KubeDB

By AppsCode

CONTACT SALES

New to KubeDB? Please start here.

Run Hazelcast with TLS/SSL (Transport Encryption)

KubeDB supports providing TLS/SSL encryption for Hazelcast. This tutorial will show you how to use KubeDB to run a Hazelcast with TLS/SSL encryption.

Before You Begin

  • At first, you need to have a Kubernetes, and the kubectl command-line tool must be configured to communicate with your . If you do not already have a cluster, you can create one by using kind.

  • Install cert-manger v1.0.0 or later to your to manage your SSL/TLS certificates.

  • Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps here.

  • To keep things isolated, this tutorial uses a separate namespace called demo throughout this tutorial.

    $ kubectl create ns demo
namespace/demo created

Note: YAML files used in this tutorial are stored in docs/examples/Hazelcast folder in GitHub repository kubedb/docs.

Overview

KubeDB uses following crd fields to enable SSL/TLS encryption in Hazelcast.

  • spec:
    • enableSSL
    • tls:
      • issuerRef
      • certificate

Read about the fields in details in Hazelcast Concept,

tls is applicable for Hazelcast cluster.

Users must specify the tls.issuerRef field. KubeDB uses the issuer or clusterIssuer referenced in the tls.issuerRef field, and the certificate specs provided in tls.certificate to generate certificate secrets. These certificate secrets are then used to generate required certificates including ca.crt, tls.crt, tls.key, keystore.jks and truststore.jks.

Create Issuer/ clusterIssuer

We are going to create an example Issuer that will be used throughout the duration of this tutorial to enable SSL/TLS in Hazelcast. Alternatively, you can follow this cert-manager tutorial to create your own Issuer.

  • Start off by generating you ca certificates using openssl.
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=hazelcast /O=kubedb"
......................+...........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+............+.....+...+...+.....................+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+..+.+..+...............+.+.....+....+...+.....+.............+.........+..+...+.+......+........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.+......+.+............+..+.........+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..............+..........+...+.....+.+.....+....+......+.....+.+......+..+.+..+.........+...+..........+..+.................................+.......+.....................+..+......................+......+.....+...+....+..+....+.........+...+..............+....+..+...+.+........+.+..+.........+...+................+..+...+.......+............+...+........+..........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
  • Now create a ca-secret using the certificate files you have just generated.
kubectl create secret tls hz-ca --cert=ca.crt  --key=ca.key --namespace=cert-manager 
secret/hz-ca created

Now, create an Issuer using the ca-secret you have just created. The YAML file looks like this:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: self-signed-issuer
spec:
  ca:
    secretName: hz-ca

Apply the YAML file:

$ kubectl create -f https://github.com/kubedb/docs/raw/v2026.7.10/docs/examples/hazelcast/tls/hz-issuer.yaml
issuer.cert-manager.io/self-signed-issuer created

TLS/SSL encryption in Hazelcast

apiVersion: kubedb.com/v1alpha2
kind: Hazelcast
metadata:
  name: hazelcast-sample
  namespace: demo
spec:
  tls:
    issuerRef:
      apiGroup: cert-manager.io
      name: self-signed-issuer
      kind: ClusterIssuer
    certificates:
      - alias: server
        subject:
          organizations:
            - kubedb
        dnsNames:
          - localhost
        ipAddresses:
          - "127.0.0.1"
      - alias: client
        subject:
          organizations:
            - kubedb
        dnsNames:
          - localhost
        ipAddresses:
          - "127.0.0.1"
  enableSSL: true
  deletionPolicy: WipeOut
  licenseSecret:
    name: hz-license-key
  replicas: 3
  version: 5.5.6
  storage:
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 2Gi
    storageClassName: standard

Deploy Hazelcast with TLS/SSL

$ kubectl create -f https://github.com/kubedb/docs/raw/v2026.7.10/docs/examples/hazelcast/tls/hazelcast.yaml
hazelcast.kubedb.com/hazelcast-sample created

Now, wait until hazelcast-sample created has status Ready. i.e,

$ kubectl get hz -n demo
NAME               TYPE                  VERSION   STATUS   AGE
hazelcast-sample   kubedb.com/v1alpha2   5.5.2     Ready    165m

Verify TLS/SSL in Hazelcast

$ kubectl describe secret hazelcast-sample-client-cert -n demo
Name:         hazelcast-sample-client-cert
Namespace:    demo
Labels:       app.kubernetes.io/component=database
              app.kubernetes.io/instance=hazelcast-sample
              app.kubernetes.io/managed-by=kubedb.com
              app.kubernetes.io/name=hazelcasts.kubedb.com
              controller.cert-manager.io/fao=true
Annotations:  cert-manager.io/alt-names:
                *.hazelcast-sample-pods.demo,*.hazelcast-sample-pods.demo.svc,*.hazelcast-sample-pods.demo.svc.cluster.local,hazelcast-sample,hazelcast-sa...
              cert-manager.io/certificate-name: hazelcast-sample-client-cert
              cert-manager.io/common-name: hazelcast-sample
              cert-manager.io/ip-sans: 127.0.0.1
              cert-manager.io/issuer-group: cert-manager.io
              cert-manager.io/issuer-kind: ClusterIssuer
              cert-manager.io/issuer-name: self-signed-issuer
              cert-manager.io/subject-organizations: kubedb
              cert-manager.io/uri-sans: 

Type:  kubernetes.io/tls

Data
====
ca.crt:          1164 bytes
keystore.p12:    3615 bytes
tls.crt:         1627 bytes
tls.key:         1675 bytes
truststore.p12:  1114 bytes

We can see from the above output that, keystore location is /var/Hazelcast/etc which means that TLS is enabled.

bash-5.1$ cd /data/etc/server
bash-5.1$ ls
ca.crt	keystore.p12  tls.crt  tls.key	truststore.p12

From the above output, we can see that we are able to connect to the Hazelcast using the TLS configuration.

Cleaning up

To clean up the Kubernetes resources created by this tutorial, run:

kubectl delete hazelcast -n demo hazelcast-sample
kubectl delete clusterissuer -n demo self-signed-issuer
kubectl delete ns demo

Next Steps

What's on this Page

Search
Improve This Page