Skip to content
This repository has been archived by the owner on Aug 25, 2021. It is now read-only.

Enable TLS #313

Merged
merged 26 commits into from
Jan 10, 2020
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
452eb4b
Initial TLS implementation
Mar 18, 2019
224c8ce
Improvements to the TLS implementation
ishustava Dec 6, 2019
b81632a
Update CHANGELOG
ishustava Dec 13, 2019
9a71a8e
tls-init-cleanup job fixes
ishustava Dec 14, 2019
46e8ab9
Client and server cluster roles don't need secret permissions
ishustava Dec 16, 2019
e57223f
Enable TLS for Consul Connect
ishustava Dec 16, 2019
2470fc3
Improvements from code review
ishustava Dec 18, 2019
6ff8db1
Enable TLS for sync-catalog
ishustava Dec 18, 2019
ef97b83
Enable TLS for server-acl-init
ishustava Dec 20, 2019
eb70d6e
Update CHANGELOG and set httpsOnly to true by default
ishustava Dec 20, 2019
458ce81
Update consul-k8s image
ishustava Dec 23, 2019
19d325d
Enable TLS for the Mesh gateway deployment
ishustava Dec 23, 2019
68c12b7
Support TLS for the snapshot agent deployment
ishustava Dec 23, 2019
c1a341e
Update CHANGELOG.md
ishustava Dec 23, 2019
d5ab090
Make sure helm test passes if TLS is enabled
ishustava Dec 24, 2019
64c57a3
tls-init service account, cluster role, and clusterrole binding shoul…
ishustava Jan 2, 2020
224b7d1
Support incremental rollout of TLS
ishustava Jan 3, 2020
b339938
Update CHANGELOG and enterprise licence TLS tests
ishustava Jan 8, 2020
81efca1
Update with changes from code review
ishustava Jan 9, 2020
c9700b8
Update Changelog and fix a few typos
ishustava Jan 9, 2020
08b4a24
Fix whitespace; combine/remove redundant tests
ishustava Jan 10, 2020
3d08818
GRPC address should not have 'http'
ishustava Jan 10, 2020
357c48e
Delete incorrect comments
ishustava Jan 10, 2020
3870aeb
Merge branch 'master' into enable-tls
ishustava Jan 10, 2020
bb34bc7
Fix syntax error
ishustava Jan 10, 2020
278da9a
Fix a bug in the enterprise license job
ishustava Jan 10, 2020
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update Changelog and fix a few typos
  • Loading branch information
ishustava committed Jan 9, 2020
commit c9700b89d43459f000b04912052ca242d60e9b39
13 changes: 7 additions & 6 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,19 +4,20 @@ IMPROVEMENTS:

* Optionally allow enabling TLS for Consul communication [[GH-313](https://github.com/hashicorp/consul-helm/pull/313)].
If `global.tls.enabled` is set to `true`, the Helm chart will generate a CA and necessary certificates and
enable TLS for servers, clients, Connect Inject, Mesh gateways, Sync Catalog, ACL bootstrapping, and snapshot agents.
enable TLS for servers, clients, Connect injector, Mesh gateways, catalog sync, ACL bootstrapping, and snapshot agents.

Note that this feature is only supported if both servers and clients are running
on Kubernetes. We will have better support for other deployment architectures,
as well as bringing your own CA, in the future.

ishustava marked this conversation as resolved.
Show resolved Hide resolved
BUG FIXES:

* Fix graceful terminations for servers and clients [[GH-313](https://github.com/hashicorp/consul-helm/pull/313)].
Set `terminationGracePeriod` to 10 seconds for the servers. Previously, it was set to 10 seconds, which wasn't
enough time for a graceful leave. Additionally, clients always set `leave_on_terminate` to `true` for clients,
so that they can gracefully leave the cluster. This replaces the `preStop` hook that was calling `consul leave`.
Note that this defaults to true for clients as of Consul `0.7`, so this change only affects earlier versions.
* Fix graceful termination for servers [[GH-313](https://github.com/hashicorp/consul-helm/pull/313)].
`terminationGracePeriod` is now set to 30 seconds for the servers. The previous setting of 10 seconds
wasn't always enough time for a graceful leave, and in those cases, servers leave the cluster
in a "failed" state. Additionally, clients always set `leave_on_terminate` to `true`.
This replaces the `preStop` hook that was calling `consul leave`. Note that `leave_on_terminate` defaults
to true for clients as of Consul `0.7`, so this change only affects earlier versions.

## 0.15.0 (Dec 17, 2019)

Expand Down
2 changes: 1 addition & 1 deletion templates/client-daemonset.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ spec:
- name: tls-client-cert
emptyDir:
# We're using tmpfs here so that
# Client certs are not written to disk
# client certs are not written to disk
medium: "Memory"
ishustava marked this conversation as resolved.
Show resolved Hide resolved
{{- end }}
{{- range .Values.client.extraVolumes }}
Expand Down
4 changes: 2 additions & 2 deletions values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@ client:
# - operator: "Exists"
tolerations: ""

# nodeSelector labels for client pod assignment, formatted as a muli-line string.
# nodeSelector labels for client pod assignment, formatted as a multi-line string.
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
# Example:
# nodeSelector: |
Expand Down Expand Up @@ -460,7 +460,7 @@ syncCatalog:
secretName: null
secretKey: null

# nodeSelector labels for syncCatalog pod assignment, formatted as a muli-line string.
# nodeSelector labels for syncCatalog pod assignment, formatted as a multi-line string.
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
# Example:
# nodeSelector: |
Expand Down