Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 86aaa90

Browse files
jk464jk464
committedMay 20, 2024·
Enabled internal TLS between k8s pods by default
1 parent 496fc58 commit 86aaa90

12 files changed

+385
-12
lines changed
 

‎.github/workflows/e2e.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,17 @@ jobs:
3939
with:
4040
k3s-channel: ${{ matrix.k3s-channel }}
4141

42+
- name: Setup cert-manager
43+
run: |
44+
helm repo add jetstack https://charts.jetstack.io --force-update
45+
helm repo update
46+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.5/cert-manager.crds.yaml
47+
helm install \
48+
cert-manager jetstack/cert-manager \
49+
--namespace cert-manager \
50+
--create-namespace \
51+
--version v1.14.5
52+
4253
- name: Update stackstorm-ha chart dependencies
4354
run: |
4455
set -x

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
## Development
44
* Updated our tests/unit to support newer versions of `unittests` - for now bumping to `v0.4.4` as `v0.5.0` has a bug that impacts us (see helm-unittest/helm-unittest#329), but testing around the bug shows `v0.5.x` should also "just work" (#414) (by @jk464)
5+
* Enable the use of TLS between all internal components (aside from Redis), and enable it by default (#401) (by @jk464)
56

67
## v1.1.0
78
* Fix syntax with ensure-packs-volumes-are-writable job (#403, #411) (by @skiedude)

‎Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ dependencies:
3333
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
3434
condition: rabbitmq.enabled
3535
- name: mongodb
36-
version: 10.0.1
36+
version: 13.18.5
3737
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
3838
condition: mongodb.enabled
3939
- name: external-dns

‎templates/_helpers.tpl

+52-1
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ Reduce duplication of the st2.*.conf volume details
199199

200200
{{- define "stackstorm-ha.init-containers-wait-for-db" -}}
201201
{{- if index .Values "mongodb" "enabled" }}
202-
{{- $mongodb_port := (int (index .Values "mongodb" "service" "port")) }}
202+
{{- $mongodb_port := (int (index .Values "mongodb" "service" "ports" "mongodb")) }}
203203
- name: wait-for-db
204204
image: {{ template "stackstorm-ha.utilityImage" . }}
205205
imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -422,3 +422,54 @@ Create the custom env list for each deployment
422422
value: {{ $value | quote }}
423423
{{- end }}
424424
{{- end -}}
425+
426+
{{/*
427+
Generate CA
428+
*/}}
429+
{{- define "stackstorm-ha.internal_tls.ca" }}
430+
data:
431+
{{- if (default false ((($.Values.secret).ca))) }}
432+
tls.crt: "{{ .Values.secret.ca.crt }}"
433+
tls.key: "{{ .Values.secret.ca.key }}"
434+
{{- else }}
435+
{{- $ca := genCA "StackStorm CA" 365 }}
436+
tls.crt: "{{ $ca.Cert | b64enc}}"
437+
tls.key: "{{ $ca.Key | b64enc}}"
438+
{{- end -}}
439+
{{- end -}}
440+
441+
{{/*
442+
Set up values for Internal TLS
443+
*/}}
444+
{{- define "stackstorm-ha.internal_tls.cert_volume.mount" -}}
445+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
446+
- name: {{ .Values.st2.tls.secretName }}
447+
mountPath: {{ .Values.st2.tls.mountPath }}/
448+
readOnly: true
449+
{{- end }}
450+
{{- end -}}
451+
{{- define "stackstorm-ha.internal_tls.cert_volume.volume" -}}
452+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
453+
- name: {{ .Values.st2.tls.secretName }}
454+
secret:
455+
secretName: {{ .Values.st2.tls.secretName }}
456+
{{- end }}
457+
{{- end -}}
458+
459+
{{/*
460+
Define st2web ports
461+
*/}}
462+
{{- define "stackstorm-ha.st2web.http_port" -}}
463+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
464+
8080
465+
{{- else -}}
466+
80
467+
{{- end -}}
468+
{{- end -}}
469+
{{- define "stackstorm-ha.st2web.https_port" -}}
470+
{{- if ne (default 0 ((($.Values.st2web.securityContext).runAsUser) | int)) 0 -}}
471+
8443
472+
{{- else -}}
473+
443
474+
{{- end -}}
475+
{{- end -}}

