Skip to content

Commit f3601a9

Browse files
cbrianpacecbrianpace
authored
Add example using cert-manager
Provide any example of "bring your own TLS infrastructure" using cert-manager[1] [1] https://cert-manager.io/docs/
1 parent 565520a commit f3601a9

File tree

10 files changed

+208
-0
lines changed

10 files changed

+208
-0
lines changed

‎kustomize/certmanager/README.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Using Cert-Manager with Postgres Operator 5.x
2+
3+
## Introduction
4+
Starting with version 5.0 of the Crunchy Data Postgres Operator for Kubernetes, TLS is on by default to secure all communication to/from the postgres cluster. By default, the Operator will generate the necessary certificates for the Postgres cluster and components. It is possible to provide custom cetificates by storing the certificates in a Kubernetes Secret and pointing the Operator to those secrets in the Postgres manifest.
5+
6+
Cert-Manager can be used to dynamically generate and manage certificates in Kubernetes. Cert-Manager can generate self-signed certificates or certificates from several certificate authorities.
7+
8+
This example shows how to use custom self-signed certificates generated by Cert-Manager.
9+
10+
## Cert-Manager Installation
11+
The first step is to deploy Cert-Manager to the Kubernetes cluster. To do this, follow the instructions on the Cert-Manager website (https://cert-manager.io/docs/installation/).
12+
13+
## Setup Certificate Issuer
14+
After Cert-Manager has been deployed, the next step used in this example is to setup a Certificate Issuer. The Certificate Issuer can be configured to be local to a namespace or cluster wide. In the examples provided here, a cluster wide issuer is created.
15+
16+
### Configure Issuer
17+
```kubectl apply -k certman```
18+
19+
This Kustomize deployment performs the following actions:
20+
21+
* Creates a cluster wide (ClusterIssuer) self-signed certificate issuer.
22+
* Generates a common CA certificate.
23+
* Creates a cluster wide (ClusterIssuer) CA certificate issuer using the generated CA certificate.
24+
25+
By default the issues are created in the cert-manager namespace which is the default namespace for Cert-Manager.
26+
27+
The CA certificate issuer is important as the Postgres components require that the ca.crt be the same for the certificates generated to support Postgres.
28+
29+
## Deploy Postgres with Custom Certificates
30+
31+
With the cluster wide certificate issuer in place, the next step is to generate certificates and then instruct the Operator to use these certicates.
32+
33+
Two certificates will be generated by the Kustomize deployment. The first certificate secret is named <cluster>-tls (hippo-tls in this example) and the second certificate <cluster>-repl-tls (hippo-repl-tls). The critical different between the two certificates is the Common Name (CN). For the replication certificate (<cluster>-repl-tls), the Common Name must be _crunchyrepl. If the Common Name is not set properly then the replicas will fail doing bootstrap process.
34+
35+
In the Postgres manifest, two entries are added to point to the newly created Secrets. The customTLSSecret key references the <cluster>-tls secret while the customReplicationTLSSecret references the <cluster>-repl-tls secret.
36+
37+
### Deploy Postgres Cluster
38+
```kubectl apply -k postgres```
39+
40+
The following process takes place during the deployment:
41+
* Custom certificate is generated for Postgres using the CA ClusterIssuer created in the previous steps.
42+
* Custom certificate is generated for Postgres replication using the CA ClusterIssuer.
43+
* Postgres cluster deployed using the custom certificates.
44+

‎kustomize/certmanager/certman/ca-cert.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: selfsigned-ca
6+
namespace: cert-manager
7+
spec:
8+
isCA: true
9+
commonName: postgres-operator
10+
secretName: root-secret
11+
privateKey:
12+
algorithm: ECDSA
13+
size: 256
14+
issuerRef:
15+
name: selfsigned-cluster-issuer
16+
kind: ClusterIssuer
17+
group: cert-manager.io

‎kustomize/certmanager/certman/ca-issuer.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: ClusterIssuer
4+
metadata:
5+
name: ca-issuer
6+
namespace: cert-manager
7+
spec:
8+
ca:
9+
secretName: root-secret

‎kustomize/certmanager/certman/kustomization.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
resources:
2+
- selfsigned-clusterissuer.yaml
3+
- ca-cert.yaml
4+
- ca-issuer.yaml

