mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
7931; Enable SSL Support (#8935)
* 7931; Enable SSL Support Signed-off-by: Jon Leonard <jon.leonard@sanofi.com> * Bump chart version Signed-off-by: Jon Leonard <jon.leonard@sanofi.com> * version bump Signed-off-by: Jon Leonard <jon.leonard@sanofi.com>
This commit is contained in:
Jon Leonard
committed by
k8s-ci-robot
k8s-ci-robot
parent
4627e63b17
commit
41ac6ce500
@@ -1,5 +1,5 @@
|
||||
name: percona-xtradb-cluster
|
||||
version: 0.3.1
|
||||
version: 0.4.0
|
||||
appVersion: 5.7.19
|
||||
description: free, fully compatible, enhanced, open source drop-in replacement for
|
||||
MySQL with Galera Replication (xtradb)
|
||||
|
||||
@@ -71,6 +71,12 @@ The following table lists the configurable parameters of the Percona chart and t
|
||||
| `podAnnotations` | Pod annotations | `{}` |
|
||||
| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` |
|
||||
| `configFiles` | files to write to /etc/mysql/conf.d | see values.yaml |
|
||||
| `ssl.enabled` | Setup and use SSL for MySQL connections | `false` |
|
||||
| `ssl.secret` | Name of the secret containing the SSL certificates | mysql-ssl-certs |
|
||||
| `ssl.certificates[0].name` | Name of the secret containing the SSL certificates | `nil` |
|
||||
| `ssl.certificates[0].ca` | CA certificate | `nil` |
|
||||
| `ssl.certificates[0].cert` | Server certificate (public key) | `nil` |
|
||||
| `ssl.certificates[0].key` | Server key (private key) | `nil` |
|
||||
| `logTail` | if set to true runs a container to tail /var/log/mysqld.log in the pod | true |
|
||||
| `metricsExporter` | if set to true runs a [mysql metrics exporter](https://github.com/prometheus/mysqld_exporter) container in the pod | false |
|
||||
|
||||
@@ -104,3 +110,60 @@ By default, an emptyDir volume is mounted at that location.
|
||||
> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."*
|
||||
|
||||
You can change the values.yaml to enable persistence and use a PersistentVolumeClaim instead.
|
||||
|
||||
## SSL
|
||||
|
||||
This chart supports configuring MySQL to use [encrypted connections](https://dev.mysql.com/doc/refman/5.7/en/encrypted-connections.html) with TLS/SSL certificates provided by the user. This is accomplished by storing the required Certificate Authority file, the server public key certificate, and the server private key as a Kubernetes secret. The SSL options for this chart support the following use cases:
|
||||
|
||||
* Manage certificate secrets with helm
|
||||
* Manage certificate secrets outside of helm
|
||||
|
||||
## Manage certificate secrets with helm
|
||||
|
||||
Include your certificate data in the `ssl.certificates` section. For example:
|
||||
|
||||
```
|
||||
ssl:
|
||||
enabled: false
|
||||
secret: mysql-ssl-certs
|
||||
certificates:
|
||||
- name: mysql-ssl-certs
|
||||
ca: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
cert: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
...
|
||||
-----END CERTIFICATE-----
|
||||
key: |-
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
...
|
||||
-----END RSA PRIVATE KEY-----
|
||||
```
|
||||
|
||||
> **Note**: Make sure your certificate data has the correct formatting in the values file.
|
||||
|
||||
## Manage certificate secrets outside of helm
|
||||
|
||||
1. Ensure the certificate secret exist before installation of this chart.
|
||||
2. Set the name of the certificate secret in `ssl.secret`.
|
||||
3. Make sure there are no entries underneath `ssl.certificates`.
|
||||
|
||||
To manually create the certificate secret from local files you can execute:
|
||||
```
|
||||
kubectl create secret generic mysql-ssl-certs \
|
||||
--from-file=ca.pem=./ssl/certificate-authority.pem \
|
||||
--from-file=server-cert.pem=./ssl/server-public-key.pem \
|
||||
--from-file=server-key.pem=./ssl/server-private-key.pem
|
||||
```
|
||||
> **Note**: `ca.pem`, `server-cert.pem`, and `server-key.pem` **must** be used as the key names in this generic secret.
|
||||
|
||||
If you are using a certificate your configurationFiles must include the three ssl lines under [mysqld]
|
||||
|
||||
```
|
||||
[mysqld]
|
||||
ssl-ca=/ssl/ca.pem
|
||||
ssl-cert=/ssl/server-cert.pem
|
||||
ssl-key=/ssl/server-key.pem
|
||||
```
|
||||
|
||||
@@ -24,3 +24,24 @@ data:
|
||||
{{ else }}
|
||||
xtrabackup-password: {{ randAlphaNum 10 | b64enc | quote }}
|
||||
{{ end }}
|
||||
{{- if .Values.ssl.enabled }}
|
||||
{{ if .Values.ssl.certificates }}
|
||||
{{- range .Values.ssl.certificates }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
labels:
|
||||
app: {{ template "percona-xtradb-cluster.fullname" $ }}
|
||||
chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
|
||||
release: "{{ $.Release.Name }}"
|
||||
heritage: "{{ $.Release.Service }}"
|
||||
type: Opaque
|
||||
data:
|
||||
ca.pem: {{ .ca | b64enc }}
|
||||
server-cert.pem: {{ .cert | b64enc }}
|
||||
server-key.pem: {{ .key | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -111,6 +111,10 @@ spec:
|
||||
mountPath: /root
|
||||
- name: var-log
|
||||
mountPath: /var/log
|
||||
{{- if .Values.ssl.enabled }}
|
||||
- name: certificates
|
||||
mountPath: /ssl
|
||||
{{- end }}
|
||||
{{ if .Values.logTail }}
|
||||
- name: "logs"
|
||||
image: "busybox:1.25.0"
|
||||
@@ -159,6 +163,11 @@ spec:
|
||||
- name: mysql-data
|
||||
emptyDir: {}
|
||||
{{- end -}}
|
||||
{{- if .Values.ssl.enabled }}
|
||||
- name: certificates
|
||||
secret:
|
||||
secretName: {{ .Values.ssl.secret }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
|
||||
@@ -96,3 +96,21 @@ metricsExporter: false
|
||||
|
||||
## When set to true will create sidecar to tail mysql log
|
||||
logTail: true
|
||||
|
||||
ssl:
|
||||
enabled: false
|
||||
secret: mysql-ssl-certs
|
||||
certificates:
|
||||
# - name: mysql-ssl-certs
|
||||
# ca: |-
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# ...
|
||||
# -----END CERTIFICATE-----
|
||||
# cert: |-
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# ...
|
||||
# -----END CERTIFICATE-----
|
||||
# key: |-
|
||||
# -----BEGIN RSA PRIVATE KEY-----
|
||||
# ...
|
||||
# -----END RSA PRIVATE KEY-----
|
||||
|
||||
Reference in New Issue
Block a user