}
469+
{{- define "stackstorm-ha.st2web.https_port" -}}
470+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
471+
8443
472+
{{- else -}}
473+
443
474+
{{- end -}}
475+
{{- end -}}

‎templates/ca.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if not ( .Values.st2.tls.certificate_issuer.existing ) -}}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: {{ .Values.st2.tls.certificate_issuer.name }}
7+
namespace: "{{ $.Release.Namespace }}"
8+
spec:
9+
ca:
10+
secretName: {{ .Values.st2.tls.certificate_issuer.name }}-tls
11+
---
12+
apiVersion: v1
13+
{{- include "stackstorm-ha.internal_tls.ca" . }}
14+
kind: Secret
15+
metadata:
16+
name: {{ .Values.st2.tls.certificate_issuer.name }}-tls
17+
namespace: "{{ $.Release.Namespace }}"
18+
type: kubernetes.io/tls
19+
{{- end -}}

‎templates/certificate.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: {{ .Values.st2.tls.secretName }}
7+
namespace: "{{ $.Release.Namespace }}"
8+
labels:
9+
app: stackstorm
10+
heritage: {{.Release.Service | quote}}
11+
release: {{.Release.Name | quote}}
12+
chart: {{ replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name }}
13+
spec:
14+
secretName: {{ .Values.st2.tls.secretName }}
15+
dnsNames:
16+
- "*.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}"
17+
{{ include "stackstorm-ha.mongodb-nodes" $ | splitList "," | toYaml | indent 4 }}
18+
ipAddresses:
19+
- "127.0.0.1"
20+
renewBefore: 360h # 15d
21+
privateKey:
22+
rotationPolicy: Always
23+
algorithm: RSA
24+
size: 3072
25+
issuerRef:
26+
name: {{ .Values.st2.tls.certificate_issuer.name }}
27+
kind: Issuer
28+
group: cert-manager.io
29+
{{- end -}}

‎templates/configmaps_st2-conf.yaml

+41
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,49 @@ data:
1111
# The order of merging: st2.conf < st2.docker.conf < st2.user.conf
1212
st2.docker.conf: |
1313
[auth]
14+
{{- if .Values.rabbitmq.tls.enabled }}
15+
api_url = https://{{ .Release.Name }}-st2api:9111/
16+
{{- else }}
1417
api_url = http://{{ .Release.Name }}-st2api:9101/
18+
{{- end -}}
19+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
20+
use_ssl = True
21+
key = {{ .Values.st2.tls.mountPath }}/tls.key
22+
cert = {{ .Values.st2.tls.mountPath }}/tls.crt
23+
debug = False
24+
enable = True
25+
{{- else }}
26+
use_ssl = False
27+
{{- end }}
28+
1529
[system_user]
1630
user = {{ .Values.st2.system_user.user }}
1731
ssh_key_file = {{ tpl .Values.st2.system_user.ssh_key_file . }}
1832
{{- if index .Values "redis" "enabled" }}
33+
1934
[coordination]
2035
url = redis://{{ template "stackstorm-ha.redis-password" $ }}{{ template "stackstorm-ha.redis-nodes" $ }}
2136
{{- end }}
2237
{{- if index .Values "rabbitmq" "enabled" }}
38+
2339
[messaging]
40+
{{- if .Values.rabbitmq.tls.enabled }}
41+
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5671{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
42+
{{- else }}
2443
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5672{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
44+
{{- end -}}
2545
{{- end }}
2646
{{- if index .Values "mongodb" "enabled" }}
47+
{{- if .Values.rabbitmq.tls.enabled }}
48+
ssl = True
49+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
50+
ssl_cert_reqs = optional
51+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
52+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
53+
{{- else }}
54+
ssl = False
55+
{{- end }}
56+
2757
[database]
2858
{{- if index .Values "mongodb" "auth" "enabled" }}
2959
host = mongodb://{{ template "stackstorm-ha.mongodb-nodes" $ }}/{{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}?authSource={{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}&replicaSet={{ index .Values "mongodb" "replicaSetName" }}
@@ -36,10 +66,21 @@ data:
3666
port = {{ index .Values "mongodb" "service" "port" }}
3767
{{- end }}
3868
{{- if ne "disable" (default "" .Values.st2.datastore_crypto_key) }}
69+
{{- if .Values.mongodb.tls.enabled }}
70+
ssl = True
71+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
72+
ssl_cert_reqs = optional
73+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
74+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
75+
{{- else }}
76+
ssl = False
77+
{{- end }}
78+
3979
[keyvalue]
4080
encryption_key_path = /etc/st2/keys/datastore_key.json
4181
{{- end }}
4282
{{- if .Values.st2.rbac.enabled }}
83+
4384
[rbac]
4485
enable = True
4586
backend = default

‎templates/configmaps_st2-urls.yaml

+15-3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,18 @@ metadata:
77
description: StackStorm service URLs, used across entire st2 cluster
88
labels: {{- include "stackstorm-ha.labels" (list $ "st2") | nindent 4 }}
99
data:
10-
ST2_AUTH_URL: http://{{ .Release.Name }}-st2auth:9100/
11-
ST2_API_URL: http://{{ .Release.Name }}-st2api:9101/
12-
ST2_STREAM_URL: http://{{ .Release.Name }}-st2stream:9102/
10+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
11+
ST2_AUTH_URL: https://{{ .Release.Name }}-st2auth.{{ .Release.Namespace }}.svc.{{$.Values.clusterDomain }}:9100/
12+
{{- else }}
13+
ST2_AUTH_URL: http://{{ .Release.Name }}-st2auth.{{ .Release.Namespace }}.svc.{{$.Values.clusterDomain }}:9100/
14+
{{- end }}
15+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
16+
ST2_API_URL: https://{{ .Release.Name }}-st2api.{{ .Release.Namespace }}.svc.{{$.Values.clusterDomain }}:9111/
17+
{{- else }}
18+
ST2_API_URL: http://{{ .Release.Name }}-st2api.{{ .Release.Namespace }}.svc.{{$.Values.clusterDomain }}:9101/
19+
{{- end }}
20+
{{- if and .Values.st2.tls.enabled .Values.st2stream.tls.enabled }}
21+
ST2_STREAM_URL: https://{{ .Release.Name }}-st2stream.{{ .Release.Namespace }}.svc.{{$.Values.clusterDomain }}:9112/
22+
{{- else }}
23+
ST2_STREAM_URL: http://{{ .Release.Name }}-st2stream.{{ .Release.Namespace }}.svc.{{$.Values.clusterDomain }}:9102/
24+
{{- end }}

0 commit comments

Comments
 (0)