diff --git a/helm/README.md b/helm/README.md index 82551f275..643e13a30 100644 --- a/helm/README.md +++ b/helm/README.md @@ -75,6 +75,8 @@ RustFS helm chart supports **standalone and distributed mode**. For standalone m | livenessProbe.timeoutSeconds | int | `3` | | | mode.distributed.enabled | bool | `true` | RustFS distributed mode support, namely multiple pod multiple pvc. | | mode.standalone.enabled | bool | `false` | RustFS standalone mode support, namely one pod one pvc. | +| mtls.enabled | bool | `false` | Enable mtls betweens pods. | +| mtls.serverOnly | bool | `false` | Only enable server https. | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | | pdb.create | bool | `false` | Enable/disable a Pod Disruption Budget creation | diff --git a/helm/rustfs/templates/_helpers.tpl b/helm/rustfs/templates/_helpers.tpl index 34e99413c..3120f1f33 100644 --- a/helm/rustfs/templates/_helpers.tpl +++ b/helm/rustfs/templates/_helpers.tpl @@ -103,11 +103,17 @@ Render imagePullSecrets for workloads - appends registry secret Render RUSTFS_VOLUMES */}} {{- define "rustfs.volumes" -}} + +{{- $protocol := "http" -}} +{{- if .Values.mtls.enabled -}} + {{- $protocol = "https" -}} +{{- end -}} + {{- if eq (int .Values.replicaCount) 4 }} -{{- printf "http://%s-{0...%d}.%s-headless:%d/data/rustfs{0...%d}" (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" . ) (.Values.service.endpoint.port | int) (sub (.Values.replicaCount | int) 1) }} +{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.cluster.local:%d/data/rustfs{0...%d}" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" . ) .Release.Namespace (.Values.service.endpoint.port | int) (sub (.Values.replicaCount | int) 1) }} {{- end }} {{- if eq (int .Values.replicaCount) 16 }} -{{- printf "http://%s-{0...%d}.%s-headless:%d/data" (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" .) (.Values.service.endpoint.port | int) }} +{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.cluster.local:%d/data" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" .) .Release.Namespace (.Values.service.endpoint.port | int) }} {{- end }} {{- end }} diff --git a/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml b/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml new file mode 100644 index 000000000..57a158c39 --- /dev/null +++ b/helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml @@ -0,0 +1,8 @@ +{{- if .Values.mtls.enabled }} +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: {{ include "rustfs.fullname" . }}-selfsigned-issuer +spec: + selfSigned: {} +{{- end }} diff --git a/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml new file mode 100644 index 000000000..9015834a6 --- /dev/null +++ b/helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml @@ -0,0 +1,13 @@ +{{- if .Values.mtls.enabled }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "rustfs.fullname" . }}-root-ca +spec: + isCA: true + commonName: {{ include "rustfs.fullname" . }}-root-ca + secretName: {{ include "rustfs.fullname" . }}-root-ca-secret + issuerRef: + name: {{ include "rustfs.fullname" . }}-selfsigned-issuer + kind: ClusterIssuer +{{- end }} \ No newline at end of file diff --git a/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml b/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml new file mode 100644 index 000000000..c41c6430b --- /dev/null +++ b/helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml @@ -0,0 +1,9 @@ +{{- if .Values.mtls.enabled }} +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ include "rustfs.fullname" . }}-ca-issuer +spec: + ca: + secretName: {{ include "rustfs.fullname" . }}-root-ca-secret +{{- end }} \ No newline at end of file diff --git a/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml new file mode 100644 index 000000000..6bf062967 --- /dev/null +++ b/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml @@ -0,0 +1,22 @@ +{{- if .Values.mtls.enabled }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "rustfs.fullname" . }}-server-tls +spec: + secretName: {{ include "rustfs.fullname" . }}-server-tls + issuerRef: + name: {{ include "rustfs.fullname" . }}-ca-issuer + kind: Issuer + commonName: {{ include "rustfs.fullname" . }}-cluster + dnsNames: + - "*.{{ include "rustfs.fullname" . }}-headless" + - "*.{{ include "rustfs.fullname" . }}-headless.{{ .Release.Namespace }}.svc.cluster.local" + - "{{ include "rustfs.fullname" . }}-svc.{{ .Release.Namespace }}.svc.cluster.local" + {{- range .Values.ingress.hosts }} + - {{ .host | quote }} + - {{ printf "*.