Skip to content

Commit 22bd9ba

Browse files
jk464jk464
committed
Enabled internal TLS between k8s pods by default
1 parent 80f80b4 commit 22bd9ba

11 files changed

+377
-10
lines changed

‎.github/workflows/e2e.yaml

+23-1
Original file line numberDiff line numberDiff line change
@@ -39,15 +39,37 @@ jobs:
3939
with:
4040
k3s-channel: ${{ matrix.k3s-channel }}
4141

42+
- name: Setup cert-manager
43+
run: |
44+
helm repo add jetstack https://charts.jetstack.io --force-update
45+
helm repo update
46+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.crds.yaml
47+
helm install \
48+
cert-manager jetstack/cert-manager \
49+
--namespace cert-manager \
50+
--create-namespace \
51+
--version v1.14.5
52+
4253
- name: Update stackstorm-ha chart dependencies
4354
run: |
4455
set -x
4556
helm dependency update
4657
58+
- name: Helm template test
59+
run: |
60+
openssl req -x509 -nodes -days 2 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=StackStorm CA"
61+
helm template --debug \
62+
--name-template stackstorm-ha . \
63+
--set "secret.ca.crt=$(cat tls.crt | base64 -w0 | tr -d '\n')" \
64+
--set "secret.ca.key=$(cat tls.key | base64 -w0 | tr -d '\n')"
65+
4766
- name: Helm install
4867
run: |
68+
openssl req -x509 -nodes -days 2 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=StackStorm CA"
4969
helm install --timeout 15m0s --debug --wait \
50-
--name-template stackstorm-ha .
70+
--name-template stackstorm-ha . \
71+
--set "secret.ca.crt=$(cat tls.crt | base64 -w0 | tr -d '\n')" \
72+
--set "secret.ca.key=$(cat tls.key | base64 -w0 | tr -d '\n')"
5173
5274
- name: Helm test
5375
run: |

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Changelog
22

33
## Development
4+
* Enable the use of TLS between all internal components (aside from Redis), and enable it by default (#401) (by @jk464)
45

56
## v1.1.0
67
* Fix syntax with ensure-packs-volumes-are-writable job (#403, #411) (by @skiedude)

‎templates/_helpers.tpl

+36
Original file line numberDiff line numberDiff line change
@@ -422,3 +422,39 @@ Create the custom env list for each deployment
422422
value: {{ $value | quote }}
423423
{{- end }}
424424
{{- end -}}
425+
426+
{{/*
427+
Set up values for Internal TLS
428+
*/}}
429+
{{- define "stackstorm-ha.internal_tls.cert_volume.mount" -}}
430+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
431+
- name: {{ .Values.st2.tls.secretName }}
432+
mountPath: {{ .Values.st2.tls.mountPath }}/
433+
readOnly: true
434+
{{- end }}
435+
{{- end -}}
436+
{{- define "stackstorm-ha.internal_tls.cert_volume.volume" -}}
437+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
438+
- name: {{ .Values.st2.tls.secretName }}
439+
secret:
440+
secretName: {{ .Values.st2.tls.secretName }}
441+
{{- end }}
442+
{{- end -}}
443+
444+
{{/*
445+
Define st2web ports
446+
*/}}
447+
{{- define "stackstorm-ha.st2web.http_port" -}}
448+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
449+
8080
450+
{{- else -}}
451+
80
452+
{{- end -}}
453+
{{- end -}}
454+
{{- define "stackstorm-ha.st2web.https_port" -}}
455+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
456+
8443
457+
{{- else -}}
458+
443
459+
{{- end -}}
460+
{{- end -}}

‎templates/ca.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if not ( .Values.st2.tls.certificate_issuer.existing ) -}}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: {{ .Values.st2.tls.certificate_issuer.name }}
7+
namespace: "{{ $.Release.Namespace }}"
8+
spec:
9+
ca:
10+
secretName: {{ .Values.st2.tls.certificate_issuer.name }}-tls
11+
---
12+
apiVersion: v1
13+
data:
14+
tls.crt: "{{ .Values.secret.ca.crt }}"
15+
tls.key: "{{ .Values.secret.ca.key }}"
16+
kind: Secret
17+
metadata:
18+
name: {{ .Values.st2.tls.certificate_issuer.name }}-tls
19+
namespace: "{{ $.Release.Namespace }}"
20+
type: kubernetes.io/tls
21+
{{- end -}}

