You are looking at the documentation of a prior release. To read the documentation of the latest release, please
visit here.
New to KubeDB? Please start here.
MariaDB TLS/SSL Encryption
Prerequisite : To configure TLS/SSL in MariaDB
, KubeDB
uses cert-manager
to issue certificates. So first you have to make sure that the cluster has cert-manager
installed. To install cert-manager
in your cluster following steps here.
To issue a certificate, the following cr of cert-manager
is used:
Issuer/ClusterIssuer
: Issuers and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details here.Certificate
:cert-manager
has the concept of Certificates that define the desired x509 certificate which will be renewed and kept up to date. You can learn more details here.
MariaDB CRD Specification:
KubeDB uses the following cr fields to enable SSL/TLS encryption in MariaDB
.
spec:
requireSSL
tls:
issuerRef
certificates
Read about the fields in details from mariadb concept,
When, requireSSL
is set, the users must specify the tls.issuerRef
field. KubeDB
uses the issuer
or clusterIssuer
referenced in the tls.issuerRef
field, and the certificate specs provided in tls.certificate
to generate certificate secrets using Issuer/ClusterIssuers
specification. These certificates secrets including ca.crt
, tls.crt
and tls.key
etc. are used to configure MariaDB
server, exporter etc. respectively.
How TLS/SSL configures in MariaDB
The following figure shows how KubeDB
enterprise is used to configure TLS/SSL in MariaDB. Open the image in a new tab to see the enlarged version.
![Stash Backup Flow](/docs/v2023.08.18/guides/mariadb/tls/overview/images/md-tls-ssl.png)
Deploying MariaDB with TLS/SSL configuration process consists of the following steps:
At first, a user creates an
Issuer/ClusterIssuer
cr.Then the user creates a
MariaDB
cr.KubeDB
community operator watches for theMariaDB
cr.When it finds one, it creates
Secret
,Service
, etc. for theMariaDB
database.KubeDB
enterprise operator watches forMariaDB
(5c),Issuer/ClusterIssuer
(5b),Secret
andService
(5a).When it finds all the resources(
MariaDB
,Issuer/ClusterIssuer
,Secret
,Service
), it createsCertificates
by usingtls.issuerRef
andtls.certificates
field specification fromMariaDB
cr.cert-manager
watches for certificates.When it finds one, it creates certificate secrets
tls-secrets
(server, client, exporter secrets, etc.) that hold the actual self-signed certificate.KubeDB
community operator watches for the Certificate secretstls-secrets
.When it finds all the tls-secret, it creates a
StatefulSet
so that MariaDB server is configured with TLS/SSL.
In the next doc, we are going to show a step by step guide on how to configure a MariaDB
database with TLS/SSL.