From d150358f2d8e791bd88eb89e8f09532c42ef49c1 Mon Sep 17 00:00:00 2001 From: Rudro-25 Date: Fri, 1 Nov 2024 20:08:11 +0600 Subject: [PATCH] add enable tls docs Signed-off-by: Rudro-25 --- .../reconfigure-tls/zkops-remove.yaml | 11 + .../reconfigure-tls/zkops-rotate.yaml | 11 + .../reconfigure-tls/zookeeper-add-tls.yaml | 24 + .../reconfigure-tls/zookeeper-issuer.yaml | 8 + .../reconfigure-tls/zookeeper-new-issuer.yaml | 8 + .../zookeeper-update-tls-issuer.yaml | 14 + .../zookeeper/reconfigure-tls/zookeeper.yaml | 16 + .../zookeeper/tls/zookeeper-issuer.yaml | 8 + .../examples/zookeeper/tls/zookeeper-tls.yaml | 22 + .../zookeeper/reconfigure-tls/_index.md | 10 + .../zookeeper/reconfigure-tls/overview.md | 54 + .../reconfigure-tls/reconfigure-tls.md | 1014 +++++++++++++++++ .../zookeeper/reconfigure/reconfigure.md | 136 ++- docs/guides/zookeeper/restart/restart.md | 1 - docs/guides/zookeeper/tls/_index.md | 10 + docs/guides/zookeeper/tls/configure_ssl.md | 268 +++++ docs/guides/zookeeper/tls/overview.md | 70 ++ .../zookeeper/zk-reconfigure-tls.svg | 3 + docs/images/zookeeper/zk-tls.svg | 4 + 19 files changed, 1637 insertions(+), 55 deletions(-) create mode 100644 docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml create mode 100644 docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml create mode 100644 docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml create mode 100644 docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml create mode 100644 docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml create mode 100644 docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml create mode 100644 docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml create mode 100644 docs/examples/zookeeper/tls/zookeeper-issuer.yaml create mode 100644 docs/examples/zookeeper/tls/zookeeper-tls.yaml create mode 100644 docs/guides/zookeeper/reconfigure-tls/_index.md create mode 100644 docs/guides/zookeeper/reconfigure-tls/overview.md create mode 100644 docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md create mode 100644 docs/guides/zookeeper/tls/_index.md create mode 100644 docs/guides/zookeeper/tls/configure_ssl.md create mode 100644 docs/guides/zookeeper/tls/overview.md create mode 100644 docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg create mode 100644 docs/images/zookeeper/zk-tls.svg diff --git a/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml b/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml new file mode 100644 index 0000000000..714c89ae57 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml @@ -0,0 +1,11 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-remove + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + remove: true \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml b/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml new file mode 100644 index 0000000000..16d11432f4 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml @@ -0,0 +1,11 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-rotate + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + rotateCertificates: true \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml new file mode 100644 index 0000000000..df73317be2 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml @@ -0,0 +1,24 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-add-tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zookeeper-ca-issuer + kind: Issuer + apiGroup: "cert-manager.io" + certificates: + - alias: client + subject: + organizations: + - zookeeper + organizationalUnits: + - client + timeout: 5m + apply: IfReady + ``` \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml new file mode 100644 index 0000000000..5d0f5284be --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml new file mode 100644 index 0000000000..f411e6c0f6 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-new-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-new-ca \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml new file mode 100644 index 0000000000..425f2eea92 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml @@ -0,0 +1,14 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-update-issuer + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zk-new-issuer + kind: Issuer + apiGroup: "cert-manager.io" \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml new file mode 100644 index 0000000000..c121a2d2fd --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml @@ -0,0 +1,16 @@ +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-quickstart + namespace: demo +spec: + version: "3.8.3" + adminServerPort: 8080 + replicas: 3 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" \ No newline at end of file diff --git a/docs/examples/zookeeper/tls/zookeeper-issuer.yaml b/docs/examples/zookeeper/tls/zookeeper-issuer.yaml new file mode 100644 index 0000000000..cee750e080 --- /dev/null +++ b/docs/examples/zookeeper/tls/zookeeper-issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zookeeper-ca-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca \ No newline at end of file diff --git a/docs/examples/zookeeper/tls/zookeeper-tls.yaml b/docs/examples/zookeeper/tls/zookeeper-tls.yaml new file mode 100644 index 0000000000..eafa468bb7 --- /dev/null +++ b/docs/examples/zookeeper/tls/zookeeper-tls.yaml @@ -0,0 +1,22 @@ +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-quickstart + namespace: demo +spec: + version: "3.8.3" + enableSSL: true + tls: + issuerRef: + apiGroup: "cert-manager.io" + kind: Issuer + name: zookeeper-ca-issuer + adminServerPort: 8080 + replicas: 5 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" \ No newline at end of file diff --git a/docs/guides/zookeeper/reconfigure-tls/_index.md b/docs/guides/zookeeper/reconfigure-tls/_index.md new file mode 100644 index 0000000000..5d3b1e62d4 --- /dev/null +++ b/docs/guides/zookeeper/reconfigure-tls/_index.md @@ -0,0 +1,10 @@ +--- +title: Reconfigure TLS/SSL +menu: + docs_{{ .version }}: + identifier: zk-reconfigure-tls + name: Reconfigure TLS/SSL + parent: zk-zookeeper-guides + weight: 46 +menu_name: docs_{{ .version }} +--- diff --git a/docs/guides/zookeeper/reconfigure-tls/overview.md b/docs/guides/zookeeper/reconfigure-tls/overview.md new file mode 100644 index 0000000000..0fb04d0833 --- /dev/null +++ b/docs/guides/zookeeper/reconfigure-tls/overview.md @@ -0,0 +1,54 @@ +--- +title: Reconfiguring TLS/SSL +menu: + docs_{{ .version }}: + identifier: kf-reconfigure-tls-overview + name: Overview + parent: kf-reconfigure-tls + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# Reconfiguring TLS of ZooKeeper + +This guide will give an overview on how KubeDB Ops-manager operator reconfigures TLS configuration i.e. add TLS, remove TLS, update issuer/cluster issuer or Certificates and rotate the certificates of `ZooKeeper`. + +## Before You Begin + +- You should be familiar with the following `KubeDB` concepts: + - [ZooKeeper](/docs/guides/zookeeper/concepts/zookeeper.md) + - [ZooKeeperOpsRequest](/docs/guides/zookeeper/concepts/zookeeperopsrequest.md) + +## How Reconfiguring ZooKeeper TLS Configuration Process Works + +The following diagram shows how KubeDB Ops-manager operator reconfigures TLS of a `ZooKeeper`. Open the image in a new tab to see the enlarged version. + +
+  Reconfiguring TLS process of ZooKeeper +
Fig: Reconfiguring TLS process of ZooKeeper
+
+ +The Reconfiguring ZooKeeper TLS process consists of the following steps: + +1. At first, a user creates a `ZooKeeper` Custom Resource Object (CRO). + +2. `KubeDB` Provisioner operator watches the `ZooKeeper` CRO. + +3. When the operator finds a `ZooKeeper` CR, it creates required number of `PetSets` and related necessary stuff like secrets, services, etc. + +4. Then, in order to reconfigure the TLS configuration of the `ZooKeeper` database the user creates a `ZooKeeperOpsRequest` CR with desired information. + +5. `KubeDB` Ops-manager operator watches the `ZooKeeperOpsRequest` CR. + +6. When it finds a `ZooKeeperOpsRequest` CR, it pauses the `ZooKeeper` object which is referred from the `ZooKeeperOpsRequest`. So, the `KubeDB` Provisioner operator doesn't perform any operations on the `ZooKeeper` object during the reconfiguring TLS process. + +7. Then the `KubeDB` Ops-manager operator will add, remove, update or rotate TLS configuration based on the Ops Request yaml. + +8. Then the `KubeDB` Ops-manager operator will restart all the Pods of the database so that they restart with the new TLS configuration defined in the `ZooKeeperOpsRequest` CR. + +9. After the successful reconfiguring of the `ZooKeeper` TLS, the `KubeDB` Ops-manager operator resumes the `ZooKeeper` object so that the `KubeDB` Provisioner operator resumes its usual operations. + +In the next docs, we are going to show a step by step guide on reconfiguring TLS configuration of a ZooKeeper database using `ZooKeeperOpsRequest` CRD. \ No newline at end of file diff --git a/docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md b/docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md new file mode 100644 index 0000000000..07e3dcde73 --- /dev/null +++ b/docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md @@ -0,0 +1,1014 @@ +--- +title: Reconfigure ZooKeeper TLS/SSL Encryption +menu: + docs_{{ .version }}: + identifier: zk-reconfigure-tls-zookeeper + name: Reconfigure ZooKeeper TLS/SSL Encryption + parent: zk-reconfigure-tls + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# Reconfigure ZooKeeper TLS/SSL (Transport Encryption) + +KubeDB supports reconfigure i.e. add, remove, update and rotation of TLS/SSL certificates for existing ZooKeeper database via a ZooKeeperOpsRequest. This tutorial will show you how to use KubeDB to reconfigure TLS/SSL encryption. + +## Before You Begin + +- At first, you need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one by using [kind](https://kind.sigs.k8s.io/docs/user/quick-start/). + +- Install [`cert-manger`](https://cert-manager.io/docs/installation/) v1.0.0 or later to your cluster to manage your SSL/TLS certificates. + +- Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md). + +- To keep things isolated, this tutorial uses a separate namespace called `demo` throughout this tutorial. + + ```bash + $ kubectl create ns demo + namespace/demo created + ``` + +> Note: YAML files used in this tutorial are stored in [docs/examples/zookeeper](https://github.com/kubedb/docs/tree/{{< param "info.version" >}}/docs/examples/zookeeper) folder in GitHub repository [kubedb/docs](https://github.com/kubedb/docs). + +## Add TLS to a ZooKeeper database + +Here, We are going to create a ZooKeeper without TLS and then reconfigure the database to use TLS. + +### Deploy ZooKeeper without TLS + +In this section, we are going to deploy a ZooKeeper ensemble without TLS. In the next few sections we will reconfigure TLS using `ZooKeeperOpsRequest` CRD. Below is the YAML of the `ZooKeeper` CR that we are going to create, + +```yaml +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-quickstart + namespace: demo +spec: + version: "3.8.3" + adminServerPort: 8080 + replicas: 3 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" + +``` + +Let's create the `ZooKeeper` CR we have shown above, + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml +zookeeper.kubedb.com/zk-quickstart created +``` + +Now, wait until `zk-quickstart` has status `Ready`. i.e, + +```bash +$ watch kubectl get zookeeper -n demo +NAME TYPE VERSION STATUS AGE +zk-quickstart kubedb.com/v1alpha2 3.8.3 Ready 60s +``` + +Now, we can exec one zookeeper broker pod and verify configuration that the TLS is disabled. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cat ../conf/zoo.cfg +4lw.commands.whitelist=* +dataDir=/data +tickTime=2000 +initLimit=10 +syncLimit=2 +clientPort=2181 +globalOutstandingLimit=1000 +preAllocSize=65536 +snapCount=10000 +commitLogCount=500 +snapSizeLimitInKb=4194304 +maxCnxns=0 +maxClientCnxns=60 +minSessionTimeout=4000 +maxSessionTimeout=40000 +autopurge.snapRetainCount=3 +autopurge.purgeInterval=1 +quorumListenOnAllIPs=false +admin.serverPort=8080 +authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider +reconfigEnabled=true +standaloneEnabled=false +dynamicConfigFile=/data/zoo.cfg.dynamic +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ +``` + +We can verify from the above output that TLS is disabled for this Ensemble. + +### Create Issuer/ ClusterIssuer + +Now, We are going to create an example `Issuer` that will be used to enable SSL/TLS in ZooKeeper. Alternatively, you can follow this [cert-manager tutorial](https://cert-manager.io/docs/configuration/ca/) to create your own `Issuer`. + +- Start off by generating a ca certificates using openssl. + +```bash +$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=ca/O=kubedb" +Generating a RSA private key +................+++++ +........................+++++ +writing new private key to './ca.key' +----- +``` + +- Now we are going to create a ca-secret using the certificate files that we have just generated. + +```bash +$ kubectl create secret tls zookeeper-ca \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=demo +secret/zookeeper-ca created +``` + +Now, Let's create an `Issuer` using the `zookeeper-ca` secret that we have just created. The `YAML` file looks like this: + +```yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca +``` + +Let's apply the `YAML` file: + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml +issuer.cert-manager.io/zk-issuer created +``` + +### Create ZooKeeperOpsRequest + +In order to add TLS to the zookeeper, we have to create a `ZooKeeperOpsRequest` CRO with our created issuer. Below is the YAML of the `ZooKeeperOpsRequest` CRO that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-add-tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zookeeper-ca-issuer + kind: Issuer + apiGroup: "cert-manager.io" + certificates: + - alias: client + subject: + organizations: + - zookeeper + organizationalUnits: + - client + timeout: 5m + apply: IfReady +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart` cluster. +- `spec.type` specifies that we are performing `ReconfigureTLS` on zookeeper. +- `spec.tls.issuerRef` specifies the issuer name, kind and api group. +- `spec.tls.certificates` specifies the certificates. You can learn more about this field from [here](/docs/guides/zookeeper/concepts/zookeeper.md#spectls). + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml +zookeeperopsrequest.ops.kubedb.com/zkops-add-tls created +``` + +#### Verify TLS Enabled Successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequest -n demo +NAME TYPE STATUS AGE +zkops-add-tls ReconfigureTLS Successful 4m36s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-add-tls +Name: zkops-add-tls +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T05:46:18Z + Generation: 1 + Resource Version: 2118117 + UID: aa25e2b8-2583-4757-b3f7-b053fc21819f +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Issuer Ref: + API Group: cert-manager.io + Kind: Issuer + Name: zookeeper-ca-issuer + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T05:46:18Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T05:46:31Z + Message: Successfully synced all certificates + Observed Generation: 1 + Reason: CertificateSynced + Status: True + Type: CertificateSynced + Last Transition Time: 2024-11-04T05:46:26Z + Message: get certificate; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: GetCertificate + Last Transition Time: 2024-11-04T05:46:26Z + Message: check ready condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: CheckReadyCondition + Last Transition Time: 2024-11-04T05:46:26Z + Message: issuing condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: IssuingCondition + Last Transition Time: 2024-11-04T05:46:36Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T05:48:56Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T05:46:41Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T05:46:41Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T05:46:46Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T05:47:26Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T05:47:26Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T05:48:16Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T05:48:16Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T05:48:56Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: +``` + +Now, Let's exec into a zookeeper ensemble pod and verify the configuration that the TLS is enabled. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cat ../conf/zoo.cfg +4lw.commands.whitelist=* +dataDir=/data +tickTime=2000 +initLimit=10 +syncLimit=2 +clientPort=2181 +globalOutstandingLimit=1000 +preAllocSize=65536 +snapCount=10000 +commitLogCount=500 +snapSizeLimitInKb=4194304 +maxCnxns=0 +maxClientCnxns=60 +minSessionTimeout=4000 +maxSessionTimeout=40000 +autopurge.snapRetainCount=3 +autopurge.purgeInterval=1 +quorumListenOnAllIPs=false +admin.serverPort=8080 +authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider +reconfigEnabled=true +standaloneEnabled=false +dynamicConfigFile=/data/zoo.cfg.dynamic +secureClientPort=2182 +serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory +authProvider.x509=org.apache.zookeeper.server.auth.X509AuthenticationProvider +ssl.keyStore.location=/var/private/ssl/server.keystore.jks +ssl.keyStore.password=fdjk2dgffqn9 +ssl.trustStore.location=/var/private/ssl/server.truststore.jks +ssl.trustStore.password=fdjk2dgffqn9 +sslQuorum=true +ssl.quorum.keyStore.location=/var/private/ssl/server.keystore.jks +ssl.quorum.keyStore.password=fdjk2dgffqn9 +ssl.quorum.trustStore.location=/var/private/ssl/server.truststore.jks +ssl.quorum.trustStore.password=fdjk2dgffqn9 +ssl.quorum.hostnameVerification=false +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ +``` + +We can see from the above output that, keystore location is `/var/private/ssl/server.keystore.jks` which means that TLS is enabled. + +## Rotate Certificate + +Now we are going to rotate the certificate of this cluster. First let's check the current expiration date of the certificate. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ openssl x509 -in /var/private/ssl/tls.crt -inform PEM -enddate -nameopt RFC2253 -noout +notAfter=Feb 2 12:53:30 2025 GMT +``` + +So, the certificate will expire on this time `Feb 2 12:53:30 2025 GMT`. + +### Create ZooKeeperOpsRequest + +Now we are going to increase it using a ZooKeeperOpsRequest. Below is the yaml of the ops request that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-rotate + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + rotateCertificates: true +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart`. +- `spec.type` specifies that we are performing `ReconfigureTLS` on our cluster. +- `spec.tls.rotateCertificates` specifies that we want to rotate the certificate of this zookeeper cluster. + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml +zookeeperopsrequest.ops.kubedb.com/zkops-rotate created +``` + +#### Verify Certificate Rotated Successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequests -n demo zkops-rotate +NAME TYPE STATUS AGE +zkops-rotate ReconfigureTLS Successful 4m4s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-rotate +Name: zkops-rotate +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T13:10:03Z + Generation: 1 + Resource Version: 2153555 + UID: a1886cd3-784b-4523-936c-a510327d6129 +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Rotate Certificates: true + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T13:10:03Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T13:10:16Z + Message: Successfully synced all certificates + Observed Generation: 1 + Reason: CertificateSynced + Status: True + Type: CertificateSynced + Last Transition Time: 2024-11-04T13:10:11Z + Message: get certificate; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: GetCertificate + Last Transition Time: 2024-11-04T13:10:11Z + Message: check ready condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: CheckReadyCondition + Last Transition Time: 2024-11-04T13:10:11Z + Message: issuing condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: IssuingCondition + Last Transition Time: 2024-11-04T13:10:22Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T13:12:42Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T13:10:27Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:10:27Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:10:32Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T13:11:07Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:11:07Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:11:52Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:11:52Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:12:42Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Starting 2m57s KubeDB Ops-manager Operator Start processing for ZooKeeperOpsRequest: demo/zkops-rotate + Normal Starting 2m57s KubeDB Ops-manager Operator Pausing ZooKeeper database: demo/zk-quickstart + Normal Successful 2m57s KubeDB Ops-manager Operator Successfully paused ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-rotate + Warning get certificate; ConditionStatus:True 2m49s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m49s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m49s KubeDB Ops-manager Operator Successfully synced all certificates + Warning get certificate; ConditionStatus:True 2m44s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m44s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m44s KubeDB Ops-manager Operator Successfully synced all certificates + Normal UpdatePetSets 2m38s KubeDB Ops-manager Operator successfully reconciled the ZooKeeper with tls configuration + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning running pod; ConditionStatus:False 2m28s KubeDB Ops-manager Operator running pod; ConditionStatus:False + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-1 113s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-1 113s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-2 68s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-2 68s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Normal RestartNodes 18s KubeDB Ops-manager Operator Successfully restarted all nodes + Normal Starting 18s KubeDB Ops-manager Operator Resuming ZooKeeper database: demo/zk-quickstart + Normal Successful 18s KubeDB Ops-manager Operator Successfully resumed ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-rotate +``` + +Now, let's check the expiration date of the certificate. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ openssl x509 -in /var/private/ssl/tls.crt -inform PEM -enddate -nameopt RFC2253 -noout +notAfter=Feb 2 13:12:42 2025 GMT +``` + +As we can see from the above output, the certificate has been rotated successfully. + +## Change Issuer/ClusterIssuer + +Now, we are going to change the issuer of this database. + +- Let's create a new ca certificate and key using a different subject `CN=ca-update,O=kubedb-updated`. + +```bash +$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=ca-updated/O=kubedb-updated" +Generating a RSA private key +..............................................................+++++ +......................................................................................+++++ +writing new private key to './ca.key' +----- +``` + +- Now we are going to create a new ca-secret using the certificate files that we have just generated. + +```bash +$ kubectl create secret tls zookeeper-new-ca \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=demo +secret/zookeeper-new-ca created +``` + +Now, Let's create a new `Issuer` using the `mongo-new-ca` secret that we have just created. The `YAML` file looks like this: + +```yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-new-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-new-ca +``` + +Let's apply the `YAML` file: + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml +issuer.cert-manager.io/zk-new-issuer created +``` + +### Create ZooKeeperOpsRequest + +In order to use the new issuer to issue new certificates, we have to create a `ZooKeeperOpsRequest` CRO with the newly created issuer. Below is the YAML of the `ZooKeeperOpsRequest` CRO that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-update-issuer + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zk-new-issuer + kind: Issuer + apiGroup: "cert-manager.io" +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart` cluster. +- `spec.type` specifies that we are performing `ReconfigureTLS` on our zookeeper. +- `spec.tls.issuerRef` specifies the issuer name, kind and api group. + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml +zookeeperpsrequest.ops.kubedb.com/zkops-update-issuer created +``` + +#### Verify Issuer is changed successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequests -n demo zkops-update-issuer +NAME TYPE STATUS AGE +zkops-update-issuer ReconfigureTLS Successful 8m6s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-update-issuer +Name: zkops-update-issuer +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T13:27:25Z + Generation: 1 + Resource Version: 2155331 + UID: 399cae54-a6ab-4848-93ff-5dba09a128d7 +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Issuer Ref: + API Group: cert-manager.io + Kind: Issuer + Name: zk-new-issuer + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T13:27:25Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T13:27:35Z + Message: Successfully synced all certificates + Observed Generation: 1 + Reason: CertificateSynced + Status: True + Type: CertificateSynced + Last Transition Time: 2024-11-04T13:27:30Z + Message: get certificate; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: GetCertificate + Last Transition Time: 2024-11-04T13:27:30Z + Message: check ready condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: CheckReadyCondition + Last Transition Time: 2024-11-04T13:27:30Z + Message: issuing condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: IssuingCondition + Last Transition Time: 2024-11-04T13:27:40Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T13:30:00Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T13:27:45Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:27:45Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:27:50Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T13:28:30Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:28:30Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:29:20Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:29:20Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:30:00Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Starting 