This is an Enterprise-only feature. Please install KubeDB Enterprise Edition to try this feature.
New to KubeDB? Please start here.
Prerequisite : To configure TLS/SSL in
cert-manager to issue certificates. So first you have to make sure that the cluster has
cert-manager installed. To install
cert-manager in your cluster following steps here.
To issue a certificate, the following cr of
cert-manager is used:
Issuer/ClusterIssuer: Issuers and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details here.
cert-manager has the concept of Certificates that define the desired x509 certificate which will be renewed and kept up to date. You can learn more details here.
Postgres CRD Specification:
KubeDB uses the following cr fields to enable SSL/TLS encryption in
Read about the fields in details from postgres concept,
sslModesupported values are [
disable:It ensures that the server does not use TLS/SSL
allow:you don’t care about security, but I will pay the overhead of encryption if the server insists on it.
prefer:you don’t care about encryption, but you wish to pay the overhead of encryption if the server supports it.
require:you want your data to be encrypted, and you accept the overhead. you want to be sure that you connect to a server that you trust.
verify-ca:you want your data to be encrypted, and you accept the overhead. you want to be sure that you connect to a server you trust, and that it’s the one you specify.
sslMode is set and the value is not
disable then, the users must specify the
KubeDB uses the
clusterIssuer referenced in the
tls.issuerRef field, and the certificate specs provided in
tls.certificate to generate certificate secrets using
Issuer/ClusterIssuers specification. These certificates secrets including
tls.key etc. are used to configure
Postgres server, exporter etc. respectively.
The following figure shows how
KubeDB enterprise is used to configure TLS/SSL in Postgres. Open the image in a new tab to see the enlarged version.
Deploying Postgres with TLS/SSL configuration process consists of the following steps:
At first, a user creates an
Then the user creates a
KubeDB community operator watches for the
When it finds one, it creates
Service, etc. for the
KubeDB enterprise operator watches for
When it finds all the resources(
Service), it creates
Certificates by using
tls.certificates field specification from
cert-manager watches for certificates.
When it finds one, it creates certificate secrets
cert-secrets(server, client, exporter secrets, etc.) that hold the actual self-signed certificate.
KubeDB community operator watches for the Certificate secrets
When it finds all the tls-secret, it creates a
StatefulSet so that Postgres server is configured with TLS/SSL.
In the next doc, we are going to show a step by step guide on how to configure a
Postgres database with TLS/SSL.