Skip to content

Commit e133290

Browse files
jotakjotak
committed
Fix issue with TLS Auto, where server cert was not created
Also: - add tests - improve docs - add validation hook on provided
1 parent 28b77c0 commit e133290

File tree

13 files changed

+369
-53
lines changed

13 files changed

+369
-53
lines changed

‎README.md‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,11 @@ Cert-manager and Trust-manager have to be installed separately. For example, usi
3838

3939
```bash
4040
helm repo add cert-manager https://charts.jetstack.io
41-
helm install my-cert-manager cert-manager/cert-manager --set crds.enabled=true
41+
helm install cert-manager -n cert-manager --create-namespace cert-manager/cert-manager --set crds.enabled=true
4242
helm upgrade trust-manager oci://quay.io/jetstack/charts/trust-manager --install --namespace cert-manager --wait
4343
```
4444

45-
If you don't want to use Cert-manager and Trust-manager, you will need to provide the expected certificates by other means (refer to [TLS.md](./docs/TLS.md)).
45+
If you don't want to use Cert-manager and Trust-manager, you need to provide certificates by other means: refer to [TLS.md](./docs/TLS.md).
4646

4747
Prometheus and Loki can be installed separately, or as dependencies of NetObserv (see below).
4848

@@ -63,7 +63,36 @@ helm install netobserv -n netobserv --create-namespace --set install.loki=true -
6363
helm install netobserv -n netobserv --create-namespace netobserv/netobserv-operator
6464
```
6565

66-
You can then create a `FlowCollector` resource ([full API reference](https://github.com/netobserv/network-observability-operator/blob/main/docs/FlowCollector.md#flowsnetobserviov1beta2)). A short `FlowCollector` should work; an example is provided in the post-install welcome message.
66+
You can then create a `FlowCollector` resource ([full API reference](https://github.com/netobserv/network-observability-operator/blob/main/docs/FlowCollector.md#flowsnetobserviov1beta2)). A short `FlowCollector` should work:
67+
68+
```bash
69+
cat <<EOF | kubectl apply -f -
70+
apiVersion: flows.netobserv.io/v1beta2
71+
kind: FlowCollector
72+
metadata:
73+
name: cluster
74+
spec:
75+
namespace: netobserv
76+
networkPolicy:
77+
enable: false
78+
consolePlugin:
79+
standalone: true
80+
processor:
81+
service:
82+
tlsType: Auto-mTLS
83+
loki:
84+
mode: Monolithic
85+
monolithic:
86+
url: 'http://netobserv-loki.netobserv.svc.cluster.local.:3100/'
87+
prometheus:
88+
querier:
89+
mode: Manual
90+
manual:
91+
url: http://netobserv-prom-stack-prometheus.netobserv.svc.cluster.local.:9090/
92+
alertManager:
93+
url: http://netobserv-prom-stack-alertmanager.netobserv.svc.cluster.local.:9093/
94+
EOF
95+
```
6796

6897
A few remarks:
6998
- You can change the Prometheus and Loki URLs depending on your installation. The `FlowCollector` example works if you use the "standalone" installation described above, with `install.loki=true` and `install.prom-stack=true`. Check more configuration options for [Prometheus](https://github.com/netobserv/network-observability-operator/blob/main/docs/FlowCollector.md#flowcollectorspecprometheus-1) and [Loki](https://github.com/netobserv/network-observability-operator/blob/main/docs/FlowCollector.md#flowcollectorspecloki-1).

‎RELEASE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,10 @@ metadata:
5656
spec:
5757
networkPolicy:
5858
enable: false
59-
consumerReplicas: 1
6059
consolePlugin:
6160
standalone: true
6261
processor:
62+
consumerReplicas: 1
6363
service:
6464
tlsType: Auto-mTLS
6565
loki:

‎api/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,7 +423,8 @@ type FlowCollectorKafka struct {
423423
// Kafka topic to use. It must exist. NetObserv does not create it.
424424
Topic string `json:"topic"`
425425

426-
// TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