‎templates/ca.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if not ( .Values.st2.tls.certificate_issuer.existing ) -}}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: {{ .Values.st2.tls.certificate_issuer.name }}
7+
namespace: "{{ $.Release.Namespace }}"
8+
spec:
9+
ca:
10+
secretName: {{ .Values.st2.tls.certificate_issuer.name }}-tls
11+
---
12+
apiVersion: v1
13+
{{- include "stackstorm-ha.internal_tls.ca" . }}
14+
kind: Secret
15+
metadata:
16+
name: {{ .Values.st2.tls.certificate_issuer.name }}-tls
17+
namespace: "{{ $.Release.Namespace }}"
18+
type: kubernetes.io/tls
19+
{{- end -}}

‎templates/certificate.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if or .Values.st2.tls.enabled .Values.mongodb.tls.enabled .Values.rabbitmq.tls.enabled }}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: {{ .Values.st2.tls.secretName }}
7+
namespace: "{{ $.Release.Namespace }}"
8+
labels:
9+
app: stackstorm
10+
heritage: {{.Release.Service | quote}}
11+
release: {{.Release.Name | quote}}
12+
chart: {{ replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name }}
13+
spec:
14+
secretName: {{ .Values.st2.tls.secretName }}
15+
dnsNames:
16+
- "*.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}"
17+
{{ include "stackstorm-ha.mongodb-nodes" $ | splitList "," | toYaml | indent 4 }}
18+
ipAddresses:
19+
- "127.0.0.1"
20+
renewBefore: 360h # 15d
21+
privateKey:
22+
rotationPolicy: Always
23+
algorithm: RSA
24+
size: 3072
25+
issuerRef:
26+
name: {{ .Values.st2.tls.certificate_issuer.name }}
27+
kind: Issuer
28+
group: cert-manager.io
29+
{{- end -}}

‎templates/configmaps_st2-conf.yaml

+41
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,49 @@ data:
1111
# The order of merging: st2.conf < st2.docker.conf < st2.user.conf
1212
st2.docker.conf: |
1313
[auth]
14+
{{- if .Values.rabbitmq.tls.enabled }}
15+
api_url = https://{{ .Release.Name }}-st2api:9111/
16+
{{- else }}
1417
api_url = http://{{ .Release.Name }}-st2api:9101/
18+
{{- end -}}
19+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
20+
use_ssl = True
21+
key = {{ .Values.st2.tls.mountPath }}/tls.key
22+
cert = {{ .Values.st2.tls.mountPath }}/tls.crt
23+
debug = False
24+
enable = True
25+
{{- else }}
26+
use_ssl = False
27+
{{- end }}
28+
1529
[system_user]
1630
user = {{ .Values.st2.system_user.user }}
1731
ssh_key_file = {{ tpl .Values.st2.system_user.ssh_key_file . }}
1832
{{- if index .Values "redis" "enabled" }}
33+
1934
[coordination]
2035
url = redis://{{ template "stackstorm-ha.redis-password" $ }}{{ template "stackstorm-ha.redis-nodes" $ }}
2136
{{- end }}
2237
{{- if index .Values "rabbitmq" "enabled" }}
38+
2339
[messaging]
40+
{{- if .Values.rabbitmq.tls.enabled }}
41+
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5671{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
42+
{{- else }}
2443
url = amqp://{{ required "rabbitmq.auth.username is required!" (index .Values "rabbitmq" "auth" "username") }}:{{ required "rabbitmq.auth.password is required!" (index .Values "rabbitmq" "auth" "password") }}@{{ .Release.Name }}-rabbitmq:5672{{ required "rabbitmq.ingress.path is required!" (index .Values "rabbitmq" "ingress" "path") }}
44+
{{- end -}}
2545
{{- end }}
2646
{{- if index .Values "mongodb" "enabled" }}
47+
{{- if .Values.rabbitmq.tls.enabled }}
48+
ssl = True
49+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
50+
ssl_cert_reqs = optional
51+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
52+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
53+
{{- else }}
54+
ssl = False
55+
{{- end }}
56+
2757
[database]
2858
{{- if index .Values "mongodb" "auth" "enabled" }}
2959
host = mongodb://{{ template "stackstorm-ha.mongodb-nodes" $ }}/{{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}?authSource={{ required "mongodb.auth.database is required!" (index .Values "mongodb" "auth" "database") }}&replicaSet={{ index .Values "mongodb" "replicaSetName" }}
@@ -36,10 +66,21 @@ data:
3666
port = {{ index .Values "mongodb" "service" "port" }}
3767
{{- end }}
3868
{{- if ne "disable" (default "" .Values.st2.datastore_crypto_key) }}
69+
{{- if .Values.mongodb.tls.enabled }}
70+
ssl = True
71+
ssl_ca_certs = {{ .Values.st2.tls.mountPath }}/ca.crt
72+
ssl_cert_reqs = optional
73+
ssl_certfile = {{ .Values.st2.tls.mountPath }}/tls.crt
74+
ssl_keyfile = {{ .Values.st2.tls.mountPath }}/tls.key
75+
{{- else }}
76+
ssl = False
77+
{{- end }}
78+
3979
[keyvalue]
4080
encryption_key_path = /etc/st2/keys/datastore_key.json
4181
{{- end }}
4282
{{- if .Values.st2.rbac.enabled }}
83+
4384
[rbac]
4485
enable = True
4586
backend = default

