Skip to content

Commit 730c4b0

Browse files
mikhail-klimkomikhail-klimko
authored
onprem: redis mtls (#997)
1 parent c8ca6bb commit 730c4b0

File tree

5 files changed

+158
-38
lines changed

5 files changed

+158
-38
lines changed

‎codefresh/.ci/values/mongodb-mtls.yaml‎ renamed to ‎codefresh/.ci/values/mtls-mongodb-redis.yaml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,49 @@ global:
99
mongoURI: "mongodb://cf-mongodb:27017/?ssl=true&authMechanism=MONGODB-X509&authSource=$external"
1010
runtimeMongoURI: "mongodb://cf-mongodb:27017/?ssl=true&authMechanism=MONGODB-X509&authSource=$external"
1111

12+
redisUrl: cf-redis-master.codefresh.svc.cluster.local
13+
runtimeRedisHost: cf-redis-master.codefresh.svc.cluster.local
14+
1215
volumes:
1316
mongodb-tls:
1417
enabled: true
1518
type: secret
1619
optional: true
1720
nameOverride: cf-codefresh-mongodb-tls
21+
redis-tls:
22+
enabled: true
23+
type: secret
24+
optional: true
25+
nameOverride: cf-redis-crt
1826

1927
volumeMounts:
2028
mongodb-tls:
2129
path:
2230
- mountPath: /etc/ssl/mongodb/ca.pem
2331
subPath: ca.pem
32+
redis-tls:
33+
path:
34+
- mountPath: /etc/ssl/redis
35+
2436
env:
37+
# Mongo MTLS
2538
MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
2639
RUNTIME_MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
2740
RUNTIME_MONGO_TLS: "true"
2841
RUNTIME_MONGO_TLS_VALIDATE: "false"
2942
MONGO_MTLS_VALIDATE: "false"
43+
# Redis MTLS
44+
REDIS_TLS: true
45+
REDIS_REJECT_UNAUTHORIZED: false
46+
REDIS_TLS_SKIP_VERIFY: true
47+
REDIS_CA_PATH: /etc/ssl/redis/ca.crt
48+
REDIS_CLIENT_CERT_PATH : /etc/ssl/redis/tls.crt
49+
REDIS_CLIENT_KEY_PATH: /etc/ssl/redis/tls.key
3050

3151
ingress:
3252
enabled: true
3353
tls:
34-
enabled: false
54+
enabled: true
3555
cert: "" # placeholder for ${WEB_TLS_CERT}
3656
key: "" # placeholder for ${WEB_TLS_KEY}
3757