426+
// TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
427+
// We recommend the use of mTLS for higher security standards.
427428
// +optional
428429
TLS ClientTLS `json:"tls"`
429430

‎api/flowcollector/v1beta2/flowcollector_validation_webhook.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ func (v *validator) validateFLP() {
247247
v.validateFLPFilters()
248248
v.validateFLPAlerts()
249249
v.validateFLPMetricsForAlerts()
250+
v.validateFLPTLS()
250251
}
251252

252253
func (v *validator) validateScheduling() {
@@ -421,6 +422,27 @@ func (v *validator) validateFLPMetricsForAlerts() {
421422
}
422423
}
423424

425+
func (v *validator) validateFLPTLS() {
426+
if v.fc.DeploymentModel == DeploymentModelService && v.fc.Processor.Service != nil && v.fc.Processor.Service.TLSType == TLSProvided {
427+
if v.fc.Processor.Service.ProvidedCertificates == nil {
428+
v.errors = append(
429+
v.errors,
430+
errors.New("missing configuration in spec.processor.providedCertificates despite spec.processor.tlsType being set to Provided"),
431+
)
432+
} else if v.fc.Processor.Service.ProvidedCertificates.CAFile == nil {
433+
v.errors = append(
434+
v.errors,
435+
errors.New("missing configuration in spec.processor.providedCertificates.caFile despite spec.processor.tlsType being set to Provided"),
436+
)
437+
} else if v.fc.Processor.Service.ProvidedCertificates.ServerCert == nil {
438+
v.errors = append(
439+
v.errors,
440+
errors.New("missing configuration in spec.processor.providedCertificates.serverCert despite spec.processor.tlsType being set to Provided"),
441+
)
442+
}
443+
}
444+
}
445+
424446
func GetFirstRequiredMetrics(anyRequired, actual []string) string {
425447
for _, m := range anyRequired {
426448
if slices.Contains(actual, m) {

‎api/flowcollector/v1beta2/flowcollector_validation_webhook_test.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -860,6 +860,21 @@ func TestValidateFLP(t *testing.T) {
860860
},
861861
},
862862
},
863+
{
864+
name: "Missing provided TLS config",
865+
ocpVersion: "4.18.0",
866+
fc: &FlowCollector{
867+
Spec: FlowCollectorSpec{
868+
DeploymentModel: DeploymentModelService,
869+
Processor: FlowCollectorFLP{
870+
Service: &ProcessorServiceConfig{
871+
TLSType: TLSProvided,
872+
},
873+
},
874+
},
875+
},
876+
expectedError: "missing configuration in spec.processor.providedCertificates despite spec.processor.tlsType being set to Provided",
877+
},
863878
}
864879

865880
CurrentClusterInfo = &cluster.Info{}

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3358,9 +3358,9 @@ spec:
33583358
type: string
33593359
type: object
33603360
tls:
3361-
description: TLS client configuration. When using TLS, verify
3362-
that the address matches the Kafka port used for TLS,
3363-
generally 9093.
3361+
description: |-
3362+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
3363+
We recommend the use of mTLS for higher security standards.
33643364
properties:
33653365
caCert:
33663366
description: '`caCert` defines the reference of the
@@ -3677,9 +3677,9 @@ spec:
36773677
type: string
36783678
type: object
36793679
tls:
3680-
description: TLS client configuration. When using TLS, verify
3681-
that the address matches the Kafka port used for TLS, generally
3682-
9093.
3680+
description: |-
3681+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
3682+
We recommend the use of mTLS for higher security standards.
36833683
properties:
36843684
caCert:
36853685
description: '`caCert` defines the reference of the certificate

‎config/crd/bases/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3138,7 +3138,9 @@ spec:
31383138
type: string
31393139
type: object
31403140
tls:
3141-
description: TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
3141+
description: |-
3142+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