‎templates/configmaps_st2-urls.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,18 @@ metadata:
77
description: StackStorm service URLs, used across entire st2 cluster
88
labels: {{- include "stackstorm-ha.labels" (list $ "st2") | nindent 4 }}
99
data:
10+
{{- if and .Values.st2.tls.enabled .Values.st2auth.tls.enabled }}
11+
ST2_AUTH_URL: https://{{ .Release.Name }}-st2auth:9100/
12+
{{- else }}
1013
ST2_AUTH_URL: http://{{ .Release.Name }}-st2auth:9100/
14+
{{- end }}
15+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
16+
ST2_API_URL: https://{{ .Release.Name }}-st2api:9111/
17+
{{- else }}
1118
ST2_API_URL: http://{{ .Release.Name }}-st2api:9101/
19+
{{- end }}
20+
{{- if and .Values.st2.tls.enabled .Values.st2stream.tls.enabled }}
21+
ST2_STREAM_URL: https://{{ .Release.Name }}-st2stream:9112/
22+
{{- else }}
1223
ST2_STREAM_URL: http://{{ .Release.Name }}-st2stream:9102/
24+
{{- end }}

‎templates/deployments.yaml

+132-6
Large diffs are not rendered by default.

‎templates/jobs.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ spec:
5151
{{- end }}
5252
{{- end }}
5353
volumeMounts:
54+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
5455
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
5556
- name: st2-rbac-roles-vol
5657
mountPath: /opt/stackstorm/rbac/roles/
@@ -65,6 +66,7 @@ spec:
6566
# TODO: Find out default resource limits for this specific service (#5)
6667
#resources:
6768
volumes:
69+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
6870
{{- include "stackstorm-ha.st2-config-volume" . | nindent 8 }}
6971
- name: st2-rbac-roles-vol
7072
configMap:
@@ -143,7 +145,11 @@ spec:
143145
- 'sh'
144146
- '-c'
145147
- >
148+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
149+
until nc -z -w 2 {{ .Release.Name }}-st2api 9111 && echo st2api ready;
150+
{{- else }}
146151
until nc -z -w 2 {{ .Release.Name }}-st2api 9101 && echo st2api ready;
152+
{{- end }}
147153
do sleep 2;
148154
done
149155
# Sidecar container for generating st2client config with st2 username & password pair and sharing produced file with the main container
@@ -163,6 +169,7 @@ spec:
163169
name: {{ . }}
164170
{{- end }}
165171
volumeMounts:
172+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
166173
- name: st2client-config-vol
167174
mountPath: /root/.st2/
168175
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
@@ -196,6 +203,7 @@ spec:
196203
name: {{ . }}
197204
{{- end }}
198205
volumeMounts:
206+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
199207
- name: st2client-config-vol
200208
mountPath: /root/.st2/
201209
- name: st2-apikeys-vol
@@ -208,6 +216,7 @@ spec:
208216
# TODO: Find out default resource limits for this specific service (#5)
209217
#resources:
210218
volumes:
219+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
211220
- name: st2client-config-vol
212221
emptyDir:
213222
medium: Memory
@@ -289,6 +298,7 @@ spec:
289298
name: {{ . }}
290299
{{- end }}
291300
volumeMounts:
301+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
292302
- name: st2client-config-vol
293303
mountPath: /root/.st2/
294304
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
@@ -323,6 +333,7 @@ spec:
323333
name: {{ . }}
324334
{{- end }}
325335
volumeMounts:
336+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
326337
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
327338
- name: st2client-config-vol
328339