@@ -85,6 +105,12 @@ mongodb:
85105
caKey: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBdVdKYkFkUGozMXJqZno1Qjl5a3RMbnhRNXFWYW41VEYxaFhRSHAxVDBUUDA4aWMzCkRhNitQbVJ6dTJaSTdWRTFERUZCWHFMeXdCZkErcmZsbFZlN2pyekZNVVliVzhBeUdRMFBuM1pYQ3NUZ2dFbEwKYWhiZ1ROQnM0YXFYQjhDT3d1QlI0WHNDVzJjOFF6YlJFTEdMZnc3aC9oTzh4M00rT0VlUnd4Snd1R3hwdmg3cgo2WS9qUkVDa1lxeUdsWi9TZlBiV3I1Zzd0K2ZUcmxmRENoQStqODlpUUFxNXdaOHlvWDJacTBGcUJQWlNrNFlkCmhDU093U2F3bVVPOGVWWk1ERG5yRmpGQTVPWVJWS0YxejBrUGQ5Y1VOVWJQOUpSc1ZZRG1lTThyOFArYkNLU0wKY05uOGZNZ1FPYWtnOGlvTU9VdUFmK3JPaXQ2Z0luYlM1dklHaFFJREFRQUJBb0lCQUNIQ3JxNHJoMkVpclRGOApCZ2xiMzFXSzREVFF3aXN6cmIrcUkwZWdBU2FsSHFPR3pyallMTjh4N2YyZnlBSW4rdEFyaGhzVTg3NVYxUmdUCnEyVENJRzhESTZvd2lVVHhRRzVkZVkzaHdFSSt6bCt1ZVdSdG5CV0JFNE1aVFAzbGJGcEMvY1poWDNHRDRHNmgKS2Z1dlNhY3U3NnNVcnhsbmZGcEZkbDhmR1pZTUlOOUNZWHArWWVJZzRuYW5ZSFJsbk1LM05QSjIzZUVHdkpjeQpLdUZWNndIUzFlWmg1M0J0aWRlY3czcmFzZFhJWmMzdFJidlFid3lDbjZ5dVlING0vUXJzMVFUckp2dzdyWU1sCkxyZGxlZm5uWk9XNFNVc3dINkVCWmF3RC9FTFc4eFNORVhudUkzUFp0di9oRVVZd3RKOVdMbk0rRitzc21ldm8KaHVGMUI5VUNnWUVBMFBHSmc2U3N6dHlKNkhyM0tTaEhyN3h5eVVPOVJTK0N3LzBSV2cranJ3SGFlRGRIalpvKwpaYXhxWVdoRUR0aUZieWpJdWR2MFF1aUZhMHVObDUvMGl3YXR2Tm81RitNZWV3WGt1T0YraWE3RFdFODk0a2ZECkVqYXJYWUk3ZkpnTkdxVmthWUw1cGdGcmxpUDhkZDFkK0VlTWV4dmJadTdwYUZzaXBaZWs1NE1DZ1lFQTR5S0cKdzAyMHJTTGRwdlYyQmE2WG4zbFRXUW0wMFlOaVFuY0YrVjJXNm95RjREK2liRUppTUdUZzRESzZLVllNVElpNQpmaVV4WHlib0Fkd1hvTlpqMmhPWmhmMVZSa3g1WGIrOVorbDV3ZFlBMGR4RmV1ajBDakpmd3p1UTNuOUxZOWxlCnJSSi91SklkbHhKWkx2Z0RLZzdRZ2NuNkJCN2Y1Ujlwa1JKaTgxY0NnWUJYZ2xITnlOSjNjUFp4WDg3VWRnSlEKSCtVVFZrT1hEbWIrSHFkOXlMOE5OUUdEQitQMzhubmZxMjZDaldDenR3dHJtdkUycG1DUEJVT2J4SER3NkJWTApoT2lQQi9hUmdwWHBnSFppMkU1ZTY4cjAyWHRab2lTWkpEeHhWWElFcE1vWU50enZNK1BMR3gwc0xMWTN4eGJzClBVc2c1SEhua25nL05LdzJIbVQ2Y1FLQmdEaW9lQzFueU5ZWGlHc0pkL05hNWYrbDZDQ2h4elVzTE9xZmZpSUMKTW84M2xuMmw0Z0pYWE43dGl4cmlESVliTE40NmpPcm1wRFkwSWxPMGIwQnp1bHkvM3VBSm5hZjNrNTdMSVpnMgpLV1VzMk8rQW51UldEK29yUHJBWXY3NkF5bkdSMjRnWXdUdHRWMnhENjNOSDhxSWZKK3Y0VWlHTkFoVEpqUy9mCkFrZnBBb0dBQ0pRS0lOU0hZOWN2RGZseWNWNmRCcndGS0hRb3oyZGg5Z0EvSjBGazYyc0VrNDY1SUtINm96VDQKQTlSZi8yMHBLZG40dmRnTktJQ3R1cUNKN1JIMC82bVRZWXUwSEJTWHo1elZIdWczTHpFbGxOdVB4MnRhc0x0MgpjdElsVkVrdk96L1hCa3BMVUE2TDlaR01Ha2tyeUJoNEdXd2FCajBHeldUQ2JMUGZ3N3c9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t"
86106
mode: allowTLS
87107

108+
redis:
109+
tls:
110+
enabled: true
111+
autoGenerated: true
112+
authClients: true
113+
88114
secrets:
89115
mongodb-tls:
90116
enabled: true

