Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reworked TLS spec #41

Merged
merged 2 commits into from
Mar 9, 2018
Merged

Reworked TLS spec #41

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f7cd3c8
Reworked TLS spec
ewoutp Mar 9, 2018
f246a5d
Added self-signed
ewoutp Mar 9, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 40 additions & 22 deletions docs/user/custom_resource.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,34 +137,38 @@ and stored in a `Secret` with given name.
Changing a JWT token results in stopping the entire cluster
and restarting it.

### `spec.ssl.keySecretName: string`
### `spec.tls.caSecretName: string`

This setting specifies the name of a kubernetes `Secret` that contains
a PEM encoded server certificate + private key used for all TLS connections
of the ArangoDB servers.
The default value is empty.
a standard CA certificate + private key used to sign certificates for individual
ArangoDB servers.
The default value is empty. TBD

If you specify a name of a `Secret` that does not exist, a certificate + key is created
using the values of `spec.ssl.serverName` & `spec.ssl.organizationName`
If you specify a name of a `Secret` that does not exist, a CA certificate + key is created
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add "self-signed"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

and stored in a `Secret` with given name.

### `spec.ssl.organizationName: string`
The specified `Secret`, must contain the following data fields:

This setting specifies the name of an organization that is put in an automatically
generated SSL certificate (see `spec.ssl.keySecretName`).
The default value is empty.
- `ca.crt` PEM encoded public key of the CA certificate
- `ca.key` PEM encoded private key of the CA certificate

### `spec.ssl.serverName: string`
### `spec.tls.altNames: []string`

This setting specifies the name of a server that is put in an automatically
generated SSL certificate (see `spec.ssl.keySecretName`).
Besides this name, the internal DNS names of all ArangoDB servers are added
to the list of valid hostnames of the certificate. It is therefore not possible
to use this feature when scaling the cluster to more servers, since the newly
added servers will not be listed in the certificate.
This setting specifies a list of alternate names that will be added to all generated
certificates. These names can be DNS names or email addresses.
The default value is empty.

**TODO Really think this through. Restriction does not sound right.**
### `spec.tls.ttl: duration`

This setting specifies the time to live of all generated
server certificates.
The default value is `2160h` (about 3 month).

When the server certificate is about to expire, it will be automatically replaced
by a new one and the affected server will be restarted.

Note: The time to live of the CA certificate (when created automatically)
will be set to 10 years.

### `spec.sync.enabled: bool`

Expand Down Expand Up @@ -208,12 +212,26 @@ Possible values are:

- `direct` (default) for direct HTTP connections between the 2 data centers.

### `spec.sync.ssl.keySecretName: string`
### `spec.sync.tls.caSecretName: string`

This setting specifies the name of a kubernetes `Secret` that contains
a PEM encoded server certificate + private key used for the TLS connections
of all ArangoSync master servers.
This is a required setting when `spec.sync.enabled` is `true`.
a standard CA certificate + private key used to sign certificates for individual
ArangoSync master servers.

When no name is specified, it defaults to `<deployment-name>-sync-ca`.

If you specify a name of a `Secret` that does not exist, a CA certificate + key is created
and stored in a `Secret` with given name.

The specified `Secret`, must contain the following data fields:

- `ca.crt` PEM encoded public key of the CA certificate
- `ca.key` PEM encoded private key of the CA certificate

### `spec.sync.tls.altNames: []string`

This setting specifies a list of alternate names that will be added to all generated
certificates. These names can be DNS names or email addresses.
The default value is empty.

### `spec.sync.monitoring.tokenSecretName: string`
Expand Down