mountPath: /root/.st2/
@@ -336,6 +347,7 @@ spec:
336347
# TODO: Find out default resource limits for this specific service (#5)
337348
#resources:
338349
volumes:
350+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
339351
{{- include "stackstorm-ha.st2-config-volume" . | nindent 8 }}
340352
- name: st2client-config-vol
341353
emptyDir:
@@ -418,6 +430,7 @@ spec:
418430
{{- end }}
419431
command: {{- toYaml $.Values.jobs.preRegisterContentCommand | nindent 8 }}
420432
volumeMounts:
433+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
421434
{{- include "stackstorm-ha.overrides-config-mounts" . | nindent 8 }}
422435
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
423436
{{- include "stackstorm-ha.pack-configs-volume-mount" . | nindent 8 }}
@@ -447,6 +460,7 @@ spec:
447460
{{- end }}
448461
{{- end }}
449462
volumeMounts:
463+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
450464
{{- include "stackstorm-ha.overrides-config-mounts" . | nindent 8 }}
451465
{{- include "stackstorm-ha.st2-config-volume-mounts" . | nindent 8 }}
452466
{{- include "stackstorm-ha.packs-volume-mounts-for-register-job" . | nindent 8 }}
@@ -458,6 +472,7 @@ spec:
458472
# TODO: Find out default resource limits for this specific service (#5)
459473
#resources:
460474
volumes:
475+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
461476
{{- include "stackstorm-ha.overrides-configs" . | nindent 8 }}
462477
{{- include "stackstorm-ha.st2-config-volume" . | nindent 8 }}
463478
{{- include "stackstorm-ha.packs-volumes" . | nindent 8 }}
@@ -567,6 +582,7 @@ spec:
567582
echo DONE
568583
569584
volumeMounts:
585+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
570586
{{- include "stackstorm-ha.packs-volume-mounts" $ | nindent 8 }}
571587
{{/* do not include the pack-configs-volume-mount helper here */}}
572588
- name: st2-pack-configs-vol
@@ -575,6 +591,7 @@ spec:
575591
# TODO: Find out default resource limits for this specific job (#5)
576592
#resources:
577593
volumes:
594+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
578595
{{- include "stackstorm-ha.packs-volumes" $ | nindent 8 }}
579596
{{- if $.Values.st2.packs.volumes.configs }}
580597
{{/* do not include the pack-configs-volume helper here */}}
@@ -659,6 +676,7 @@ spec:
659676
name: {{ . }}
660677
{{- end }}
661678
volumeMounts:
679+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
662680
- name: st2client-config-vol
663681
mountPath: /root/.st2/
664682
# `st2 login` doesn't exit on failure correctly, use old methods instead. See bug: https://github.com/StackStorm/st2/issues/4338
@@ -693,6 +711,7 @@ spec:
693711
volumeMounts:
694712
- name: st2client-config-vol
695713
mountPath: /root/.st2/
714+
{{- include "stackstorm-ha.internal_tls.cert_volume.mount" . | nindent 8 }}
696715
{{- include "stackstorm-ha.overrides-config-mounts" $ | nindent 8 }}
697716
{{- include "stackstorm-ha.st2-config-volume-mounts" $ | nindent 8 }}
698717
{{- include "stackstorm-ha.packs-volume-mounts-for-register-job" $ | nindent 8 }}
@@ -708,6 +727,7 @@ spec:
708727
- name: st2client-config-vol
709728
emptyDir:
710729
medium: Memory
730+
{{- include "stackstorm-ha.internal_tls.cert_volume.volume" . | nindent 8 }}
711731
{{- include "stackstorm-ha.overrides-configs" $ | nindent 8 }}
712732
{{- include "stackstorm-ha.st2-config-volume" $ | nindent 8 }}
713733
{{- include "stackstorm-ha.packs-volumes" $ | nindent 8 }}

‎templates/services.yaml

+14-2
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,11 @@ spec:
4848
{{- end }}
4949
ports:
5050
- protocol: TCP
51+
{{- if and .Values.st2.tls.enabled .Values.st2api.tls.enabled }}
52+
port: 9111
53+
{{- else }}
5154
port: 9101
55+
{{- end }}
5256

5357
---
5458
kind: Service
@@ -74,7 +78,11 @@ spec:
7478
{{- end }}
7579
ports:
7680
- protocol: TCP
81+
{{- if and .Values.st2.tls.enabled .Values.st2stream.tls.enabled }}
82+
port: 9112
83+
{{- else }}
7784
port: 9102
85+
{{- end }}
7886

7987
---
8088
kind: Service
@@ -99,8 +107,12 @@ spec:
99107
{{- end }}
100108
{{- end }}
101109
ports:
102-
- protocol: TCP
103-
port: {{ eq (get .Values.st2web.env "ST2WEB_HTTPS" | toString) "1" | ternary 443 80 }}
110+
{{- $https_port := include "stackstorm-ha.st2web.https_port" . }}
111+
{{- $http_port := include "stackstorm-ha.st2web.http_port" . }}
112+
- name: st2web
113+
protocol: TCP
114+
port: {{ if and .Values.st2.tls.enabled .Values.st2web.tls.enabled -}}{{ $https_port }}{{- else -}}{{ $http_port }}{{- end }}
115+
targetPort: {{ if and .Values.st2.tls.enabled .Values.st2web.tls.enabled -}}{{ $https_port }}{{- else -}}{{ $http_port }}{{- end }}
104116

105117
{{ if .Values.st2chatops.enabled -}}
106118
---

‎values.yaml

+53-2
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,11 @@ st2:
9696
[api]
9797
allow_origin = '*'
9898
# fixes no replicaset found bug;
99+
99100
[database]
100101
# Connection and server selection timeout (in ms).
101102
connection_timeout = 5000
102103
103-
104104
#Override Definitions can be added here.
105105
#https://docs.stackstorm.com/latest/packs.html#overriding-pack-defaults
106106
overrides: {}
@@ -296,6 +296,15 @@ st2:
296296
# roles:
297297
# - "admin"
298298

299+
# Controls configuring TLS between internal inter-pod communications
300+
tls:
301+
enabled: true
302+
secretName: "internal-tls"
303+
mountPath: "/etc/ssl/internal"
304+
certificate_issuer:
305+
existing: false
306+
name: stackstorm-issuer
307+
299308
##
300309
## Default SecurityContext for pods and containers.
301310
## Overrides available for st2web, st2actionrunner, st2sensorcontainer, st2client pods, and custom packs images.
@@ -392,6 +401,9 @@ st2web:
392401
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
393402
postStartScript: ""
394403
preStopSleep: "10"
404+
# Use TLS on HTTP connections to st2web (i.e. between pod and ingress)
405+
tls:
406+
enabled: true
395407