2m53s KubeDB Ops-manager Operator Start processing for ZooKeeperOpsRequest: demo/zkops-update-issuer + Warning get certificate; ConditionStatus:True 2m48s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m48s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m48s KubeDB Ops-manager Operator Successfully synced all certificates + Warning get certificate; ConditionStatus:True 2m43s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m43s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m43s KubeDB Ops-manager Operator Successfully synced all certificates + Normal UpdatePetSets 2m38s KubeDB Ops-manager Operator successfully reconciled the ZooKeeper with tls configuration + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning running pod; ConditionStatus:False 2m28s KubeDB Ops-manager Operator running pod; ConditionStatus:False + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-1 108s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-1 108s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-2 58s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-2 58s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Normal RestartNodes 18s KubeDB Ops-manager Operator Successfully restarted all nodes + Normal Starting 18s KubeDB Ops-manager Operator Resuming ZooKeeper database: demo/zk-quickstart + Normal Successful 18s KubeDB Ops-manager Operator Successfully resumed ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-update-issuer +``` + +Now, Let's exec into a zookeeper node and find out the ca subject to see if it matches the one we have provided. + +```bash +>$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ keytool -list -v -keystore /var/private/ssl/server.keystore.jks -storepass fdjk2dgffqn9 | grep 'Issuer' +Issuer: O=kubedb-updated, CN=ca-updated +Issuer: O=kubedb-updated, CN=ca-updated +``` + +We can see from the above output that, the subject name matches the subject name of the new ca certificate that we have created. So, the issuer is changed successfully. + +## Remove TLS from the Database + +Now, we are going to remove TLS from this database using a ZooKeeperOpsRequest. + +### Create ZooKeeperOpsRequest + +Below is the YAML of the `ZooKeeperOpsRequest` CRO that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-remove + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + remove: true +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart` cluster. +- `spec.type` specifies that we are performing `ReconfigureTLS` on ZooKeeper. +- `spec.tls.remove` specifies that we want to remove tls from this cluster. + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml +zookeeperopsrequest.ops.kubedb.com/zkops-remove created +``` + +#### Verify TLS Removed Successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequest -n demo zkops-remove +NAME TYPE STATUS AGE +zkops-remove ReconfigureTLS Successful 105s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-remove +Name: zkops-remove +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T13:39:19Z + Generation: 1 + Resource Version: 2156556 + UID: 8f669fe1-169f-4446-9d12-bf959216e2e0 +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Remove: true + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T13:39:19Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T13:39:27Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T13:41:42Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T13:39:32Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:39:32Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:39:37Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T13:40:22Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:40:22Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:41:02Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:41:02Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:41:42Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Starting 2m26s KubeDB Ops-manager Operator Start processing for ZooKeeperOpsRequest: demo/zkops-remove + Normal Starting 2m26s KubeDB Ops-manager Operator Pausing ZooKeeper database: demo/zk-quickstart + Normal Successful 2m26s KubeDB Ops-manager Operator Successfully paused ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-remove + Normal UpdatePetSets 2m18s KubeDB Ops-manager Operator successfully reconciled the ZooKeeper with tls configuration + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-0 2m13s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-0 2m13s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning running pod; ConditionStatus:False 2m8s KubeDB Ops-manager Operator running pod; ConditionStatus:False + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-1 83s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-1 83s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-2 43s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-2 43s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Normal RestartNodes 3s KubeDB Ops-manager Operator Successfully restarted all nodes + Normal Starting 3s KubeDB Ops-manager Operator Resuming ZooKeeper database: demo/zk-quickstart + Normal Successful 3s KubeDB Ops-manager Operator Successfully resumed ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-remove +``` + +Now, Let's exec into one of the broker node and find out that TLS is disabled or not. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cat ../conf/zoo.cfg +4lw.commands.whitelist=* +dataDir=/data +tickTime=2000 +initLimit=10 +syncLimit=2 +clientPort=2181 +globalOutstandingLimit=1000 +preAllocSize=65536 +snapCount=10000 +commitLogCount=500 +snapSizeLimitInKb=4194304 +maxCnxns=0 +maxClientCnxns=60 +minSessionTimeout=4000 +maxSessionTimeout=40000 +autopurge.snapRetainCount=3 +autopurge.purgeInterval=1 +quorumListenOnAllIPs=false +admin.serverPort=8080 +authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider +reconfigEnabled=true +standaloneEnabled=false +dynamicConfigFile=/data/zoo.cfg.dynamic +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ +``` + +So, we can see from the above that, output that tls is disabled successfully. + +## Cleaning up + +To cleanup the Kubernetes resources created by this tutorial, run: + +```bash +kubectl delete opsrequest zkops-add-tls zkops-remove zkops-rotate zkops-update-issuer +kubectl delete zookeeper -n demo zk-quickstart +kubectl delete issuer -n demo zk-issuer zk-new-issuer +kubectl delete ns demo +``` + +## Next Steps + +- Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). +- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). + diff --git a/docs/guides/zookeeper/reconfigure/reconfigure.md b/docs/guides/zookeeper/reconfigure/reconfigure.md index 8d67c1cf86..fc45e67f15 100644 --- a/docs/guides/zookeeper/reconfigure/reconfigure.md +++ b/docs/guides/zookeeper/reconfigure/reconfigure.md @@ -97,7 +97,7 @@ zookeeper.kubedb.com/zk-quickstart created Now, wait until `zk-quickstart` has status `Ready`. i.e, ```bash -$ kubectl get mc -n demo +$ kubectl get zk -n demo NAME VERSION STATUS AGE zk-quickstart 3.8.3 Ready 23s ``` @@ -300,7 +300,7 @@ Now need to check the new configuration we have provided. Now, wait until `zk-quickstart` has status `Ready`. i.e, ```bash -$ kubectl get mc -n demo +$ kubectl get zk -n demo NAME VERSION STATUS AGE zk-quickstart 3.8.3 Ready 20s ``` @@ -390,112 +390,140 @@ zk-reconfig-apply Reconfigure Successful 38s We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed to reconfigure the database. ```bash -$ kubectl describe zookeeperopsrequest -n demo zk-apply-reconfig -Name: zk-apply-reconfig +$ kubectl describe zookeeperopsrequest -n demo zk-reconfig-apply +Name: zk-reconfig-apply Namespace: demo Labels: Annotations: API Version: ops.kubedb.com/v1alpha1 Kind: ZooKeeperOpsRequest Metadata: - Creation Timestamp: 2024-09-03T06:02:41Z + Creation Timestamp: 2024-10-30T08:27:00Z Generation: 1 - Resource Version: 178039 - UID: d1f90151-abeb-4035-87f4-e2bc89c35b89 + Resource Version: 1548116 + UID: 4f3daa11-c41b-4079-a8d8-1040931284ef Spec: Apply: IfReady Configuration: - Apply Config: - memcached.conf: --conn-limit=3000 - + Config Secret: + Name: zk-new-configuration Database Ref: Name: zk-quickstart Type: Reconfigure Status: Conditions: - Last Transition Time: 2024-09-03T06:02:41Z - Message: ZooKeeper ops request is reconfiguring the cluster + Last Transition Time: 2024-10-30T08:27:00Z + Message: ZooKeeper ops-request has started to reconfigure ZooKeeper nodes Observed Generation: 1 Reason: Reconfigure Status: True Type: Reconfigure - Last Transition Time: 2024-09-03T06:02:44Z - Message: reconfiguring memcached + Last Transition Time: 2024-10-30T08:27:08Z + Message: successfully reconciled the ZooKeeper with new configure Observed Generation: 1 Reason: UpdatePetSets Status: True Type: UpdatePetSets - Last Transition Time: 2024-09-03T06:02:49Z + Last Transition Time: 2024-10-30T08:29:18Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-10-30T08:27:13Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-10-30T08:27:13Z Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 Observed Generation: 1 Status: True Type: EvictPod--zk-quickstart-0 - Last Transition Time: 2024-09-03T06:02:49Z - Message: is pod ready; ConditionStatus:False + Last Transition Time: 2024-10-30T08:27:18Z + Message: running pod; ConditionStatus:False Observed Generation: 1 Status: False - Type: IsPodReady - Last Transition Time: 2024-09-03T06:02:54Z - Message: is pod ready; ConditionStatus:True; PodName:zk-quickstart-0 + Type: RunningPod + Last Transition Time: 2024-10-30T08:27:58Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 Observed Generation: 1 Status: True - Type: IsPodReady--zk-quickstart-0 - Last Transition Time: 2024-09-03T06:02:54Z - Message: Restarted pods after reconfiguration + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-10-30T08:27:58Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 Observed Generation: 1 - Reason: RestartPods Status: True - Type: RestartPods - Last Transition Time: 2024-09-03T06:02:54Z - Message: Successfully completed the modification process. + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-10-30T08:28:38Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-10-30T08:28:38Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-10-30T08:29:18Z + Message: Successfully