‎codefresh/Chart.lock‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -58,58 +58,58 @@ dependencies:
5858
version: 1.13.5
5959
- name: cfapi
6060
repository: https://chartmuseum.codefresh.io/cfapi
61-
version: 21.222.17
61+
version: 21.222.20
6262
- name: cfapi
6363
repository: https://chartmuseum.codefresh.io/cfapi
64-
version: 21.222.17
64+
version: 21.222.20
6565
- name: cfapi
6666
repository: https://chartmuseum.codefresh.io/cfapi
67-
version: 21.222.17
67+
version: 21.222.20
6868
- name: cfapi
6969
repository: https://chartmuseum.codefresh.io/cfapi
70-
version: 21.222.17
70+
version: 21.222.20
7171
- name: cfapi
7272
repository: https://chartmuseum.codefresh.io/cfapi
73-
version: 21.222.17
73+
version: 21.222.20
7474
- name: cfapi
7575
repository: https://chartmuseum.codefresh.io/cfapi
76-
version: 21.222.17
76+
version: 21.222.20
7777
- name: cfapi
7878
repository: https://chartmuseum.codefresh.io/cfapi
79-
version: 21.222.17
79+
version: 21.222.20
8080
- name: cfapi
8181
repository: https://chartmuseum.codefresh.io/cfapi
82-
version: 21.222.17
82+
version: 21.222.20
8383
- name: cfapi
8484
repository: https://chartmuseum.codefresh.io/cfapi
85-
version: 21.222.17
85+
version: 21.222.20
8686
- name: cfapi
8787
repository: https://chartmuseum.codefresh.io/cfapi
88-
version: 21.222.17
88+
version: 21.222.20
8989
- name: cfapi
9090
repository: https://chartmuseum.codefresh.io/cfapi
91-
version: 21.222.17
91+
version: 21.222.20
9292
- name: cfapi
9393
repository: https://chartmuseum.codefresh.io/cfapi
94-
version: 21.222.17
94+
version: 21.222.20
9595
- name: cfapi
9696
repository: https://chartmuseum.codefresh.io/cfapi
97-
version: 21.222.17
97+
version: 21.222.20
9898
- name: cfapi
9999
repository: https://chartmuseum.codefresh.io/cfapi
100-
version: 21.222.17
100+
version: 21.222.20
101101
- name: cfapi
102102
repository: https://chartmuseum.codefresh.io/cfapi
103-
version: 21.222.17
103+
version: 21.222.20
104104
- name: cfapi
105105
repository: https://chartmuseum.codefresh.io/cfapi
106-
version: 21.222.17
106+
version: 21.222.20
107107
- name: cfapi
108108
repository: https://chartmuseum.codefresh.io/cfapi
109-
version: 21.222.17
109+
version: 21.222.20
110110
- name: cfui
111111
repository: https://chartmuseum.codefresh.io/cfui
112-
version: 14.88.45
112+
version: 14.88.47
113113
- name: k8s-monitor
114114
repository: https://chartmuseum.codefresh.io/k8s-monitor
115115
version: 4.10.2
@@ -118,13 +118,13 @@ dependencies:
118118
version: 3.25.2
119119
- name: cf-broadcaster
120120
repository: https://chartmuseum.codefresh.io/cf-broadcaster
121-
version: 1.11.3
121+
version: 1.11.4
122122
- name: helm-repo-manager
123123
repository: https://chartmuseum.codefresh.io/helm-repo-manager
124124
version: 0.10.3
125125
- name: hermes
126126
repository: https://chartmuseum.codefresh.io/hermes
127-
version: 0.20.1
127+
version: 0.20.2
128128
- name: nomios
129129
repository: https://chartmuseum.codefresh.io/nomios
130130
version: 0.10.3
@@ -133,18 +133,18 @@ dependencies:
133133
version: 0.7.3
134134
- name: cf-platform-analytics
135135
repository: https://chartmuseum.codefresh.io/cf-platform-analytics
136-
version: 0.45.8
136+
version: 0.46.3
137137
- name: cf-platform-analytics
138138
repository: https://chartmuseum.codefresh.io/cf-platform-analytics
139-
version: 0.45.8
139+
version: 0.46.3
140140
- name: argo-platform
141141
repository: https://chartmuseum.codefresh.io/argo-platform
142-
version: 1.2258.0
142+
version: 1.2258.1
143143
- name: argo-hub-platform
144144
repository: https://chartmuseum.codefresh.io/argo-hub-platform
145145
version: 0.1.1
146146
- name: codefresh-tunnel-server
147147
repository: https://chartmuseum.codefresh.io/codefresh-tunnel-server
148148
version: 0.1.12
149-
digest: sha256:d86f9c468ccb49fa90dcd74dd70cbf6333671038ca9490dad1540a8076c4a51a
150-
generated: "2023-05-19T22:30:12.602319405+03:00"
149+
digest: sha256:a5cb5fc0ab5d508d46d1999e102ae9486d5c42d8bcbc1b11e85e779df3d4688c
150+
generated: "2023-05-22T12:07:12.977656719+03:00"

