Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Custom certs for s3 https access #57

Merged
merged 7 commits into from
Sep 17, 2021
Merged

Custom certs for s3 https access #57

merged 7 commits into from
Sep 17, 2021

Conversation

spilchen
Copy link
Collaborator

This adds a new parameter to the .spec.communal section to allow a CA certificate to be specified. This will allow access to any https s3 endpoint, previously for https we only supported AWS.

The new parameter is called .spec.communal.caFile. It references a file that must exist in the container. You can mount the cert using the .spec.certSecrets.

Here is an example:

  1. Create a secret that contains the certificate to use.
$ kubectl create secret generic my-cert --from-file=root_cert.pem
  1. Create a CR that mounts this secret, then reference the secret in the new caFile field.
apiVersion: vertica.com/v1beta1
kind: VerticaDB
metadata:
  name: sample
spec:
  communal:
    path: "s3://nimbusdb/db"
    endpoint: "https://minio"
    credentialSecret: s3-auth
    caFile: /certs/my-certs/root_cert.pem
  certsSecrets:
    - name: my-cert 
  subclusters:
    - name: sc1

In order to test this out, the e2e test was converted to run with minio with an https endpoint. An early commit had introduced two endpoints for testing, and changed the tests to use one of the endpoints. Much of that was undone as this went back to having a single endpoint for the entire test.

In order to get minio https working in the e2e tests, the versions of cert-manager and minio were updated.

Closes #45

@spilchen spilchen merged commit ce5107b into vertica:main Sep 17, 2021
@spilchen spilchen deleted the cafile branch September 17, 2021 20:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CA path for the https communal storage
1 participant