396408
# https://docs.stackstorm.com/reference/ha.html#st2auth
397409
# Multiple st2auth processes can be behind a load balancer in an active-active configuration.
@@ -432,6 +444,9 @@ st2auth:
432444
## Note that Helm templating is supported in 'mount' and 'volume'
433445
extra_volumes: []
434446
# see examples under st2actionrunner.extra_volumes
447+
# Use TLS on HTTP connections to st2auth (i.e. between pod and ingress, and inter-pod)
448+
tls:
449+
enabled: true
435450

436451
# https://docs.stackstorm.com/reference/ha.html#st2api
437452
# Multiple st2api process can be behind a load balancer in an active-active configuration.
@@ -472,6 +487,9 @@ st2api:
472487
## Note that Helm templating is supported in 'mount' and 'volume'
473488
extra_volumes: []
474489
# see examples under st2actionrunner.extra_volumes
490+
# Use TLS on HTTP connections to st2api (i.e. between pod and ingress, and inter-pod)
491+
tls:
492+
enabled: true
475493

476494
# https://docs.stackstorm.com/reference/ha.html#st2stream
477495
# Multiple st2stream process can be behind a load balancer in an active-active configuration.
@@ -512,6 +530,9 @@ st2stream:
512530
## Note that Helm templating is supported in 'mount' and 'volume'
513531
extra_volumes: []
514532
# see examples under st2actionrunner.extra_volumes
533+
# Use TLS on HTTP connections to st2stream (i.e. between pod and ingress, and inter-pod)
534+
tls:
535+
enabled: true
515536

516537
# https://docs.stackstorm.com/reference/ha.html#st2rulesengine
517538
# Multiple st2rulesengine processes can run in active-active with only connections to MongoDB and RabbitMQ. All these will share the TriggerInstance load and naturally pick up more work if one or more of the processes becomes unavailable.
@@ -1050,6 +1071,13 @@ mongodb:
10501071
arbiter:
10511072
enabled: false
10521073
resources: {}
1074+
tls:
1075+
enabled: true
1076+
replicaset:
1077+
existingSecrets:
1078+
- internal-tls
1079+
- internal-tls
1080+
- internal-tls
10531081

10541082
##
10551083
## RabbitMQ configuration (3rd party chart dependency)
@@ -1067,6 +1095,10 @@ rabbitmq:
10671095
forceBoot: true
10681096
# Authentication Details
10691097
auth:
1098+
tls:
1099+
enabled: true
1100+
existingSecret: "internal-tls"
1101+
# Fail over to username admin if LDAP is down:
10701102
username: admin
10711103
# TODO: Use default random 10 character password, but need to fetch this string for use by downstream services
10721104
password: 9jS+w1u07NbHtZke1m+jW4Cj
@@ -1097,7 +1129,9 @@ rabbitmq:
10971129
# As RabbitMQ enabled prometheus operator monitoring by default, disable it for non-prometheus users
10981130
metrics:
10991131
enabled: false
1100-
1132+
tls:
1133+
enabled: true
1134+
existingSecret: "internal-tls"
11011135
##
11021136
## Redis HA configuration (3rd party chart dependency)
11031137
##
@@ -1133,6 +1167,13 @@ redis:
11331167
usePassword: false
11341168
metrics:
11351169
enabled: false
1170+
# tls:
1171+
# enabled: true
1172+
# authClients: false
1173+
# certificatesSecret: internal-tls
1174+
# certFilename: tls.crt
1175+
# certKeyFilename: tls.key
1176+
# certCAFilename: ca.crt
11361177

11371178
##
11381179
## Settings to be applied to all stackstorm-ha pods
@@ -1168,3 +1209,13 @@ external-dns:
11681209
aws:
11691210
zoneType: "public"
11701211
domainFilters: []
1212+
1213+
##
1214+
## Image details for ghostunnel
1215+
##
1216+
ghostunnel:
1217+
image:
1218+
name: ghostunnel
1219+
repository: ghostunnel
1220+
tag: v1.6.0
1221+
pullPolicy: IfNotPresent

0 commit comments

Comments
 (0)
Please sign in to comment.