Skip to content

Commit 05c95d9

Browse files
JeffMboyaJeffMboya
authored
SMQ-106 - SSL connection support for DB's (#168)
* AddSSL connection support for DB's Signed-off-by: JeffMboya <[email protected]> * Bump chart version Signed-off-by: JeffMboya <[email protected]> * Update docs Signed-off-by: JeffMboya <[email protected]> --------- Signed-off-by: JeffMboya <[email protected]>
1 parent 50a338a commit 05c95d9

11 files changed

+132
-2
lines changed

‎charts/supermq/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ name: Supermq
66
description: Event-driven Infrastructure for Modern Cloud
77
icon: https://avatars1.githubusercontent.com/u/13207490
88
type: application
9-
version: 0.16.1
9+
version: 0.16.2
1010
appVersion: "0.16.0"
1111
home: https://abstractmachines.fr/supermq.html
1212
sources:

‎charts/supermq/README.md

+33-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Event-driven Infrastructure for Modern Cloud
44

5-
![Version: 0.16.1](https://img.shields.io/badge/Version-0.16.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.16.0](https://img.shields.io/badge/AppVersion-0.16.0-informational?style=flat-square)
5+
![Version: 0.16.2](https://img.shields.io/badge/Version-0.16.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.16.0](https://img.shields.io/badge/AppVersion-0.16.0-informational?style=flat-square)
66

77
**Homepage:** <https://abstractmachines.fr/supermq.html>
88

@@ -70,6 +70,10 @@ Event-driven Infrastructure for Modern Cloud
7070
| auth.refreshTokenDuration | string | `"24h"` | |
7171
| auth.replicaCount | int | `1` | |
7272
| auth.secretKey | string | `"supersecret"` | |
73+
| auth.sslCert | string | `""` | |
74+
| auth.sslKey | string | `""` | |
75+
| auth.sslMode | string | `"disable"` | |
76+
| auth.sslRootCert | string | `""` | |
7377
| auth.tolerations | object | `{}` | |
7478
| cassandra.dbUser.password | string | `"cassandra"` | |
7579
| cassandra.dbUser.user | string | `"cassandra"` | |
@@ -95,6 +99,10 @@ Event-driven Infrastructure for Modern Cloud
9599
| certs.sdkTlsVerification | string | `"false"` | |
96100
| certs.signCAKeyPath | string | `"/etc/ssl/certs/ca.key"` | |
97101
| certs.signCAPath | string | `"/etc/ssl/certs/ca.crt"` | |
102+
| certs.sslCert | string | `""` | |
103+
| certs.sslKey | string | `""` | |
104+
| certs.sslMode | string | `"disable"` | |
105+
| certs.sslRootCert | string | `""` | |
98106
| certs.vault.approleRoleid | string | `"supermq"` | |
99107
| certs.vault.approleSecret | string | `"supermq"` | |
100108
| certs.vault.namespace | string | `"supermq"` | |
@@ -111,13 +119,21 @@ Event-driven Infrastructure for Modern Cloud
111119
| channels.httpPort | int | `9005` | |
112120
| channels.image | object | `{}` | |
113121
| channels.replicaCount | int | `1` | |
122+
| channels.sslCert | string | `""` | |
123+
| channels.sslKey | string | `""` | |
124+
| channels.sslMode | string | `"disable"` | |
125+
| channels.sslRootCert | string | `""` | |
114126
| clients.authGrpcPort | int | `7006` | |
115127
| clients.grpcClientCert | string | `"./ssl/certs/clients-grpc-client.crt"` | |
116128
| clients.grpcClientKey | string | `"./ssl/certs/clients-grpc-client.key"` | |
117129
| clients.grpcTimeout | string | `"1s"` | |
118130
| clients.httpPort | int | `9006` | |
119131
| clients.image | object | `{}` | |
120132
| clients.replicaCount | int | `1` | |
133+
| clients.sslCert | string | `""` | |
134+
| clients.sslKey | string | `""` | |
135+
| clients.sslMode | string | `"disable"` | |
136+
| clients.sslRootCert | string | `""` | |
121137
| defaults.image.pullPolicy | string | `"IfNotPresent"` | |
122138
| defaults.image.rootRepository | string | `"supermq"` | |
123139
| defaults.image.tag | string | `"latest"` | |
@@ -131,6 +147,10 @@ Event-driven Infrastructure for Modern Cloud
131147
| domains.httpPort | int | `9003` | |
132148
| domains.image | object | `{}` | |
133149
| domains.replicaCount | int | `1` | |
150+
| domains.sslCert | string | `""` | |
151+
| domains.sslKey | string | `""` | |
152+
| domains.sslMode | string | `"disable"` | |
153+
| domains.sslRootCert | string | `""` | |
134154
| envoy.image.pullPolicy | string | `"IfNotPresent"` | |
135155
| envoy.image.repository | string | `"envoyproxy/envoy"` | |
136156
| envoy.image.tag | string | `"v1.31-latest"` | |
@@ -145,6 +165,10 @@ Event-driven Infrastructure for Modern Cloud
145165
| groups.httpPort | int | `9004` | |
146166
| groups.image | object | `{}` | |
147167
| groups.replicaCount | int | `1` | |
168+
| groups.sslCert | string | `""` | |
169+
| groups.sslKey | string | `""` | |
170+
| groups.sslMode | string | `"disable"` | |
171+
| groups.sslRootCert | string | `""` | |
148172
| ingress.annotations."kubernetes.io/ingress.class" | string | `"nginx"` | |
149173
| ingress.enabled | bool | `true` | |
150174
| ingress.hostname | string | `"localhost"` | |
@@ -190,6 +214,10 @@ Event-driven Infrastructure for Modern Cloud
190214
| journal.httpPort | int | `9021` | |
191215
| journal.image | object | `{}` | |
192216
| journal.replicaCount | int | `1` | |
217+
| journal.sslCert | string | `""` | |
218+
| journal.sslKey | string | `""` | |
219+
| journal.sslMode | string | `"disable"` | |
220+
| journal.sslRootCert | string | `""` | |
193221
| mqtt.adapter.forwarderTimeout | string | `"30s"` | |
194222
| mqtt.adapter.image.pullSecrets | object | `{}` | |
195223
| mqtt.adapter.logLevel | string | `"error"` | |
@@ -570,5 +598,9 @@ Event-driven Infrastructure for Modern Cloud
570598
| users.refreshTokenDuration | string | `"24h"` | |
571599
| users.replicaCount | int | `1` | |
572600
| users.secretKey | string | `"supersecret"` | |
601+
| users.sslCert | string | `""` | |
602+
| users.sslKey | string | `""` | |
603+
| users.sslMode | string | `"disable"` | |
604+
| users.sslRootCert | string | `""` | |
573605
| users.tokenResetEndpoint | string | `"/reset-request"` | |
574606
| vault.enabled | bool | `false` | |

