mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2025-06-13 10:33:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

util: add support for vault certificates

Browse Source 
Added a option to pass the client certificate
and the client certificate key for the vault token
based encryption.

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit is contained in:
Madhu Rajanna
2020-12-15 12:41:28 +05:30
committed by mergify[bot]
parent 3109160fa0
commit 81061e9f68
5 changed files with 232 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
docs/design/proposals/encryption-with-vault-tokens.md
View File

@ -180,8 +180,73 @@ data:
vaultBackendPath: "secret/ceph-csi-encryption/"
vaultTLSServerName: "vault.infosec.example.org"
vaultCAFromSecret: "vault-infosec-ca"
vaultClientCertFromSecret: "vault-client-cert"
vaultClientCertKeyFromSecret: "vault-client-cert-key"
vaultCAVerify: "true"
```
Only parameters with the `vault`-prefix may be changed in the Kubernetes
ConfigMap of the Tenant.
### Certificates stored in the Tenants Kubernetes Namespace
The `vaultCAFromSecret` , `vaultClientCertFromSecret` and
`vaultClientCertKeyFromSecret` secrets should be created in the namespace where
Ceph-CSI is deployed. The sample of secrets for the CA and client Certificate.
#### CA Certificate to verify Vault server TLS certificate
```yaml
---
apiVersion: v1
kind: secret
metadata:
name: vault-infosec-ca
stringData:
ca.cert: |
MIIC2DCCAcCgAwIBAgIBATANBgkqh...
```
#### Client Certificate for Vault connection
```yaml
---
apiVersion: v1
kind: secret
metadata:
name: vault-client-cert
stringData:
tls.cert: |
BATANBgkqcCgAwIBAgIBATANBAwI...
```
#### Client Certificate key for Vault connection
```yaml
---
apiVersion: v1
kind: secret
metadata:
name: vault-client-cert-key
stringData:
tls.key: |
KNSC2DVVXcCgkqcCgAwIBAgIwewrvx...
```
Its also possible that a user can create a single secret for the certificates
and update the configuration to fetch certificates from a secret.
```yaml
---
apiVersion: v1
kind: secret
metadata:
name: vault-certificates
stringData:
ca.cert: |
MIIC2DCCAcCgAwIBAgIBATANBgkqh...
tls.cert: |
BATANBgkqcCgAwIBAgIBATANBAwI...
tls.key: |
KNSC2DVVXcCgkqcCgAwIBAgIwewrvx...
```