Skip to content

Commit 401e6eb

Browse files
ewoutpewoutp
authored
Merge pull request #51 from arangodb/tls-auto-on
Turn on TLS by default
2 parents fd7b559 + 3300f35 commit 401e6eb

File tree

12 files changed

+145
-98
lines changed

12 files changed

+145
-98
lines changed

‎docs/user/custom_resource.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,8 @@ and restarting it.
142142
This setting specifies the name of a kubernetes `Secret` that contains
143143
a standard CA certificate + private key used to sign certificates for individual
144144
ArangoDB servers.
145-
The default value is empty. TBD
145+
When no name is specified, it defaults to `<deployment-name>-ca`.
146+
To disable authentication, set this value to `None`.
146147

147148
If you specify a name of a `Secret` that does not exist, a self-signed CA certificate + key is created
148149
and stored in a `Secret` with given name.

‎docs/user/tls.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# TLS
22

3-
The ArangoDB operator allows you to create ArangoDB deployments that use
3+
The ArangoDB operator will by default create ArangoDB deployments that use
44
secure TLS connections.
55

66
It uses a single CA certificate (stored in a Kubernetes secret) and
77
one certificate per ArangoDB server (stored in a Kubernetes secret per server).
88

9+
To disable TLS, set `spec.tls.caSecretName` to `None`.
10+
911
## Install CA certificate
1012

1113
If the CA certificate is self-signed, it will not be trusted by browsers,

‎examples/simple-cluster-no-tls.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: "database.arangodb.com/v1alpha"
2+
kind: "ArangoDeployment"
3+
metadata:
4+
name: "example-simple-cluster-no-tls"
5+
spec:
6+
mode: cluster
7+
tls:
8+
caSecretName: None

‎examples/simple-cluster-tls.yaml‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎pkg/apis/deployment/v1alpha/deployment_spec.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ func (s *DeploymentSpec) SetDefaults(deploymentName string) {
9292
}
9393
s.RocksDB.SetDefaults()
9494
s.Authentication.SetDefaults(deploymentName + "-jwt")
95-
s.TLS.SetDefaults("")
95+
s.TLS.SetDefaults(deploymentName + "-ca")
9696
s.Sync.SetDefaults(s.Image, s.ImagePullPolicy, deploymentName+"-sync-jwt", deploymentName+"-sync-ca")
9797
s.Single.SetDefaults(ServerGroupSingle, s.Mode.HasSingleServers(), s.Mode)
9898
s.Agents.SetDefaults(ServerGroupAgents, s.Mode.HasAgents(), s.Mode)

‎pkg/apis/deployment/v1alpha/tls_spec.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,14 @@ type TLSSpec struct {
4242
TTL time.Duration `json:"ttl,omitempty"`
4343
}
4444

45+
const (
46+
// CASecretNameDisabled is the value of CASecretName to use for disabling authentication.
47+
CASecretNameDisabled = "None"
48+
)
49+
4550
// IsSecure returns true when a CA secret has been set, false otherwise.
4651
func (s TLSSpec) IsSecure() bool {
47-
return s.CASecretName != ""
52+
return s.CASecretName != CASecretNameDisabled
4853
}
4954

5055
// GetAltNames splits the list of AltNames into DNS names, IP addresses & email addresses.

‎pkg/apis/deployment/v1alpha/tls_spec_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,9 @@ func TestTLSSpecValidate(t *testing.T) {
4343
}
4444

4545
func TestTLSSpecIsSecure(t *testing.T) {
46-
assert.False(t, TLSSpec{CASecretName: ""}.IsSecure())
46+
assert.True(t, TLSSpec{CASecretName: ""}.IsSecure())
4747
assert.True(t, TLSSpec{CASecretName: "foo"}.IsSecure())
48+
assert.False(t, TLSSpec{CASecretName: "None"}.IsSecure())
4849
}
4950