‎charts/supermq/templates/auth-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,14 @@ spec:
8484
value: {{ .Release.Name }}-spicedb-envoy
8585
- name: SMQ_SPICEDB_PORT
8686
value: {{ .Values.spicedb.grpc.port | quote }}
87+
- name: SMQ_AUTH_DB_SSL_MODE
88+
value: {{ .Values.auth.sslMode | quote }}
89+
- name: SMQ_AUTH_DB_SSL_CERT
90+
value: {{ .Values.auth.sslCert | quote }}
91+
- name: SMQ_AUTH_DB_SSL_KEY
92+
value: {{ .Values.auth.sslKey | quote }}
93+
- name: SMQ_AUTH_DB_SSL_ROOT_CERT
94+
value: {{ .Values.auth.sslRootCert | quote }}
8795
- name: SMQ_SPICEDB_SCHEMA_FILE
8896
value: /schema.zed
8997
- name: SMQ_SPICEDB_PRE_SHARED_KEY

‎charts/supermq/templates/certs-deployment.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,16 @@ spec:
7171
value: {{ .Values.postgresqlcerts.username | quote }}
7272
- name: SMQ_CERTS_DB_PASS
7373
value: {{ .Values.postgresqlcerts.password | quote }}
74+
- name: AM_CERTS_DB_SSL_MODE
75+
value: {{ .Values.certs.sslMode | quote }}
76+
- name: SMQ_CERTS_DB_SSL_MODE
77+
value: {{ .Values.certs.sslMode | quote }}
78+
- name: SMQ_CERTS_DB_SSL_CERT
79+
value: {{ .Values.certs.sslCert | quote }}
80+
- name: SMQ_CERTS_DB_SSL_KEY
81+
value: {{ .Values.certs.sslKey | quote }}
82+
- name: SMQ_CERTS_DB_SSL_ROOT_CERT
83+
value: {{ .Values.certs.sslRootCert | quote }}
7484
- name: SMQ_CERTS_SIGN_CA_PATH
7585
value: {{ .Values.certs.signCAPath }}
7686
- name: SMQ_CERTS_SIGN_CA_KEY_PATH

‎charts/supermq/templates/channels-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,14 @@ spec:
5050
value: {{ .Values.postgresqlchannels.username | quote }}
5151
- name: SMQ_CHANNELS_DB_PASS
5252
value: {{ .Values.postgresqlchannels.password | quote }}
53+
- name: SMQ_CHANNELS_DB_SSL_MODE
54+
value: {{ .Values.channels.sslMode | quote }}
55+
- name: SMQ_CHANNELS_DB_SSL_CERT
56+
value: {{ .Values.channels.sslCert | quote }}
57+
- name: SMQ_CHANNELS_DB_SSL_KEY
58+
value: {{ .Values.channels.sslKey | quote }}
59+
- name: SMQ_CHANNELS_DB_SSL_ROOT_CERT
60+
value: {{ .Values.channels.sslRootCert | quote }}
5361
- name: SMQ_SPICEDB_SCHEMA_FILE
5462
value: /schema.zed
5563
- name : SMQ_AUTH_GRPC_URL

‎charts/supermq/templates/clients-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,14 @@ spec:
7272
value: {{ .Values.postgresqlclients.password | quote }}
7373
- name: SMQ_CLIENTS_DB_NAME
7474
value: {{ .Values.postgresqlclients.database | quote }}
75+
- name: SMQ_CLIENTS_DB_SSL_MODE
76+
value: {{ .Values.clients.sslMode | quote }}
77+
- name: SMQ_CLIENTS_DB_SSL_CERT
78+
value: {{ .Values.clients.sslCert | quote }}
79+
- name: SMQ_CLIENTS_DB_SSL_KEY
80+
value: {{ .Values.clients.sslKey | quote }}
81+
- name: SMQ_CLIENTS_DB_SSL_ROOT_CERT
82+
value: {{ .Values.clients.sslRootCert | quote }}
7583
- name: SMQ_ES_URL
7684
value: {{ .Values.nats.enabled | ternary (printf "%s-nats:%d" .Release.Name (.Values.nats.config.nats.port | int )) .Values.nats.externalAddress }}
7785
- name: SMQ_CLIENTS_HTTP_HOST

‎charts/supermq/templates/domains-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,14 @@ spec:
6565
value: {{ .Values.postgresqldomains.password | quote }}
6666
- name: SMQ_DOMAINS_DB_NAME
6767
value: {{ .Values.postgresqldomains.database | quote }}
68+
- name: SMQ_DOMAINS_DB_SSL_MODE
69+
value: {{ .Values.domains.sslMode | quote }}
70+
- name: SMQ_DOMAINS_DB_SSL_CERT
71+
value: {{ .Values.domains.sslCert | quote }}
72+
- name: SMQ_DOMAINS_DB_SSL_KEY
73+
value: {{ .Values.domains.sslKey | quote }}
74+
- name: SMQ_DOMAINS_DB_SSL_ROOT_CERT
75+
value: {{ .Values.domains.sslRootCert | quote }}
6876
- name: SMQ_DOMAINS_CACHE_URL
6977
{{- if .Values.redisdomains.enabled }}
7078
value: redis://{{ .Release.Name }}-redisdomains-master:{{ .Values.redisdomains.master.service.ports.redis }}/0

‎charts/supermq/templates/groups-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,14 @@ spec:
5656
value: {{ .Values.postgresqlgroups.username | quote }}
5757
- name: SMQ_GROUPS_DB_PASS
5858
value: {{ .Values.postgresqlgroups.password | quote }}
59+
- name: SMQ_GROUPS_DB_SSL_MODE
60+
value: {{ .Values.groups.sslMode | quote }}
61+
- name: SMQ_GROUPS_DB_SSL_CERT
62+
value: {{ .Values.groups.sslCert | quote }}
63+
- name: SMQ_GROUPS_DB_SSL_KEY
64+
value: {{ .Values.groups.sslKey | quote }}
65+
- name: SMQ_GROUPS_DB_SSL_ROOT_CERT
66+
value: {{ .Values.groups.sslRootCert | quote }}
5967
- name: SMQ_CHANNELS_URL
6068
value: {{ .Release.Name }}-channels:{{ .Values.channels.httpPort }}
6169
- name: SMQ_CHANNELS_GRPC_URL

‎charts/supermq/templates/journal-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,14 @@ spec:
7878
value: {{ .Values.postgresqljournal.username | quote }}
7979
- name: SMQ_JOURNAL_DB_PASS
8080
value: {{ .Values.postgresqljournal.password | quote }}
81+
- name: SMQ_JOURNAL_DB_SSL_MODE
82+
value: {{ .Values.journal.sslMode | quote }}
83+
- name: SMQ_JOURNAL_DB_SSL_CERT
84+
value: {{ .Values.journal.sslCert | quote }}
85+
- name: SMQ_JOURNAL_DB_SSL_KEY
86+
value: {{ .Values.journal.sslKey | quote }}
87+
- name: SMQ_JOURNAL_DB_SSL_ROOT_CERT
88+
value: {{ .Values.journal.sslRootCert | quote }}
8189
ports:
8290
- containerPort: {{ .Values.journal.httpPort }}
8391
protocol: TCP