‎kustomize/certmanager/certman/selfsigned-clusterissuer.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: ClusterIssuer
4+
metadata:
5+
name: selfsigned-cluster-issuer
6+
namespace: cert-manager
7+
spec:
8+
selfSigned: {}

‎kustomize/certmanager/certman/selfsigned-issuer.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: selfsigned-issuer
6+
spec:
7+
selfSigned: {}

‎kustomize/certmanager/postgres/cert-repl.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: hippo-repl-certmanager
5+
spec:
6+
# Secret names are always required.
7+
secretName: hippo-repl-tls
8+
duration: 2160h # 90d
9+
renewBefore: 360h # 15d
10+
subject:
11+
organizations:
12+
- crunchydata
13+
# The use of the common name field has been deprecated since 2000 and is
14+
# discouraged from being used.
15+
commonName: _crunchyrepl
16+
isCA: false
17+
privateKey:
18+
algorithm: RSA
19+
encoding: PKCS1
20+
size: 2048
21+
usages:
22+
- server auth
23+
- client auth
24+
# At least one of a DNS Name, URI, or IP address is required.
25+
dnsNames:
26+
- _crunchyrepl
27+
# uris:
28+
# - spiffe://cluster.local/ns/zoo/hippo
29+
#ipAddresses:
30+
#- 192.168.0.5
31+
# Issuer references are always required.
32+
issuerRef:
33+
name: ca-issuer
34+
# We can reference ClusterIssuers by changing the kind here.
35+
# The default value is Issuer (i.e. a locally namespaced Issuer)
36+
kind: ClusterIssuer
37+
# This is optional since cert-manager will default to this value however
38+
# if you are using an external issuer, change this to that issuer group.
39+
group: cert-manager.io

‎kustomize/certmanager/postgres/cert.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: hippo-certmanager
5+
spec:
6+
# Secret names are always required.
7+
secretName: hippo-tls
8+
duration: 2160h # 90d
9+
renewBefore: 360h # 15d
10+
subject:
11+
organizations:
12+
- crunchydata
13+
# The use of the common name field has been deprecated since 2000 and is
14+
# discouraged from being used.
15+
commonName: postgres-operator
16+
isCA: false
17+
privateKey:
18+
algorithm: RSA
19+
encoding: PKCS1
20+
size: 2048
21+
usages:
22+
- server auth
23+
- client auth
24+
# At least one of a DNS Name, URI, or IP address is required.
25+
dnsNames:
26+
- hippo-primary
27+
# uris:
28+
# - spiffe://cluster.local/ns/zoo/hippo
29+
#ipAddresses:
30+
#- 192.168.0.5
31+
# Issuer references are always required.
32+
issuerRef:
33+
name: ca-issuer
34+
# We can reference ClusterIssuers by changing the kind here.
35+
# The default value is Issuer (i.e. a locally namespaced Issuer)
36+
kind: ClusterIssuer
37+
# This is optional since cert-manager will default to this value however
38+
# if you are using an external issuer, change this to that issuer group.
39+
group: cert-manager.io

‎kustomize/certmanager/postgres/kustomization.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
namespace: zoo
2+
3+
resources:
4+
- cert.yaml
5+
- cert-repl.yaml
6+
- postgres.yaml

‎kustomize/certmanager/postgres/postgres.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: hippo
5+
spec:
6+
image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-ha:centos8-13.3-0
7+
postgresVersion: 13
8+
openshift: true
9+
customReplicationTLSSecret:
10+
name: hippo-repl-tls
11+
customTLSSecret:
12+
name: hippo-tls
13+
instances:
14+
- name: pgc
15+
replicas: 2
16+
dataVolumeClaimSpec:
17+
accessModes:
18+
- "ReadWriteOnce"
19+
resources:
20+
requests:
21+
storage: 1Gi
22+
backups:
23+
pgbackrest:
24+
image: registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:centos8-2.33-0
25+
repoHost:
26+
dedicated: {}
27+
repos:
28+
- name: repo1
29+
volume:
30+
volumeClaimSpec:
31+
accessModes:
32+
- "ReadWriteOnce"
33+
resources:
34+
requests:
35+
storage: 1Gi

0 commit comments

Comments
 (0)