3143+
We recommend the use of mTLS for higher security standards.
31423144
properties:
31433145
caCert:
31443146
description: '`caCert` defines the reference of the certificate for the Certificate Authority.'
@@ -3409,7 +3411,9 @@ spec:
34093411
type: string
34103412
type: object
34113413
tls:
3412-
description: TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
3414+
description: |-
3415+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
3416+
We recommend the use of mTLS for higher security standards.
34133417
properties:
34143418
caCert:
34153419
description: '`caCert` defines the reference of the certificate for the Certificate Authority.'

‎docs/FlowCollector.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6161,7 +6161,8 @@ Kafka configuration, such as the address and topic, to send enriched flows to.
61616161
<td><b><a href="#flowcollectorspecexportersindexkafkatls">tls</a></b></td>
61626162
<td>object</td>
61636163
<td>
6164-
TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.<br/>
6164+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
6165+
We recommend the use of mTLS for higher security standards.<br/>
61656166
</td>
61666167
<td>false</td>
61676168
</tr></tbody>
@@ -6323,7 +6324,8 @@ If the namespace is different, the config map or the secret is copied so that it
63236324

63246325

63256326

6326-
TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
6327+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
6328+
We recommend the use of mTLS for higher security standards.
63276329

63286330
<table>
63296331
<thead>
@@ -6901,7 +6903,8 @@ Kafka configuration, allowing to use Kafka as a broker as part of the flow colle
69016903
<td><b><a href="#flowcollectorspeckafkatls">tls</a></b></td>
69026904
<td>object</td>
69036905
<td>
6904-
TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.<br/>
6906+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
6907+
We recommend the use of mTLS for higher security standards.<br/>
69056908
</td>
69066909
<td>false</td>
69076910
</tr></tbody>
@@ -7063,7 +7066,8 @@ If the namespace is different, the config map or the secret is copied so that it
70637066

70647067

70657068

7066-
TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
7069+
TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
7070+
We recommend the use of mTLS for higher security standards.
70677071

70687072
<table>
70697073
<thead>

‎docs/TLS.md‎

Lines changed: 90 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,126 @@
1-
## TLS and expected certificates
1+
# TLS and expected certificates
22

33
This document lists all required and optional TLS certificates for NetObserv. You can also refer to the [Helm chart templates](../helm/templates/certificates.yaml) for cert-manager.
44

5+
## Required certificates
6+
7+
Those certificates are always required and are not configurable:
8+
59
<table>
610
<thead>
711
<tr>
812
<th>Service name</th>
9-
<th>Required</th>
1013
<th>Resource kind</th>
1114
<th>Resource name</th>
1215
<th>Resource keys</th>
13-
<th>Notes</th>
1416
</tr>
1517
</thead>
1618
<tbody>
1719
<tr>
1820
<td>netobserv-webhook-service</td>
19-
<td>yes</td>
2021
<td>Secret</td>
2122
<td>webhook-server-cert</td>
22-
<td>ca.crt, tls.crt, tls.key</td>
23-
<td></td>
23+
<td>tls.crt, tls.key</td>
2424
</tr>
2525
<tr>
2626
<td>netobserv-metrics-service</td>
27-
<td>yes</td>
2827
<td>Secret</td>
2928
<td>manager-metrics-tls</td>
30-
<td>ca.crt, tls.crt, tls.key</td>
29+
<td>tls.crt, tls.key</td>
30+
</tr>
31+
</tbody>
32+
</table>
33+
34+
## Agent to FLP certificates
35+
36+
When `spec.deploymentModel` is "Service", the traffic from eBPF agents to flowlogs-pipeline pods uses TLS by default. It is possible to disable TLS, though not recommended in production-grade environments, as it decreases the security of the NetObserv deployments.