%s" .host | quote }} + {{- end }} + usages: + - server auth +{{- end }} \ No newline at end of file diff --git a/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml new file mode 100644 index 000000000..41fc8dc35 --- /dev/null +++ b/helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml @@ -0,0 +1,14 @@ +{{- if .Values.mtls.enabled }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "rustfs.fullname" . }}-client-tls +spec: + secretName: {{ include "rustfs.fullname" . }}-client-tls + issuerRef: + name: {{ include "rustfs.fullname" . }}-ca-issuer + kind: Issuer + commonName: {{ include "rustfs.fullname" . }}-cluster + usages: + - client auth +{{- end }} diff --git a/helm/rustfs/templates/cert-manager-mtls/servers-transport.yaml b/helm/rustfs/templates/cert-manager-mtls/servers-transport.yaml new file mode 100644 index 000000000..b26f5457f --- /dev/null +++ b/helm/rustfs/templates/cert-manager-mtls/servers-transport.yaml @@ -0,0 +1,15 @@ +{{- if and .Values.mtls.enabled (eq .Values.ingress.className "traefik")}} +apiVersion: traefik.io/v1alpha1 +kind: ServersTransport +metadata: + name: {{ include "rustfs.fullname" . }}-transport +spec: + rootcas: + - {{ include "rustfs.fullname" . }}-root-ca-secret + certificatesSecrets: + - {{ include "rustfs.fullname" . }}-mtls-secret + insecureSkipVerify: true + {{- range .Values.ingress.hosts }} + serverName: {{ .host | quote }} + {{- end }} +{{- end }} diff --git a/helm/rustfs/templates/configmap.yaml b/helm/rustfs/templates/configmap.yaml index c55277847..065e7e851 100644 --- a/helm/rustfs/templates/configmap.yaml +++ b/helm/rustfs/templates/configmap.yaml @@ -34,4 +34,11 @@ data: RUSTFS_VOLUMES: {{ .Values.config.rustfs.volumes | default (include "rustfs.volumes" .) | quote }} {{- else }} RUSTFS_VOLUMES: "/data" - {{- end }} \ No newline at end of file + {{- end }} + {{- if .Values.mtls.enabled }} + RUSTFS_SERVER_MTLS_ENABLE: "1" + RUSTFS_TLS_KEYLOG: "1" + RUSTFS_TLS_PATH: "/opt/tls" + {{- end }} + # RUSTFS_MTLS_CLIENT_CERT: "/opt/tls/client_cert.pem" + # RUSTFS_MTLS_CLIENT_KEY: "/opt/tls/client_key.pem" \ No newline at end of file diff --git a/helm/rustfs/templates/service.yaml b/helm/rustfs/templates/service.yaml index 347383ab5..ce824fc86 100644 --- a/helm/rustfs/templates/service.yaml +++ b/helm/rustfs/templates/service.yaml @@ -27,13 +27,13 @@ apiVersion: v1 kind: Service metadata: name: {{ include "rustfs.fullname" . }}-svc - {{- if .Values.mode.distributed.enabled }} - {{- if eq .Values.ingress.className "traefik" }} - {{- with .Values.ingress.traefikAnnotations }} + {{- if and .Values.mode.distributed.enabled (eq .Values.ingress.className "traefik")}} annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} + {{- toYaml .Values.ingress.traefikAnnotations | nindent 4 }} + {{- if and .Values.mtls.enabled (eq .Values.ingress.className "traefik") }} + traefik.ingress.kubernetes.io/service.serversscheme: https + traefik.ingress.kubernetes.io/service.serverstransport: {{ .Release.Namespace }}-{{ include "rustfs.fullname" . }}-transport@kubernetescrd + {{- end }} {{- end }} labels: {{- include "rustfs.labels" . | nindent 4 }} diff --git a/helm/rustfs/templates/statefulset.yaml b/helm/rustfs/templates/statefulset.yaml index 911be352e..6c55bbbb9 100644 --- a/helm/rustfs/templates/statefulset.yaml +++ b/helm/rustfs/templates/statefulset.yaml @@ -118,11 +118,29 @@ spec: name: {{ include "rustfs.secretName" . }} resources: {{- toYaml .Values.resources | nindent 12 }} - livenessProbe: - {{- toYaml .Values.livenessProbe | nindent 12 }} - readinessProbe: - {{- toYaml .Values.readinessProbe | nindent 12 }} volumeMounts: + {{- if .Values.mtls.enabled }} + {{- if not .Values.mtls.serverOnly }} + - name: client-cert + mountPath: /opt/tls/client_cert.pem + subPath: client_cert.pem + - name: client-cert + mountPath: /opt/tls/client_key.pem + subPath: client_key.pem + - name: client-cert + mountPath: /opt/tls/client_ca.crt + subPath: client_ca.crt + {{- end }} + - name: server-cert + mountPath: /opt/tls/rustfs_cert.pem + subPath: rustfs_cert.pem + - name: server-cert + mountPath: /opt/tls/rustfs_key.pem + subPath: rustfs_key.pem + - name: server-cert + mountPath: /opt/tls/ca.crt + subPath: ca.crt + {{- end }} - name: logs mountPath: {{ $logDir }} subPath: logs @@ -135,6 +153,31 @@ spec: - name: data mountPath: /data {{- end }} + {{- if .Values.mtls.enabled }} + volumes: + - name: server-cert + secret: + secretName: rustfs-server-tls + items: + - key: tls.crt + path: rustfs_cert.pem + - key: tls.key + path: rustfs_key.pem + - key: ca.crt + path: ca.crt + {{- if not .Values.mtls.serverOnly }} + - name: client-cert + secret: + secretName: rustfs-client-tls + items: + - key: tls.crt + path: client_cert.pem + - key: tls.key + path: client_key.pem + - key: ca.crt + path: client_ca.crt + {{- end }} + {{- end }} volumeClaimTemplates: - metadata: name: logs diff --git a/helm/rustfs/values.yaml b/helm/rustfs/values.yaml index 8d35dcf50..8e6341ca2 100644 --- a/helm/rustfs/values.yaml +++ b/helm/rustfs/values.yaml @@ -160,6 +160,11 @@ gatewayApi: name: "" namespace: "" +mtls: + enabled: false + serverOnly: false # If true, only server side TLS will be enabled. If false, both server and client side TLS will be enabled. + # This is for setting up mTLS for ingress. + resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little