‎charts/supermq/templates/users-deployment.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,14 @@ spec:
109109
value: {{ .Values.postgresqlusers.username | quote }}
110110
- name: SMQ_USERS_DB_PASS
111111
value: {{ .Values.postgresqlusers.password | quote }}
112+
- name: SMQ_USERS_DB_SSL_MODE
113+
value: {{ .Values.users.sslMode | quote }}
114+
- name: SMQ_USERS_DB_SSL_CERT
115+
value: {{ .Values.users.sslCert | quote }}
116+
- name: SMQ_USERS_DB_SSL_KEY
117+
value: {{ .Values.users.sslKey | quote }}
118+
- name: SMQ_USERS_DB_SSL_ROOT_CERT
119+
value: {{ .Values.users.sslRootCert | quote }}
112120
- name : SMQ_AUTH_GRPC_URL
113121
value: {{ .Release.Name }}-envoy:{{ .Values.auth.grpcPort }}
114122
- name: SMQ_SPICEDB_HOST

‎charts/supermq/values.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,10 @@ auth:
142142
grpcClientCert: "./ssl/certs/auth-grpc-client.crt"
143143
grpcClientKey: "./ssl/certs/auth-grpc-client.key"
144144
grpcClientCACerts: "./ssl/certs/ca.crt"
145+
sslMode: "disable"
146+
sslCert: ""
147+
sslKey: ""
148+
sslRootCert: ""
145149
nodeSelector: {}
146150
affinity: {}
147151
tolerations: {}
@@ -218,6 +222,10 @@ certs:
218222
sdkHost: "http://supermq-am-certs"
219223
sdkCertsUrl: "${SMQ_CERTS_SDK_HOST}:9010"
220224
sdkTlsVerification: "false"
225+
sslMode: "disable"
226+
sslCert: ""
227+
sslKey: ""
228+
sslRootCert: ""
221229
vault:
222230
url: "http://supermq-vault:8200"
223231
approleRoleid: supermq
@@ -272,6 +280,10 @@ channels:
272280
httpPort: 9005
273281
grpcPort: 7005
274282
grpcTimeout: "1s"
283+
sslMode: "disable"
284+
sslCert: ""
285+
sslKey: ""
286+
sslRootCert: ""
275287
grpcClientCert: "./ssl/certs/channels-grpc-client.crt"
276288
grpcClientKey: "./ssl/certs/channels-grpc-client.key"
277289
grpcServerCert: "./ssl/certs/channels-grpc-server.crt"
@@ -323,6 +335,10 @@ clients:
323335
httpPort: 9006
324336
authGrpcPort: 7006
325337
grpcTimeout: "1s"
338+
sslMode: "disable"
339+
sslCert: ""
340+
sslKey: ""
341+
sslRootCert: ""
326342
grpcClientCert: "./ssl/certs/clients-grpc-client.crt"
327343
grpcClientKey: "./ssl/certs/clients-grpc-client.key"
328344
# logLevel: "error"
@@ -396,6 +412,10 @@ domains:
396412
httpPort: 9003
397413
grpcPort: 7003
398414
grpcTimeout: "300s"
415+
sslMode: "disable"
416+
sslCert: ""
417+
sslKey: ""
418+
sslRootCert: ""
399419
grpcClientCert: "./ssl/certs/domains-grpc-client.crt"
400420
grpcClientCaCerts: "./ssl/certs/ca.crt"
401421

@@ -473,6 +493,10 @@ groups:
473493
httpPort: 9004
474494
grpcPort: 7004
475495
grpcTimeout: "300s"
496+
sslMode: "disable"
497+
sslCert: ""
498+
sslKey: ""
499+
sslRootCert: ""
476500
grpcClientCert: "./ssl/certs/groups-grpc-client.crt"
477501
grpcClientKey: "./ssl/certs/groups-grpc-client.key"
478502
grpcClientCaCerts: "./ssl/certs/ca.crt"
@@ -608,6 +632,10 @@ journal:
608632
# logLevel: "error"
609633
replicaCount: 1
610634
httpPort: 9021
635+
sslMode: "disable"
636+
sslCert: ""
637+
sslKey: ""
638+
sslRootCert: ""
611639
# nodeSelector: {}
612640
# affinity: {}
613641
# tolerations: {}
@@ -918,6 +946,10 @@ users:
918946
allowSelfRegister: true
919947
deleteInterval: "24h"
920948
deleteAfter: "720h"
949+
sslMode: "disable"
950+
sslCert: ""
951+
sslKey: ""
952+
sslRootCert: ""
921953
# nodeSelector: {}
922954
# affinity: {}
923955
# tolerations: {}

0 commit comments

Comments
 (0)