37+
38+
In "Kafka" mode, the TLS/SASL configuration depends on your installation. The Kafka clients used in NetObserv support simple TLS, mTLS, SASL as well as no TLS. We recommend the use of mTLS for higher security standards.
39+
40+
In "Direct" mode, the traffic doesn't leave the host and is not encrypted.
41+
42+
The tables below apply to the "Service" mode.
43+
44+
### Auto (TLS)
45+
46+
When `spec.processor.service.tlsType` is "Auto":
47+
48+
<table>
49+
<thead>
50+
<tr>
51+
<th>Needed by</th>
52+
<th>Resource kind</th>
53+
<th>Resource name</th>
54+
<th>Resource keys</th>
55+
<th>Notes</th>
56+
</tr>
57+
</thead>
58+
<tbody>
59+
<tr>
60+
<td>flowlogs-pipeline</td>
61+
<td>Secret</td>
62+
<td>flowlogs-pipeline-cert</td>
63+
<td>tls.crt, tls.key</td>
3164
<td></td>
3265
</tr>
66+
<tr>
67+
<td>eBPF Agents</td>
68+
<td>ConfigMap</td>
69+
<td>netobserv-ca</td>
70+
<td>service-ca.crt</td>
71+
<td>Must be installed in netobserv-privileged namespace.</td>
72+
</tr>
73+
</tbody>
74+
</table>
75+
76+
### Auto (mTLS)
77+
78+
When `spec.processor.service.tlsType` is "Auto-mTLS":
79+
80+
<table>
81+
<thead>
82+
<tr>
83+
<th>Needed by</th>
84+
<th>Resource kind</th>
85+
<th>Resource name</th>
86+
<th>Resource keys</th>
87+
<th>Notes</th>
88+
</tr>
89+
</thead>
90+
<tbody>
3391
<tr>
3492
<td>flowlogs-pipeline</td>
35-
<td>no</td>
3693
<td>Secret</td>
3794
<td>flowlogs-pipeline-cert</td>
38-
<td>ca.crt, tls.crt, tls.key</td>
39-
<td>Only used when spec.deploymentModel is "Service".</td>
95+
<td>tls.crt, tls.key</td>
96+
<td></td>
4097
</tr>
4198
<tr>
42-
<td>flowlogs-pipeline CA</td>
43-
<td>no</td>
99+
<td>flowlogs-pipeline</td>
44100
<td>ConfigMap</td>
45101
<td>netobserv-ca</td>
46102
<td>service-ca.crt</td>
47-
<td>Must be installed in netobserv-privileged namespace. Only used when spec.deploymentModel is "Service".</td>
103+
<td></td>
104+
</tr>
105+
<tr>
106+
<td>eBPF Agents</td>
107+
<td>Secret</td>
108+
<td>ebpf-agent-cert</td>
109+
<td>tls.crt, tls.key</td>
110+
<td>Must be installed in netobserv-privileged namespace.</td>
111+
</tr>
112+
<tr>
113+
<td>eBPF Agents</td>
114+
<td>ConfigMap</td>
115+
<td>netobserv-ca</td>
116+
<td>service-ca.crt</td>
117+
<td>Must be installed in netobserv-privileged namespace.</td>
48118
</tr>
49119
</tbody>
50120
</table>
121+
122+
### Provided
123+
124+
When `spec.processor.service.tlsType` is "Provided", you can specify any Secret or ConfigMap for TLS or mTLS, via `spec.processor.service.providedCertificates`.
125+
126+
For mTLS, configure `spec.processor.service.providedCertificates.clientCert`. For simple TLS, do not set the client cert config.

‎helm/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ Cert-manager and Trust-manager have to be installed separately. For example, usi
3434

3535
```bash
3636
helm repo add cert-manager https://charts.jetstack.io
37-
helm install my-cert-manager cert-manager/cert-manager --set crds.enabled=true
37+
helm install cert-manager -n cert-manager --create-namespace cert-manager/cert-manager --set crds.enabled=true
3838
helm upgrade trust-manager oci://quay.io/jetstack/charts/trust-manager --install --namespace cert-manager --wait
3939
```
4040

41-
If you don't want to use Cert-manager and Trust-manager, you will need to provide the expected certificates by other means (refer to [TLS.md](https://github.com/netobserv/network-observability-operator/blob/main/docs/TLS.md)).
41+
If you don't want to use Cert-manager and Trust-manager, you need to provide certificates by other means: refer to [TLS.md](https://github.com/netobserv/network-observability-operator/blob/main/docs/TLS.md).
4242

4343
Prometheus and Loki can be installed separately, or as dependencies of NetObserv (see below).
4444

0 commit comments

Comments
 (0)