5051
func TestTLSSpecSetDefaults(t *testing.T) {

‎pkg/deployment/pod_creator_agent_args_test.go‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,9 @@ func TestCreateArangodArgsAgent(t *testing.T) {
5454
assert.Equal(t,
5555
[]string{
5656
"--agency.activate=true",
57-
"--agency.endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
58-
"--agency.endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
59-
"--agency.my-address=tcp://name-agent-a1.name-int.ns.svc:8529",
57+
"--agency.endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
58+
"--agency.endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
59+
"--agency.my-address=ssl://name-agent-a1.name-int.ns.svc:8529",
6060
"--agency.size=3",
6161
"--agency.supervision=true",
6262
"--cluster.my-id=a1",
@@ -65,16 +65,18 @@ func TestCreateArangodArgsAgent(t *testing.T) {
6565
"--log.level=INFO",
6666
"--log.output=+",
6767
"--server.authentication=true",
68-
"--server.endpoint=tcp://[::]:8529",
68+
"--server.endpoint=ssl://[::]:8529",
6969
"--server.jwt-secret=$(ARANGOD_JWT_SECRET)",
7070
"--server.statistics=false",
7171
"--server.storage-engine=rocksdb",
72+
"--ssl.ecdh-curve=",
73+
"--ssl.keyfile=/secrets/tls/tls.keyfile",
7274
},
7375
cmdline,
7476
)
7577
}
7678

77-
// Default+TLS deployment
79+
// Default+TLS disabled deployment
7880
{
7981
apiObject := &api.ArangoDeployment{
8082
ObjectMeta: metav1.ObjectMeta{
@@ -84,7 +86,7 @@ func TestCreateArangodArgsAgent(t *testing.T) {
8486
Spec: api.DeploymentSpec{
8587
Mode: api.DeploymentModeCluster,
8688
TLS: api.TLSSpec{
87-
CASecretName: "test-ca",
89+
CASecretName: "None",
8890
},
8991
},
9092
}
@@ -98,9 +100,9 @@ func TestCreateArangodArgsAgent(t *testing.T) {
98100
assert.Equal(t,
99101
[]string{
100102
"--agency.activate=true",
101-
"--agency.endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
102-
"--agency.endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
103-
"--agency.my-address=ssl://name-agent-a1.name-int.ns.svc:8529",
103+
"--agency.endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
104+
"--agency.endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
105+
"--agency.my-address=tcp://name-agent-a1.name-int.ns.svc:8529",
104106
"--agency.size=3",
105107
"--agency.supervision=true",
106108
"--cluster.my-id=a1",
@@ -109,12 +111,10 @@ func TestCreateArangodArgsAgent(t *testing.T) {
109111
"--log.level=INFO",
110112
"--log.output=+",
111113
"--server.authentication=true",
112-
"--server.endpoint=ssl://[::]:8529",
114+
"--server.endpoint=tcp://[::]:8529",
113115
"--server.jwt-secret=$(ARANGOD_JWT_SECRET)",
114116
"--server.statistics=false",
115117
"--server.storage-engine=rocksdb",
116-
"--ssl.ecdh-curve=",
117-
"--ssl.keyfile=/secrets/tls/tls.keyfile",
118118
},
119119
cmdline,
120120
)
@@ -143,9 +143,9 @@ func TestCreateArangodArgsAgent(t *testing.T) {
143143
assert.Equal(t,
144144
[]string{
145145
"--agency.activate=true",
146-
"--agency.endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
147-
"--agency.endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
148-
"--agency.my-address=tcp://name-agent-a1.name-int.ns.svc:8529",
146+
"--agency.endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
147+
"--agency.endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
148+
"--agency.my-address=ssl://name-agent-a1.name-int.ns.svc:8529",
149149
"--agency.size=3",
150150
"--agency.supervision=true",
151151
"--cluster.my-id=a1",
@@ -154,9 +154,11 @@ func TestCreateArangodArgsAgent(t *testing.T) {
154154
"--log.level=INFO",
155155
"--log.output=+",
156156
"--server.authentication=false",
157-
"--server.endpoint=tcp://[::]:8529",
157+
"--server.endpoint=ssl://[::]:8529",
158158
"--server.statistics=false",
159159
"--server.storage-engine=mmfiles",
160+
"--ssl.ecdh-curve=",
161+
"--ssl.keyfile=/secrets/tls/tls.keyfile",
160162
},
161163
cmdline,
162164
)
@@ -184,9 +186,9 @@ func TestCreateArangodArgsAgent(t *testing.T) {
184186
assert.Equal(t,
185187
[]string{
186188
"--agency.activate=true",
187-
"--agency.endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
188-
"--agency.endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
189-
"--agency.my-address=tcp://name-agent-a1.name-int.ns.svc:8529",
189+
"--agency.endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
190+
"--agency.endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
191+
"--agency.my-address=ssl://name-agent-a1.name-int.ns.svc:8529",
190192
"--agency.size=3",
191193
"--agency.supervision=true",
192194
"--cluster.my-id=a1",
@@ -195,10 +197,12 @@ func TestCreateArangodArgsAgent(t *testing.T) {
195197
"--log.level=INFO",
196198
"--log.output=+",
197199
"--server.authentication=true",
198-
"--server.endpoint=tcp://[::]:8529",
200+
"--server.endpoint=ssl://[::]:8529",
199201
"--server.jwt-secret=$(ARANGOD_JWT_SECRET)",
200202
"--server.statistics=false",
201203
"--server.storage-engine=rocksdb",
204+
"--ssl.ecdh-curve=",
205+
"--ssl.keyfile=/secrets/tls/tls.keyfile",
202206
"--foo1",
203207
"--foo2",
204208
},

