Uploaded image for project: 'Couchbase Kubernetes'
  1. Couchbase Kubernetes
  2. K8S-2949

Support for per-node certificates

    XMLWordPrintable

Details

    • Task
    • Resolution: Unresolved
    • Major
    • Jasconius
    • None
    • operator
    • None
    • 2.5.0 - Release Sprint, 2.6.0 - To 2.6.0 and Beyond
    • 5

    Description

      With 7.1 we can begin to use intermediate certificates and CA's which apply to a single node:

      https://docs.couchbase.com/server/current/learn/security/using-multiple-cas.html

      While we currently support multiple CA's, server does not get the full benefit of this because the same node certificate which is signed by a single CA is installed cluster-wide.  We also cannot allow intermediates with FQDN as a subject alternative names since the certificate would not be valid on other hosts with different hostnames.

       

      What I propose is that we include the TLS structure in the server config as a means to provide granular TLS for a specific set of nodes:

      servers:
        - size: 2
        name: data_services
        services:
          - data
        tls:
          secretSource:
            serverSecretName: "data-service-tls"
        - size: 2
        name: index_services
        services:
          - index 
        tls:
          secretSource:
            serverSecretName: "index-service-tls" 

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            justin.ashworth Justin Ashworth
            tommie Tommie McAfee (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty