Skip to main content

Create TLS Secret

TLS Secrets for Server and/or Client Encryption​

Depending on your needs, you can let the C* operator generate CA and TLS secrets for you; or provide either a CA or Node TLS secret. For multi-region clusters, you need to setup TLS Secrets signed with same CA. To achieve this, you need to provide the same CA TLS Secret for all regions. See the steps below for how to manually generate TLS Secrets.

NOTE: don't use password encrypted private keys, they are not supported.

To remove passphrase from the key use command below

openssl rsa -in example.key -out example.key

Use ./utils/tls.sh to generate CA or Node TLS Secrets.

tls.sh -h

NAME:
  tls.sh - This bash script generates CA and Node TLS Secrets

USAGE:
  tls.sh command [options]

COMMANDS:
  create-ca-tls-secret    - generate and deploy CA TLS Secret
  create-node-tls-secret  - generate and deploy Node TLS Secret
  create-ca-keypair       - generate CA keypair into tmp directory
  create-node-keypair     - generate signed Node keypair into tmp directory

OPTIONS:
  --secret-name           Name of the TLS Secret to generate
  --dry-run               Produces generated by this script commands to output and don't run it in k8s.
  -h, --help              Display this help.

How to create TLS CA Secret with existing CA keypair​

This way is most common when you have an already running C* cluster and want to join a new one.

Use utils/tls.sh to generate CA TLS Secret with CA keypair. openssl is required to be installed in your system.

./utils/tls.sh create-ca-tls-secret --secret-name cluster-tls-ca --ca-cert ./rootca.crt --ca-key ./rootca.key

Check the Secret

kubectl get secret cluster-tls-ca
NAME             TYPE     DATA   AGE
cluster-tls-ca   Opaque   2      4m30s

Hook in the CA Secret in the CR

  encryption:
    server:
      internodeEncryption: dc
      caTLSSecret:
        name: cluster-tls-ca

How to create TLS CA Secret from scratch​

This is the most common way to connect multiple regions protected by TLS.

Use utils/tls.sh to generate CA TLS Secret with ca keypair. openssl is required to be installed in your system.

tls.sh create-ca-tls-secret --secret-name cluster-tls-ca

Check the Secret

kubectl get secret cluster-tls-ca
NAME             TYPE     DATA   AGE
cluster-tls-ca   Opaque   2      4m30s

Hook in the CA Secret in the CR

  encryption:
    server:
      internodeEncryption: dc
      caTLSSecret:
        name: cluster-tls-ca

How to create TLS Node Secret​

This is required in rare cases. Can be useful if it's not possible to provide CA TLS Secret.

Use utils/tls.sh to generate Node TLS Secret with ca keypair. JAVA and openssl are required to be installed in your system.

NOTE: use JAVA prior version 12 to run keytool commands. This is because JDK 12 uses HmacPBESHA256 algorithm which is only supported by standard java (SunJCE Provider) starting from Java 12.

tls.sh create-node-tls-secret --secret-name cluster-tls-node

Check the Secret

kubectl get secret cluster-tls-node
NAME               TYPE     DATA   AGE
cluster-tls-node   Opaque   7      67s

Hook in the Node Secret in the CR

  encryption:
    server:
      internodeEncryption: dc
      nodeTLSSecret:
        name: cluster-tls-node
Last updated on