‎templates/certificate.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: {{ .Values.st2.tls.secretName }}
7+
labels:
8+
app: stackstorm
9+
heritage: {{.Release.Service | quote}}
10+
release: {{.Release.Name | quote}}
11+
chart: {{ replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name }}
12+
spec:
13+
secretName: {{ .Values.st2.tls.secretName }}
14+
dnsNames:
15+
- "*.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}"
16+
{{ include "stackstorm-ha.mongodb-nodes" $ | splitList "," | toYaml | indent 4 }}
17+
ipAddresses:
18+
- "127.0.0.1"
19+
renewBefore: 360h # 15d
20+
privateKey:
21+
rotationPolicy: Always
22+
algorithm: RSA
23+
size: 3072
24+
issuerRef:
25+
name: {{ .Values.st2.tls.certificate_issuer.name }}
26+
kind: Issuer
27+
group: cert-manager.io
28+
{{- end -}}

‎templates/configmaps_st2-conf.yaml

+41
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,49 @@ data:
1111
# The order of merging: st2.conf < st2.docker.conf < st2.user.conf
1212
st2.docker.conf: |
1313
[auth]
14+
{{- if .Values.rabbitmq.tls.enabled }}
15+
api_url = https://{{ .Release.Name }}-st2api:9111/
16+
{{- else }}
1417
api_url = http://{{ .Release.Name }}-st2api:9101/
18+
{{- end -}}
19+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
20+
use_ssl = True
21+
key = {{ .Values.st2.tls.mountPath }}/tls.key
22+
cert = {{ .Values.st2.tls.mountPath }}/tls.crt
23+
debug = False
24+
enable = True
25+
{{- else }}
26+
use_ssl = False
27+
{{- end }}
28+
1529
[system_user]
1630
user = {{ .Values.st2.system_user.user }}
1731
ssh_key_file = {{ tpl .Values.st2.system_user.ssh_key_file . }}
1832
{{- if index .Values "redis" "enabled" }}
33+
1934
[coordination]
2035
url = redis://{{ template "stackstorm-ha.redis-password" $ }}{{ template "stackstorm-ha.redis-nodes" $ }}
2136
{{- end }}
2237
{{- if index .Values "rabbitmq" "enabled" }}
38+
2339
[messaging]
40+
{{- if .Values.rabbitmq.tls.enabled }}
41+
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5671{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
42+
{{- else }}
2443
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5672{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
44+
{{- end -}}
2545
{{- end }}
2646
{{- if index .Values "mongodb" "enabled" }}
47+
{{- if .Values.rabbitmq.tls.enabled }}
48+
ssl = True
49+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
50+
ssl_cert_reqs = optional
51+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
52+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
53+
{{- else }}
54+
ssl = False
55+
{{- end }}
56+
2757
[database]
2858
{{- if index .Values "mongodb" "auth" "enabled" }}
2959
host = mongodb://{{ template "stackstorm-ha.mongodb-nodes" $ }}/{{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}?authSource={{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}&replicaSet={{ index .Values "mongodb" "replicaSetName" }}
@@ -36,10 +66,21 @@ data:
3666
port = {{ index .Values "mongodb" "service" "port" }}
3767
{{- end }}
3868
{{- if ne "disable" (default "" .Values.st2.datastore_crypto_key) }}
69+
{{- if .Values.mongodb.tls.enabled }}
70+
ssl = True
71+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
72+
ssl_cert_reqs = optional
73+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
74+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
75+
{{- else }}
76+
ssl = False
77+
{{- end }}
78+
3979
[keyvalue]
4080
encryption_key_path = /etc/st2/keys/datastore_key.json
4181
{{- end }}
4282
{{- if .Values.st2.rbac.enabled }}
83+
4384
[rbac]
4485
enable = True
4586
backend = default

‎templates/configmaps_st2-urls.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,18 @@ metadata:
77
description: StackStorm service URLs, used across entire st2 cluster
88
labels: {{- include "stackstorm-ha.labels" (list $ "st2") | nindent 4 }}
99
data:
10+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
11+
ST2_AUTH_URL: https://{{ .Release.Name }}-st2auth:9100/
12+
{{- else }}
1013
ST2_AUTH_URL: http://{{ .Release.Name }}-st2auth:9100/
14+
{{- end }}
15+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
16+
ST2_API_URL: https://{{ .Release.Name }}-st2api:9111/
17+
{{- else }}
1118
ST2_API_URL: http://{{ .Release.Name }}-st2api:9101/
19+
{{- end }}
20+
{{- if and .Values.st2.tls.enabled .Values.st2stream.tls.enabled }}
21+
ST2_STREAM_URL: https://{{ .Release.Name }}-st2stream:9112/
22+
{{- else }}
1223
ST2_STREAM_URL: http://{{ .Release.Name }}-st2stream:9102/
24+
{{- end }}

0 commit comments

Comments
 (0)