‎codefresh/Chart.yaml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
description: Helm Chart for Codefresh On-Prem
33
name: codefresh
4-
version: 2.0.0-alpha.12
4+
version: 2.0.0-alpha.13
55
keywords:
66
- codefresh
77
home: https://codefresh.io/
@@ -17,13 +17,9 @@ annotations:
1717
artifacthub.io/prerelease: "true"
1818
artifacthub.io/changes: |
1919
- kind: added
20-
description: Added MongoDB MTLS test case in CI
20+
description: Added Redis MTLS support
2121
- kind: changed
22-
description: Changed replicas number for broadcaster and hermes
23-
- kind: changed
24-
description: Bump cluster-providers, argo-platform, etc
25-
- kind: changed
26-
description: Updated mongo seed job script and job template
22+
description: Bump cf-api, cf-ui, argo-platform
2723
dependencies:
2824
- name: cf-common
2925
repository: https://chartmuseum.codefresh.io/cf-common

‎codefresh/README.md‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Codefresh On-Premises
22

3-
![Version: 2.0.0-alpha.12](https://img.shields.io/badge/Version-2.0.0--alpha.12-informational?style=flat-square) ![AppVersion: 2.0.0](https://img.shields.io/badge/AppVersion-2.0.0-informational?style=flat-square)
3+
![Version: 2.0.0-alpha.13](https://img.shields.io/badge/Version-2.0.0--alpha.13-informational?style=flat-square) ![AppVersion: 2.0.0](https://img.shields.io/badge/AppVersion-2.0.0-informational?style=flat-square)
44

55
## Table of Content
66

@@ -13,6 +13,7 @@
1313
- [External MongoDB with MTLS](#external-mongodb-with-mtls)
1414
- [External PostgresSQL](#external-postgressql)
1515
- [External Redis](#external-redis)
16+
- [External Redis with MTLS](#external-redis-with-mtls)
1617
- [External RabbitMQ](#external-rabbitmq)
1718
- [Configuring Ingress-NGINX](#configuring-ingress-nginx)
1819
- [ELB with SSL Termination (Classic Load Balancer)](#elb-with-ssl-termination-classic-load-balancer)
@@ -175,7 +176,7 @@ secrets:
175176
ca.pem: <base64 encoded sting>
176177
```
177178

178-
* Add `.Values.global.volumes` and `.Values.global.container.volumeMounts` to mount the secret into all the services.
179+
* Add `.Values.global.volumes` and `.Values.global.volumeMounts` to mount the secret into all the services.
179180
```yaml
180181
global:
181182
volumes:
@@ -196,7 +197,7 @@ global:
196197
MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
197198
RUNTIME_MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
198199
RUNTIME_MONGO_TLS: "true"
199-
# Set these var to 'false' if self-signed certificate is used to avoid x509 errors
200+
# Set these env vars to 'false' if self-signed certificate is used to avoid x509 errors
200201
RUNTIME_MONGO_TLS_VALIDATE: "false"
201202
MONGO_MTLS_VALIDATE: "false"
202203
```
@@ -258,6 +259,54 @@ redis:
258259

259260
```
260261

262+
#### External Redis with MTLS
263+
264+
In order to use [MTLS (Mutual TLS) for Redis](https://redis.io/docs/management/security/encryption/), you need:
265+
266+
* Create a K8S secret that contains the certificate (ca, certificate and private key).
267+
```console
268+
cat ca.crt tls.crt > tls.crt
269+
kubectl create secret tls my-redis-tls --cert=tls.crt --key=tls.key --dry-run=client -o yaml | kubectl apply -f -
270+
```
271+
272+
Or you can create certificate using templates provided in Codefresh Helm chart.
273+
Add `.Values.secrets` into `values.yaml` as follows.
274+
```yaml
275+
secrets:
276+
redis-tls:
277+
enabled: true
278+
data:
279+
ca.crt: <base64 encoded string>
280+
tls.crt: <base64 encoded string>
281+
tls.key: <base64 encoded string>
282+
```
283+
284+
* Add `.Values.global.volumes` and `.Values.global.volumeMounts` to mount the secret into all the services.
285+
```yaml
286+
global:
287+
volumes:
288+
redis-tls:
289+
enabled: true
290+
type: secret
291+
# Existing secret with TLS certificates (keys: `ca.crt` , `tls.crt`, `tls.key`)
292+
# existingName: my-redis-tls
293+
optional: true
294+
295+
volumeMounts:
296+
redis-tls:
297+
path:
298+
- mountPath: /etc/ssl/redis
299+
300+
env:
301+
REDIS_TLS: true
302+
REDIS_CA_PATH: /etc/ssl/redis/ca.crt
303+
REDIS_CLIENT_CERT_PATH : /etc/ssl/redis/tls.crt
304+
REDIS_CLIENT_KEY_PATH: /etc/ssl/redis/tls.key
305+
# Set these env vars like that if self-signed certificate is used to avoid x509 errors
306+
REDIS_REJECT_UNAUTHORIZED: false
307+
REDIS_TLS_SKIP_VERIFY: true
308+
```
309+
261310
#### External RabbitMQ
262311
263312
**Important:** Recommended version of RabbitMQ is 3.x

