Skip to main content

Configuring TLS/mTLS

The sensor and cluster manager can be configured to use TLS/mTLS for communications between them.

Certificates and CA​

The sensor and cluster manager pods expect their respective certificates and their associated keys to exist in a secret, and their corresponding CA certificates to exist in a config map. By default the sensor pod expects a secret named upwind-secrets-agent-certs for the sensor certificate and key, and a config map named upwind-config-agent-peer-ca-certs for the CA certificate. These names can be configured in the upwind operator chart. Similarly the cluster manager pod expects a secret named upwind-secrets-cluster-agent-certs for the cluster manager certificate and key, and a config map named upwind-config-cluster-agent-peer-ca-certs for the CA certificate.

tip

It can be convenient to use cert-manager and trust-manager (see the official docs for more) to manage the creation of the required secrets and config maps.


When tls.certManager.enabled and tls.certificates.enabled are set, the sensor and cluster manager charts, which the Upwind Operator installs, each create a Certificate: a request for a signed certificate from the configured Issuer or ClusterIssuer. cert-manager then creates the TLS secrets where the sensor and cluster manager pods expect to find them. trust-manager can then create the config maps for the CA certificates where the pods expect to find them.

note

When installing trust-manager it should be configured to read source secrets from the upwind namespace by setting the value app.trust.namespace to upwind i.e. --set app.trust.namespace=upwind.

Enabling TLS/mTLS​

With cert-manager and trust-manager set up to create the expected secrets and config maps (or they have been created manually in which case the certManager field can be omitted in the configs below) TLS/mTLS can be enabled by setting the following chart values in the upwind-operator chart:

agent:
  values:
    tls:
      ca:
        enabled: true
    agent:
      extraArgs:
        - --in-cluster-tls=true
        - --ca-cert-enabled=true
clusterAgent:
  values:
    tls:
      certManager:
        enabled: true
        issuerRef:
          name: my-ca-issuer
          kind: ClusterIssuer
      certificates:
        enabled: true
    extraArgs:
      - --self-signed=false

issuerRef.kind defaults to ClusterIssuer. If your issuer is a namespaced Issuer, set kind: Issuer and create the issuer in the upwind namespace, where the Certificate resources are created.

caution

While the sensor and cluster manager pods support automatic reloading of TLS certificates, automatic reloading of CA certificates is not supported. Therefore, the relevant component must be restarted to pick up changes to the CA certificate. For example, if the CA that signs the cluster manager certificates is changed, the sensors must be restarted to recognize the new CA before the cluster manager pods start using certificates signed by it.