Feature: Configuring rest components for TLS #622

Johnaius · 2025-02-05T17:43:41Z

This pull request introduces the configuration of certificates for TLS in REST
before enabling TLS, changes to control plane will have to be pulled in as well. I will link PR here

Description

REST API Component:

TLS Configuration:

Added support for enabling TLS by configuring certificate paths and volume mounts.
Removed the --dummy-certificates argument when TLS is enabled.
Introduced new command-line arguments for specifying certificate and key files.
Included configuration to mount the CA certificate for client verification with core agent (commented out for now).

CSI and Diskpool Operator:

Added support for reading CA certificate and configuring TLS for HTTPS endpoints.
Introduced new command-line arguments for specifying the CA certificate file path.

Values.yaml:

Added enable TLS switch. And configured components to only load tls info when enabled.

Certs/Secrets :

Introduced a script to create certificates and a Kubernetes Secret for testing purposes.
Further discussion needed on how certificate deployment will be handled (e.g., using cert-manager or manual setup).

Motivation and Context

These changes enhance the security of the REST API, CSI, and Diskpool Operator components by enabling TLS communication, ensuring secure data transmission

How Has This Been Tested?

I have deployed these changes along with the changes I implemented in the control plane to an AKS cluster. I need some direction on how to appropriately test.

Types of changes

Bug fix (non-breaking change which fixes an issue)
[x ] New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

My code follows the code style of this project.
My change requires a change to the documentation.
I have updated the documentation accordingly.
I have added unit tests to cover my changes.

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

tiagolobocastro

I think call-home also needs to have the certificate?
Also, the kubectl plugin?

tiagolobocastro · 2025-02-07T22:50:40Z

chart/charts/crds/templates/cert-manager.crds.yaml

@@ -0,0 +1,4163 @@
+# Source: cert-manager/templates/templates.out


Do we need to apply the CRDs? Are they not installed via cert-manager itself?
Handling CRDs via helm has been painful in the past

Do you remember what the pain points were and why? I'll look into it, cert-manager installs fine without any certificate or issuer etc. resources being created. But when attempting to deploy with certs in the chart I was seeing errors where these resources were attempting to be created before the CRDs were installed.

I think mostly to do with updates of the CRD. CC @niladrih and @Abhinandan-Purkait

But when attempting to deploy with certs in the chart I was seeing errors where these resources were attempting to be created before the CRDs were installed.

Yeah, makes sense..
What were the resources being created? Is it something we can configure to be done by the pods rather than via helm?

I'm trying to create issuer and certificate resources. We will create a root cert file and seperate files for each cert. I created a new branch here where i'm working on getting cert-manager installed as a subchart as well as certificates. You can see the server-root-cert and rest api cert here

tiagolobocastro · 2025-02-07T22:52:02Z

scripts/certs.sh

+NAMESPACE="openebs"
+APP_NAME="api-rest"


This would have to be configurable?

for clarification, I created this cert file for testing purposes only until we get cert-manager installed... The plan is to not rely on this script and to use cert-manager to create all the certs. I am open to discuss and direction on this.

Fair enough, though might be worth keeping for devel

tiagolobocastro · 2025-02-07T22:52:54Z

scripts/certs.sh

+# Create a self-signed root CA
+echo "Creating a self-signed root CA"
+openssl genrsa -out "${CERT_DIR}/ca.key" 4096
+openssl req -x509 -new -nodes -key "${CERT_DIR}/ca.key" -sha256 -days 3650 -out "${CERT_DIR}/ca.crt" -subj "/CN=api-rest-ca" -addext "subjectAltName=DNS:${NAMESPACE}-${APP_NAME}-${NAMESPACE}.svc.cluster.local,DNS:${NAMESPACE}-${APP_NAME},DNS:${NAMESPACE}-${APP_NAME}-${NAMESPACE}.svc"


cluster.local needs to be configurable?

scripts/certs.sh

Abhinandan-Purkait · 2025-02-10T04:10:57Z

scripts/certs.sh

+echo "Creating a TLS certificate for the API REST"
+openssl genrsa -out "${CERT_DIR}/server.key" 4096
+openssl req -new -key "${CERT_DIR}/server.key" -out "${CERT_DIR}/server.csr" -subj "/CN=${NAMESPACE}-${APP_NAME}" -addext "subjectAltName=DNS:${NAMESPACE}-${APP_NAME}-${NAMESPACE}.svc.cluster.local,DNS:${NAMESPACE}-${APP_NAME},DNS:${NAMESPACE}-${APP_NAME}-${NAMESPACE}.svc"
+openssl x509 -req -in "${CERT_DIR}/server.csr" -CA "${CERT_DIR}/ca.crt" -CAkey "${CERT_DIR}/ca.key" -CAcreateserial -out "${CERT_DIR}/server.crt" -days 3650 -sha256 -extfile <(printf "subjectAltName=DNS:${NAMESPACE}-${APP_NAME}-${NAMESPACE}.svc.cluster.local,DNS:${NAMESPACE}-${APP_NAME},DNS:${NAMESPACE}-${APP_NAME}-${NAMESPACE}.svc")


Should the time period be configurable?

tiagolobocastro · 2025-02-10T11:49:47Z

chart/Chart.yaml

+    version: v1.17.0
+    repository: https://charts.jetstack.io
+    alias: cert-manager
+    condition: base.cert-manager.enabled


Not sure why we had used base for jaeger, but seems since then we've used the actual name, eg: loki-stack.
So maybe let's use the actual name?