‎codefresh/README.md.gotmpl‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
- [External MongoDB with MTLS](#external-mongodb-with-mtls)
1414
- [External PostgresSQL](#external-postgressql)
1515
- [External Redis](#external-redis)
16+
- [External Redis with MTLS](#external-redis-with-mtls)
1617
- [External RabbitMQ](#external-rabbitmq)
1718
- [Configuring Ingress-NGINX](#configuring-ingress-nginx)
1819
- [ELB with SSL Termination (Classic Load Balancer)](#elb-with-ssl-termination-classic-load-balancer)
@@ -177,7 +178,7 @@ secrets:
177178
ca.pem: <base64 encoded sting>
178179
```
179180

180-
* Add `.Values.global.volumes` and `.Values.global.container.volumeMounts` to mount the secret into all the services.
181+
* Add `.Values.global.volumes` and `.Values.global.volumeMounts` to mount the secret into all the services.
181182
```yaml
182183
global:
183184
volumes:
@@ -198,7 +199,7 @@ global:
198199
MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
199200
RUNTIME_MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
200201
RUNTIME_MONGO_TLS: "true"
201-
# Set these var to 'false' if self-signed certificate is used to avoid x509 errors
202+
# Set these env vars to 'false' if self-signed certificate is used to avoid x509 errors
202203
RUNTIME_MONGO_TLS_VALIDATE: "false"
203204
MONGO_MTLS_VALIDATE: "false"
204205
```
@@ -260,6 +261,54 @@ redis:
260261

261262
```
262263

264+
#### External Redis with MTLS
265+
266+
In order to use [MTLS (Mutual TLS) for Redis](https://redis.io/docs/management/security/encryption/), you need:
267+
268+
* Create a K8S secret that contains the certificate (ca, certificate and private key).
269+
```console
270+
cat ca.crt tls.crt > tls.crt
271+
kubectl create secret tls my-redis-tls --cert=tls.crt --key=tls.key --dry-run=client -o yaml | kubectl apply -f -
272+
```
273+
274+
Or you can create certificate using templates provided in Codefresh Helm chart.
275+
Add `.Values.secrets` into `values.yaml` as follows.
276+
```yaml
277+
secrets:
278+
redis-tls:
279+
enabled: true
280+
data:
281+
ca.crt: <base64 encoded string>
282+
tls.crt: <base64 encoded string>
283+
tls.key: <base64 encoded string>
284+
```
285+
286+
* Add `.Values.global.volumes` and `.Values.global.volumeMounts` to mount the secret into all the services.
287+
```yaml
288+
global:
289+
volumes:
290+
redis-tls:
291+
enabled: true
292+
type: secret
293+
# Existing secret with TLS certificates (keys: `ca.crt` , `tls.crt`, `tls.key`)
294+
# existingName: my-redis-tls
295+
optional: true
296+
297+
volumeMounts:
298+
redis-tls:
299+
path:
300+
- mountPath: /etc/ssl/redis
301+
302+
env:
303+
REDIS_TLS: true
304+
REDIS_CA_PATH: /etc/ssl/redis/ca.crt
305+
REDIS_CLIENT_CERT_PATH : /etc/ssl/redis/tls.crt
306+
REDIS_CLIENT_KEY_PATH: /etc/ssl/redis/tls.key
307+
# Set these env vars like that if self-signed certificate is used to avoid x509 errors
308+
REDIS_REJECT_UNAUTHORIZED: false
309+
REDIS_TLS_SKIP_VERIFY: true
310+
```
311+
263312
#### External RabbitMQ
264313

265314
**Important:** Recommended version of RabbitMQ is 3.x

0 commit comments

Comments
 (0)