diff --git a/stable/percona-xtradb-cluster/Chart.yaml b/stable/percona-xtradb-cluster/Chart.yaml index 76dc08bb29..82d8f8d267 100644 --- a/stable/percona-xtradb-cluster/Chart.yaml +++ b/stable/percona-xtradb-cluster/Chart.yaml @@ -1,5 +1,5 @@ name: percona-xtradb-cluster -version: 0.3.1 +version: 0.4.0 appVersion: 5.7.19 description: free, fully compatible, enhanced, open source drop-in replacement for MySQL with Galera Replication (xtradb) diff --git a/stable/percona-xtradb-cluster/README.md b/stable/percona-xtradb-cluster/README.md index 22f99a3b5a..f0015f3cc8 100644 --- a/stable/percona-xtradb-cluster/README.md +++ b/stable/percona-xtradb-cluster/README.md @@ -71,6 +71,12 @@ The following table lists the configurable parameters of the Percona chart and t | `podAnnotations` | Pod annotations | `{}` | | `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | | `configFiles` | files to write to /etc/mysql/conf.d | see values.yaml | +| `ssl.enabled` | Setup and use SSL for MySQL connections | `false` | +| `ssl.secret` | Name of the secret containing the SSL certificates | mysql-ssl-certs | +| `ssl.certificates[0].name` | Name of the secret containing the SSL certificates | `nil` | +| `ssl.certificates[0].ca` | CA certificate | `nil` | +| `ssl.certificates[0].cert` | Server certificate (public key) | `nil` | +| `ssl.certificates[0].key` | Server key (private key) | `nil` | | `logTail` | if set to true runs a container to tail /var/log/mysqld.log in the pod | true | | `metricsExporter` | if set to true runs a [mysql metrics exporter](https://github.com/prometheus/mysqld_exporter) container in the pod | false | @@ -104,3 +110,60 @@ By default, an emptyDir volume is mounted at that location. > *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* You can change the values.yaml to enable persistence and use a PersistentVolumeClaim instead. + +## SSL + +This chart supports configuring MySQL to use [encrypted connections](https://dev.mysql.com/doc/refman/5.7/en/encrypted-connections.html) with TLS/SSL certificates provided by the user. This is accomplished by storing the required Certificate Authority file, the server public key certificate, and the server private key as a Kubernetes secret. The SSL options for this chart support the following use cases: + +* Manage certificate secrets with helm +* Manage certificate secrets outside of helm + +## Manage certificate secrets with helm + +Include your certificate data in the `ssl.certificates` section. For example: + +``` +ssl: + enabled: false + secret: mysql-ssl-certs + certificates: + - name: mysql-ssl-certs + ca: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + cert: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + key: |- + -----BEGIN RSA PRIVATE KEY----- + ... + -----END RSA PRIVATE KEY----- +``` + +> **Note**: Make sure your certificate data has the correct formatting in the values file. + +## Manage certificate secrets outside of helm + +1. Ensure the certificate secret exist before installation of this chart. +2. Set the name of the certificate secret in `ssl.secret`. +3. Make sure there are no entries underneath `ssl.certificates`. + +To manually create the certificate secret from local files you can execute: +``` +kubectl create secret generic mysql-ssl-certs \ + --from-file=ca.pem=./ssl/certificate-authority.pem \ + --from-file=server-cert.pem=./ssl/server-public-key.pem \ + --from-file=server-key.pem=./ssl/server-private-key.pem +``` +> **Note**: `ca.pem`, `server-cert.pem`, and `server-key.pem` **must** be used as the key names in this generic secret. + +If you are using a certificate your configurationFiles must include the three ssl lines under [mysqld] + +``` +[mysqld] + ssl-ca=/ssl/ca.pem + ssl-cert=/ssl/server-cert.pem + ssl-key=/ssl/server-key.pem +``` diff --git a/stable/percona-xtradb-cluster/templates/secrets.yaml b/stable/percona-xtradb-cluster/templates/secrets.yaml index 073151c73f..0d150ed6fc 100644 --- a/stable/percona-xtradb-cluster/templates/secrets.yaml +++ b/stable/percona-xtradb-cluster/templates/secrets.yaml @@ -24,3 +24,24 @@ data: {{ else }} xtrabackup-password: {{ randAlphaNum 10 | b64enc | quote }} {{ end }} +{{- if .Values.ssl.enabled }} +{{ if .Values.ssl.certificates }} +{{- range .Values.ssl.certificates }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + labels: + app: {{ template "percona-xtradb-cluster.fullname" $ }} + chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}" + release: "{{ $.Release.Name }}" + heritage: "{{ $.Release.Service }}" +type: Opaque +data: + ca.pem: {{ .ca | b64enc }} + server-cert.pem: {{ .cert | b64enc }} + server-key.pem: {{ .key | b64enc }} +{{- end }} +{{- end }} +{{- end }} diff --git a/stable/percona-xtradb-cluster/templates/statefulset.yaml b/stable/percona-xtradb-cluster/templates/statefulset.yaml index 70f70b201b..34b5ddce48 100644 --- a/stable/percona-xtradb-cluster/templates/statefulset.yaml +++ b/stable/percona-xtradb-cluster/templates/statefulset.yaml @@ -111,6 +111,10 @@ spec: mountPath: /root - name: var-log mountPath: /var/log + {{- if .Values.ssl.enabled }} + - name: certificates + mountPath: /ssl + {{- end }} {{ if .Values.logTail }} - name: "logs" image: "busybox:1.25.0" @@ -159,6 +163,11 @@ spec: - name: mysql-data emptyDir: {} {{- end -}} + {{- if .Values.ssl.enabled }} + - name: certificates + secret: + secretName: {{ .Values.ssl.secret }} + {{- end }} {{- if .Values.tolerations }} tolerations: {{ toYaml .Values.tolerations | indent 8 }} diff --git a/stable/percona-xtradb-cluster/values.yaml b/stable/percona-xtradb-cluster/values.yaml index 3142cdf25e..0a21c036b7 100644 --- a/stable/percona-xtradb-cluster/values.yaml +++ b/stable/percona-xtradb-cluster/values.yaml @@ -96,3 +96,21 @@ metricsExporter: false ## When set to true will create sidecar to tail mysql log logTail: true + +ssl: + enabled: false + secret: mysql-ssl-certs + certificates: +# - name: mysql-ssl-certs +# ca: |- +# -----BEGIN CERTIFICATE----- +# ... +# -----END CERTIFICATE----- +# cert: |- +# -----BEGIN CERTIFICATE----- +# ... +# -----END CERTIFICATE----- +# key: |- +# -----BEGIN RSA PRIVATE KEY----- +# ... +# -----END RSA PRIVATE KEY-----