You are looking at the documentation of a prior release. To read the documentation of the latest release, please visit here.
New to KubeDB? Please start here.
Prerequisite : To configure TLS/SSL in
cert-manager to issue certificates. So first you have to make sure that the cluster has
cert-manager installed. To install
cert-manager in your cluster following steps here.
To issue a certificate, the following crd of
cert-manager is used:
Issuer/ClusterIssuer: Issuers, and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details here.
cert-manager has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details here.
Redis CRD Specification :
KubeDB uses following crd fields to enable SSL/TLS encryption in
Read about the fields in details from redis concept,
KubeDB uses the
clusterIssuer referenced in the
tls.issuerRef field, and the certificate specs provided in
tls.certificate to generate certificate secrets using
Issuer/ClusterIssuers specification. These certificates secrets including
tls.key etc. are used to configure
Redis server, exporter etc. respectively.
The following figure shows how
KubeDB enterprise used to configure TLS/SSL in Redis. Open the image in a new tab to see the enlarged version.
Deploying Redis with TLS/SSL configuration process consists of the following steps:
At first, a user creates a
Then the user creates a
Redis cr which refers to the
Issuer/ClusterIssuer cr that the user created in the previous step.
KubeDB Provisioner operator watches for the
When it finds one, it creates
Service, etc. for the
KubeDB Ops-manager operator watches for
When it finds all the resources(
Service), it creates
Certificates by using
tls.certificates field specification from
cert-manager watches for certificates.
When it finds one, it creates certificate secrets
tls-secrets(server, client, exporter secrets etc.) that holds the actual certificate signed by the CA.
KubeDB Provisioner operator watches for the Certificate secrets
When it finds all the tls-secret, it creates the related
StatefulSets so that Redis database can be configured with TLS/SSL.
In the next doc, we are going to show a step-by-step guide on how to configure a
Redis database with TLS/SSL.