Turn on TLS by default

Author: ewoutp

docs/user/custom_resource.md

@@ -142,7 +142,8 @@ and restarting it.
 This setting specifies the name of a kubernetes `Secret` that contains
 a standard CA certificate + private key used to sign certificates for individual
 ArangoDB servers.
-The default value is empty. TBD
+When no name is specified, it defaults to `<deployment-name>-ca`.
+To disable authentication, set this value to `None`.
 
 If you specify a name of a `Secret` that does not exist, a self-signed CA certificate + key is created
 and stored in a `Secret` with given name.

docs/user/tls.md

@@ -1,11 +1,13 @@
 # TLS
 
-The ArangoDB operator allows you to create ArangoDB deployments that use
+The ArangoDB operator will by default create ArangoDB deployments that use
 secure TLS connections.
 
 It uses a single CA certificate (stored in a Kubernetes secret) and
 one certificate per ArangoDB server (stored in a Kubernetes secret per server).
 
+To disable TLS, set `spec.tls.caSecretName` to `None`.
+
 ## Install CA certificate
 
 If the CA certificate is self-signed, it will not be trusted by browsers,

examples/simple-cluster-no-tls.yaml

@@ -0,0 +1,8 @@
+apiVersion: "database.arangodb.com/v1alpha"
+kind: "ArangoDeployment"
+metadata:
+  name: "example-simple-cluster-no-tls"
+spec:
+  mode: cluster
+  tls:
+    caSecretName: None

examples/simple-cluster-tls.yaml

@@ -92,7 +92,7 @@ func (s *DeploymentSpec) SetDefaults(deploymentName string) {
 	}
 	s.RocksDB.SetDefaults()
 	s.Authentication.SetDefaults(deploymentName + "-jwt")
-	s.TLS.SetDefaults("")
+	s.TLS.SetDefaults(deploymentName + "-ca")
 	s.Sync.SetDefaults(s.Image, s.ImagePullPolicy, deploymentName+"-sync-jwt", deploymentName+"-sync-ca")
 	s.Single.SetDefaults(ServerGroupSingle, s.Mode.HasSingleServers(), s.Mode)
 	s.Agents.SetDefaults(ServerGroupAgents, s.Mode.HasAgents(), s.Mode)

pkg/apis/deployment/v1alpha/deployment_spec.go

@@ -42,9 +42,14 @@ type TLSSpec struct {
 	TTL          time.Duration `json:"ttl,omitempty"`
 }
 
+const (
+	// CASecretNameDisabled is the value of CASecretName to use for disabling authentication.
+	CASecretNameDisabled = "None"
+)
+
 // IsSecure returns true when a CA secret has been set, false otherwise.
 func (s TLSSpec) IsSecure() bool {
-	return s.CASecretName != ""
+	return s.CASecretName != CASecretNameDisabled
 }
 
 // GetAltNames splits the list of AltNames into DNS names, IP addresses & email addresses.

pkg/apis/deployment/v1alpha/tls_spec.go

@@ -43,8 +43,9 @@ func TestTLSSpecValidate(t *testing.T) {
 }
 
 func TestTLSSpecIsSecure(t *testing.T) {
-	assert.False(t, TLSSpec{CASecretName: ""}.IsSecure())
+	assert.True(t, TLSSpec{CASecretName: ""}.IsSecure())
 	assert.True(t, TLSSpec{CASecretName: "foo"}.IsSecure())
+	assert.False(t, TLSSpec{CASecretName: "None"}.IsSecure())
 }
 
 func TestTLSSpecSetDefaults(t *testing.T) {