‎pkg/deployment/pod_creator_coordinator_args_test.go‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -53,27 +53,29 @@ func TestCreateArangodArgsCoordinator(t *testing.T) {
5353
cmdline := createArangodArgs(apiObject, apiObject.Spec, api.ServerGroupCoordinators, apiObject.Spec.Coordinators, agents, "id1")
5454
assert.Equal(t,
5555
[]string{
56-
"--cluster.agency-endpoint=tcp://name-agent-a1.name-int.ns.svc:8529",
57-
"--cluster.agency-endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
58-
"--cluster.agency-endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
59-
"--cluster.my-address=tcp://name-coordinator-id1.name-int.ns.svc:8529",
56+
"--cluster.agency-endpoint=ssl://name-agent-a1.name-int.ns.svc:8529",
57+
"--cluster.agency-endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
58+
"--cluster.agency-endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
59+
"--cluster.my-address=ssl://name-coordinator-id1.name-int.ns.svc:8529",
6060
"--cluster.my-id=id1",
6161
"--cluster.my-role=COORDINATOR",
6262
"--database.directory=/data",
6363
"--foxx.queues=true",
6464
"--log.level=INFO",
6565
"--log.output=+",
6666
"--server.authentication=true",
67-
"--server.endpoint=tcp://[::]:8529",
67+
"--server.endpoint=ssl://[::]:8529",
6868
"--server.jwt-secret=$(ARANGOD_JWT_SECRET)",
6969
"--server.statistics=true",
7070
"--server.storage-engine=rocksdb",
71+
"--ssl.ecdh-curve=",
72+
"--ssl.keyfile=/secrets/tls/tls.keyfile",
7173
},
7274
cmdline,
7375
)
7476
}
7577

