Configuring TLS
Relevant source files
The following files were used as context for generating this wiki page:
Transport Layer Security (TLS) is used across the helm-charts project to secure network communications for various services. Configuration is primarily managed through the values.yaml file for each respective chart, such as agh2, agh3, and playground. This allows for enabling TLS on Ingress resources, securing SMTP traffic with Postfix, and managing secure connections to backend services like databases and message queues.
The primary mechanism for Ingress TLS involves creating a Kubernetes Secret of type kubernetes.io/tls from certificate and key values provided in the values.yaml. Other services, like Postfix, have their TLS parameters configured directly within their respective ConfigMaps. This document outlines the configuration methods for these different components.
Ingress TLS Configuration
TLS for Ingress is configured via the ingress.tls section in the values.yaml file of the agh2, agh3, and playground charts. When enabled, it uses the provided certificate and key to create a Kubernetes Secret, which is then referenced by the Ingress resource to terminate TLS traffic.
Sources: charts/agh2/values.yaml:70-80, charts/agh3/values.yaml:124-134, charts/playground/values.yaml:45-55
Parameters
The following table details the parameters available under the ingress.tls section.
| Parameter | Description | Default Value (agh2/agh3) | Default Value (playground) |
|---|---|---|---|
enabled | A boolean to enable or disable TLS certificate generation. | false | false |
secretName | The name of the Kubernetes Secret that will be created to store the TLS certificate and key. | agh-tls | agh-playground-tls |
cert | The content of the server's TLS certificate. | (A long, base64-encoded string) | (A long, base64-encoded string) |
key | The content of the server's private key. | "" | "" |
Sources: charts/agh2/values.yaml:75-80, charts/agh3/values.yaml:129-134, charts/playground/values.yaml:50-55
TLS Secret Creation
When ingress.tls.enabled is set to true, a Kubernetes Secret resource is generated. The process is illustrated in the diagram below.
This diagram shows the flow from user-provided values to the creation of a Kubernetes TLS Secret.
The secret contains the tls.crt and tls.key data, which are populated from the cert and key values in values.yaml.
Validation
The charts include a validation step to ensure that if ingress.tls.enabled is true, both the cert and key fields are provided. If they are missing, the Helm installation will fail with an error message.
Sources: charts/agh2/templates/validations/index.yaml:29-39, charts/agh3/templates/validations/index.yaml:29-39
Here is the validation logic from the agh3 chart:
{{- if .Values.ingress.tls.enabled -}}
{{- $errorMsg = printf "%s\n%s"
$errorMsg
(
include "validations.required" (
dict
"path" "ingress.tls"
"fields" (list "cert" "key")
"msg" "Must provide when ingress.tls.enabled is true"
"context" $
)
)
-}}
{{- end -}}
Sources: charts/agh3/templates/validations/index.yaml:29-39
Service-Specific TLS
Besides Ingress, other components within the charts have their own TLS configurations.
Postfix TLS
The postfix chart configures TLS for SMTP communication. These settings are defined in a ConfigMap that generates the main.cf file for Postfix.
Sources: charts/postfix/templates/cm.yaml:104-110
The following TLS parameters are configured by default:
| Parameter | Value | Description |
|---|---|---|
smtpd_tls_cert_file | /etc/ssl/certs/ssl-cert-snakeoil.pem | Path to the SMTP daemon's certificate file. |
smtpd_tls_key_file | /etc/ssl/private/ssl-cert-snakeoil.key | Path to the SMTP daemon's private key file. |
smtpd_tls_security_level | may | Enables opportunistic TLS for incoming mail. |
smtp_tls_CApath | /etc/ssl/certs | Path to the directory with trusted CA certificates for outgoing mail. |
smtp_tls_security_level | may | Enables opportunistic TLS for outgoing mail. |
smtp_tls_session_cache_database | btree:${data_directory}/smtp_scache | Path to the TLS session cache database. |
Sources: charts/postfix/templates/cm.yaml:104-110
RabbitMQ TLS
The rabbitmq chart supports TLS for AMQP connections. The service can be configured to expose a specific port for AMQP over TLS.
| Parameter | Description | Default Value |
|---|---|---|
rabbitmq.service.ports.amqpTls | The port number for AMQP connections over TLS. | 5671 |
Sources: charts/agh3/values.yaml:705-706
Database Connection TLS
For database connections, the charts provide an option to disable SSL. This is controlled by the db.connection.options.disableSSL flag.
| Chart | Parameter | Description | Default Value |
|---|---|---|---|
agh2 | db.connection.options.disableSSL | If true, the database connection will not use SSL. | true |
agh3 | db.connection.options.disableSSL | If true, the database connection will not use SSL. | true |
Sources: charts/agh2/values.yaml:92-93, charts/agh3/values.yaml:150-151
Summary
TLS configuration is a critical aspect of securing the services deployed by this Helm repository. For user-facing services, Ingress TLS is the primary method, managed by providing a certificate and key in values.yaml to create a Kubernetes secret. For backend and internal services like Postfix and databases, TLS is configured through service-specific parameters, offering granular control over encrypted communications within the cluster. Proper configuration of these values is essential for a secure deployment.