Suggested change

condition: base.cert-manager.enabled

condition: cert-manager.enabled

tiagolobocastro · 2025-02-10T11:52:26Z

chart/charts/crds/templates/cert-manager.crds.yaml

@@ -0,0 +1,4163 @@
+# Source: cert-manager/templates/templates.out


I think mostly to do with updates of the CRD. CC @niladrih and @Abhinandan-Purkait

But when attempting to deploy with certs in the chart I was seeing errors where these resources were attempting to be created before the CRDs were installed.

Yeah, makes sense..
What were the resources being created? Is it something we can configure to be done by the pods rather than via helm?

chart/templates/mayastor/apis/api-rest-deployment.yaml

dsharma-dc · 2025-02-11T06:47:11Z

scripts/README.md

+1. Push images from [rest_tls][rest_tls] branch on control plane.
+    - ```./scripts/release.sh --registry <registry url> --alias-tag <tag> --image rest operators.diskpool csi.controller```
+1. Enable TLS in values.yaml [here][enableTls].
+1. With cluster in current context, run certs.sh from scripts dir. This will create certs and ultimately a kubernetes secret containing those certs.


If someone intends to use CA certificates instead of self signed, can we have a provision to create Secrets with that?

I think we will use self-signed certs as default. If user's want to use their own cert-manager install they will need to make sure that mayastor cert-manager is disabled. We should document how to configure in this case

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

Johnaius · 2025-02-13T23:27:45Z

I think call-home also needs to have the certificate? Also, the kubectl plugin?

I just added configurations for callhome. Not sure how I can get the certs to the kubectl plugin on first glance, I see this but where are the args being passed in?

Johnaius · 2025-02-13T23:33:29Z

Looks like csi-node will need to be configured as well

tiagolobocastro · 2025-02-13T23:33:41Z

I think call-home also needs to have the certificate? Also, the kubectl plugin?

I just added configurations for callhome. Not sure how I can get the certs to the kubectl plugin on first glance, I see this but where are the args being passed in?

That's using a separate crate as it's going via the apiserver.
We have two crates for this, kube-forward and kube-proxy, here.

Johnaius mentioned this pull request Feb 5, 2025

Feature: Configuring rest components for TLS openebs/mayastor-control-plane#927

Open

John Zakrzewski added 4 commits February 5, 2025 14:24

adding cert-manager

3ffa6a9

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

configure tls for REST

8f40818

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

update script to include DNS names

2cc503b

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

disable tls in values.yaml, remove cert-manager

dd8095a

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

Johnaius force-pushed the tls branch 2 times, most recently from 9b6796d to e81716c Compare February 5, 2025 20:40

adding readme

37653b4

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

Johnaius force-pushed the tls branch from e81716c to 37653b4 Compare February 5, 2025 20:41

Johnaius mentioned this pull request Feb 6, 2025

Enable TLS in Mayastor openebs/openebs#3855

Open

feat: cert-manager-install

47b5a17

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

tiagolobocastro reviewed Feb 7, 2025

View reviewed changes

Abhinandan-Purkait reviewed Feb 10, 2025

View reviewed changes

tiagolobocastro reviewed Feb 10, 2025

View reviewed changes

dsharma-dc reviewed Feb 11, 2025

View reviewed changes

feat: configure callhome for tls with restapi

4f4b5bc

Signed-off-by: John Zakrzewski <Jozakrzewski@microsoft.com>

Johnaius requested review from a team as code owners February 13, 2025 23:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: Configuring rest components for TLS #622

Feature: Configuring rest components for TLS #622

Johnaius commented Feb 5, 2025 •

edited

Loading

tiagolobocastro left a comment

tiagolobocastro Feb 7, 2025

Johnaius Feb 8, 2025

tiagolobocastro Feb 10, 2025

Johnaius Feb 11, 2025 •

edited

Loading

tiagolobocastro Feb 7, 2025

Johnaius Feb 11, 2025

tiagolobocastro Feb 12, 2025

tiagolobocastro Feb 7, 2025

Abhinandan-Purkait Feb 10, 2025

tiagolobocastro Feb 10, 2025

tiagolobocastro Feb 10, 2025

dsharma-dc Feb 11, 2025

Johnaius Feb 13, 2025

Johnaius commented Feb 13, 2025

Johnaius commented Feb 13, 2025

tiagolobocastro commented Feb 13, 2025

		@@ -0,0 +1,4163 @@
		# Source: cert-manager/templates/templates.out

	condition: base.cert-manager.enabled
	condition: cert-manager.enabled

		NAMESPACE="openebs"
		APP_NAME="api-rest"

Feature: Configuring rest components for TLS #622

Are you sure you want to change the base?

Feature: Configuring rest components for TLS #622

Conversation

Johnaius commented Feb 5, 2025 • edited Loading

Description

REST API Component:

CSI and Diskpool Operator:

Values.yaml:

Certs/Secrets :

Motivation and Context

How Has This Been Tested?

Types of changes

Checklist:

tiagolobocastro left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Johnaius Feb 11, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Johnaius commented Feb 13, 2025

Johnaius commented Feb 13, 2025

tiagolobocastro commented Feb 13, 2025

Johnaius commented Feb 5, 2025 •

edited

Loading

Johnaius Feb 11, 2025 •

edited

Loading