Configuring TLS/mTLS

The sensor and cluster manager can be configured to use TLS/mTLS for communications between them.

Certificates and CA

The sensor and cluster manager pods expect their respective certificates and their associated keys to exist in a secret, and their corresponding CA certificates to exist in a config map. By default the sensor pod expects a secret named upwind-secrets-agent-certs for the sensor certificate and key, and a config map named upwind-config-agent-peer-ca-certs for the CA certificate. These names can be configured in the upwind operator chart. Similarly the cluster manager pod expects a secret named upwind-secrets-cluster-agent-certs for the cluster manager certificate and key, and a config map named upwind-config-cluster-agent-peer-ca-certs for the CA certificate.

tip

It can be convenient to use cert-manager and trust-manager (see the official docs for more) to manage the creation of the required secrets and config maps.

If cert-manager is enabled a Certificate which represents a certificate request to obtain a signed certificate from a configured Issuer or ClusterIssuer will be created during the installation of the upwind-operator chart and cert-manager will create secrets for the TLS certificates where the sensor and cluster manager pods expect to find them. Furthermore, trust-manager can be configured to create the config maps for the CA certificates where the sensor and cluster manager pods expect to find them upon the creation of the secrets.

note

When installing trust-manager it should be configured to read source secrets from the upwind namespace by setting the value app.trust.namespace to upwind i.e. --set app.trust.namespace=upwind.

Enabling TLS/mTLS

With cert-manager and trust-manager set up to create the expected secrets and config maps (or they have been created manually in which case the certManager field can be omitted in the configs below) TLS/mTLS can be enabled by setting the following chart values in the upwind-operator chart:

TLS

agent:
  values:
    tls:
      ca:
        enabled: true
    agent:
      extraArgs:
        - --in-cluster-tls=true
        - --ca-cert-enabled=true
clusterAgent:
  values:
    tls:
      certManager:
        enabled: true
        issuerRef:
          name: my-ca-issuer
      certificates:
        enabled: true
    extraArgs:
      - --self-signed=false

mTLS

agent:
  values:
    tls:
      certManager:
        enabled: true
        issuerRef:
          name: my-ca-issuer
      certificates:
        enabled: true
      ca:
        enabled: true
    agent:
      extraArgs:
        - --in-cluster-tls=true
        - --ca-cert-enabled=true
clusterAgent:
  values:
    tls:
      certManager:
        enabled: true
        issuerRef:
          name: my-ca-issuer
      certificates:
        enabled: true
      ca:
        enabled: true
    extraArgs:
      - --self-signed=false
      - --ca-cert-enabled=true

caution

While the sensor and cluster manager pods support automatic reloading of TLS certificates, automatic reloading of CA certificates is not supported. Therefore, the relevant component must be restarted to pick up changes to the CA certificate. For example, if the CA that signs the cluster manager certificates is changed, the sensors must be restarted to recognize the new CA before the cluster manager pods start using certificates signed by it.