76-
// Default+TLS deployment
78+
// Default+TLS disabled deployment
7779
{
7880
apiObject := &api.ArangoDeployment{
7981
ObjectMeta: metav1.ObjectMeta{
@@ -83,7 +85,7 @@ func TestCreateArangodArgsCoordinator(t *testing.T) {
8385
Spec: api.DeploymentSpec{
8486
Mode: api.DeploymentModeCluster,
8587
TLS: api.TLSSpec{
86-
CASecretName: "test-ca",
88+
CASecretName: "None",
8789
},
8890
},
8991
}
@@ -96,23 +98,21 @@ func TestCreateArangodArgsCoordinator(t *testing.T) {
9698
cmdline := createArangodArgs(apiObject, apiObject.Spec, api.ServerGroupCoordinators, apiObject.Spec.Coordinators, agents, "id1")
9799
assert.Equal(t,
98100
[]string{
99-
"--cluster.agency-endpoint=ssl://name-agent-a1.name-int.ns.svc:8529",
100-
"--cluster.agency-endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
101-
"--cluster.agency-endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
102-
"--cluster.my-address=ssl://name-coordinator-id1.name-int.ns.svc:8529",
101+
"--cluster.agency-endpoint=tcp://name-agent-a1.name-int.ns.svc:8529",
102+
"--cluster.agency-endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
103+
"--cluster.agency-endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
104+
"--cluster.my-address=tcp://name-coordinator-id1.name-int.ns.svc:8529",
103105
"--cluster.my-id=id1",
104106
"--cluster.my-role=COORDINATOR",
105107
"--database.directory=/data",
106108
"--foxx.queues=true",
107109
"--log.level=INFO",
108110
"--log.output=+",
109111
"--server.authentication=true",
110-
"--server.endpoint=ssl://[::]:8529",
112+
"--server.endpoint=tcp://[::]:8529",
111113
"--server.jwt-secret=$(ARANGOD_JWT_SECRET)",
112114
"--server.statistics=true",
113115
"--server.storage-engine=rocksdb",
114-
"--ssl.ecdh-curve=",
115-
"--ssl.keyfile=/secrets/tls/tls.keyfile",
116116
},
117117
cmdline,
118118
)
@@ -139,20 +139,22 @@ func TestCreateArangodArgsCoordinator(t *testing.T) {
139139
cmdline := createArangodArgs(apiObject, apiObject.Spec, api.ServerGroupCoordinators, apiObject.Spec.Coordinators, agents, "id1")
140140
assert.Equal(t,
141141
[]string{
142-
"--cluster.agency-endpoint=tcp://name-agent-a1.name-int.ns.svc:8529",
143-
"--cluster.agency-endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
144-
"--cluster.agency-endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
145-
"--cluster.my-address=tcp://name-coordinator-id1.name-int.ns.svc:8529",
142+
"--cluster.agency-endpoint=ssl://name-agent-a1.name-int.ns.svc:8529",
143+
"--cluster.agency-endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
144+
"--cluster.agency-endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
145+
"--cluster.my-address=ssl://name-coordinator-id1.name-int.ns.svc:8529",
146146
"--cluster.my-id=id1",
147147
"--cluster.my-role=COORDINATOR",
148148
"--database.directory=/data",
149149
"--foxx.queues=true",
150150
"--log.level=INFO",
151151
"--log.output=+",
152152
"--server.authentication=false",
153-
"--server.endpoint=tcp://[::]:8529",
153+
"--server.endpoint=ssl://[::]:8529",
154154
"--server.statistics=true",
155155
"--server.storage-engine=rocksdb",
156+
"--ssl.ecdh-curve=",
157+
"--ssl.keyfile=/secrets/tls/tls.keyfile",
156158
},
157159
cmdline,
158160
)
@@ -180,21 +182,23 @@ func TestCreateArangodArgsCoordinator(t *testing.T) {
180182
cmdline := createArangodArgs(apiObject, apiObject.Spec, api.ServerGroupCoordinators, apiObject.Spec.Coordinators, agents, "id1")
181183
assert.Equal(t,
182184
[]string{
183-
"--cluster.agency-endpoint=tcp://name-agent-a1.name-int.ns.svc:8529",
184-
"--cluster.agency-endpoint=tcp://name-agent-a2.name-int.ns.svc:8529",
185-
"--cluster.agency-endpoint=tcp://name-agent-a3.name-int.ns.svc:8529",
186-
"--cluster.my-address=tcp://name-coordinator-id1.name-int.ns.svc:8529",
185+
"--cluster.agency-endpoint=ssl://name-agent-a1.name-int.ns.svc:8529",
186+
"--cluster.agency-endpoint=ssl://name-agent-a2.name-int.ns.svc:8529",
187+
"--cluster.agency-endpoint=ssl://name-agent-a3.name-int.ns.svc:8529",
188+
"--cluster.my-address=ssl://name-coordinator-id1.name-int.ns.svc:8529",
187189
"--cluster.my-id=id1",
188190
"--cluster.my-role=COORDINATOR",
189191
"--database.directory=/data",
190192
"--foxx.queues=true",
191193
"--log.level=INFO",
192194
"--log.output=+",
193195
"--server.authentication=true",
194-
"--server.endpoint=tcp://[::]:8529",
196+
"--server.endpoint=ssl://[::]:8529",
195197
"--server.jwt-secret=$(ARANGOD_JWT_SECRET)",
196198
"--server.statistics=true",
197199
"--server.storage-engine=mmfiles",
200+
"--ssl.ecdh-curve=",
201+
"--ssl.keyfile=/secrets/tls/tls.keyfile",
198202
"--foo1",
199203
"--foo2",
200204
},

0 commit comments

Comments
 (0)