completed reconfigure ZooKeeper Observed Generation: 1 Reason: Successful Status: True Type: Successful Observed Generation: 1 Phase: Successful -Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal PauseDatabase 26s KubeDB Ops-manager Operator Pausing ZooKeeper demo/zk-quickstart - Normal RestartPods 13s KubeDB Ops-manager Operator Restarted pods after reconfiguration - Normal ResumeDatabase 13s KubeDB Ops-manager Operator Resuming ZooKeeper demo/zk-quickstart - Normal ResumeDatabase 13s KubeDB Ops-manager Operator Successfully resumed ZooKeeper demo/zk-quickstart - Normal Successful 13s KubeDB Ops-manager Operator Successfully Reconfigured Database - +Events: ``` -Now let's check the new configuration we have provided. +Now need to check the new configuration we have provided. -We will connect to `zk-quickstart-0` pod from local-machine using port-frowarding. +Now, wait until `zk-quickstart` has status `Ready`. i.e, ```bash -$ kubectl port-forward -n demo zk-quickstart-0 11211 -Forwarding from 127.0.0.1:11211 -> 11211 -Forwarding from [::1]:11211 -> 11211 +$ kubectl get zk -n demo +NAME VERSION STATUS AGE +zk-quickstart 3.8.3 Ready 20s ``` -Now, connect to the memcached server from a different terminal through `telnet`. +Now let’s exec into the zookeeper pod and check the new configuration we have provided. ```bash -$ telnet 127.0.0.1 11211 -Trying 127.0.0.1... -Connected to 127.0.0.1. -Escape character is '^]'. -stats -... -STAT max_connections 3000 -... -END +$ Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ echo conf | nc localhost 2181 +clientPort=2181 +secureClientPort=-1 +dataDir=/data/version-2 +dataDirSize=134218330 +dataLogDir=/data/version-2 +dataLogSize=134218330 +tickTime=2000 +maxClientCnxns=90 +minSessionTimeout=4000 +maxSessionTimeout=40000 +clientPortListenBacklog=-1 +serverId=1 +initLimit=10 +syncLimit=2 +electionAlg=3 +electionPort=3888 +quorumPort=2888 +peerType=0 +membership: +server.1=zk-quickstart-0.zk-quickstart-pods.demo.svc.cluster.local:2888:3888:participant;0.0.0.0:2181 +server.2=zk-quickstart-1.zk-quickstart-pods.demo.svc.cluster.local:2888:3888:participant;0.0.0.0:2181 +server.3=zk-quickstart-2.zk-quickstart-pods.demo.svc.cluster.local:2888:3888:participant;0.0.0.0:2181 +version=100000011zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ exit +exit ``` -As we can see from the configuration of running memcached, the value of `maxclients` has been changed from `2000` to `3000`. So, the reconfiguration of the database using the `applyConfig` field is successful. +As we can see from the configuration of running zookeeper, the value of `maxClientCnxns` has been changed from `100` to `90`. So, the reconfiguration of the database using the `applyConfig` field is successful. ## Cleaning Up To clean up the Kubernetes resources created by this tutorial, run: ```bash -kubectl delete mc -n demo zk-quickstart -kubectl delete zookeeperopsrequest -n demo zk-reconfig zk-apply-reconfig +kubectl delete zk -n demo zk-quickstart +kubectl delete zookeeperopsrequest -n demo zk-reconfig zk-reconfig-apply ``` \ No newline at end of file diff --git a/docs/guides/zookeeper/restart/restart.md b/docs/guides/zookeeper/restart/restart.md index 387b837774..583f8b0de2 100644 --- a/docs/guides/zookeeper/restart/restart.md +++ b/docs/guides/zookeeper/restart/restart.md @@ -201,6 +201,5 @@ kubectl delete ns demo ## Next Steps -- Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). - Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). - Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). diff --git a/docs/guides/zookeeper/tls/_index.md b/docs/guides/zookeeper/tls/_index.md new file mode 100644 index 0000000000..d1b1b06277 --- /dev/null +++ b/docs/guides/zookeeper/tls/_index.md @@ -0,0 +1,10 @@ +--- +title: Run ZooKeeper with TLS +menu: + docs_{{ .version }}: + identifier: zk-tls + name: TLS/SSL Encryption + parent: zk-zookeeper-guides + weight: 45 +menu_name: docs_{{ .version }} +--- diff --git a/docs/guides/zookeeper/tls/configure_ssl.md b/docs/guides/zookeeper/tls/configure_ssl.md new file mode 100644 index 0000000000..378d70c619 --- /dev/null +++ b/docs/guides/zookeeper/tls/configure_ssl.md @@ -0,0 +1,268 @@ +--- +title: ZooKeeper TLS/SSL Encryption +menu: + docs_{{ .version }}: + identifier: zk-tls-configure + name: ZooKeeper_SSL + parent: zk-zookeeper-guides + weight: 20 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# Run ZooKeeper Ensemble with TLS/SSL + +KubeDB supports providing TLS/SSL encryption for ZooKeeper Ensemble. This tutorial will show you how to use KubeDB to run a ZooKeeper Ensemble with TLS/SSL encryption. + +## Before You Begin + +- At first, you need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one by using [kind](https://kind.sigs.k8s.io/docs/user/quick-start/). + +- Install [`cert-manger`](https://cert-manager.io/docs/installation/) v1.0.0 or later to your cluster to manage your SSL/TLS certificates. + +- Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md). + +- To keep things isolated, this tutorial uses a separate namespace called `demo` throughout this tutorial. + + ```bash + $ kubectl create ns demo + namespace/demo created + ``` + +> Note: YAML files used in this tutorial are stored in [docs/examples/zookeeper](https://github.com/kubedb/docs/tree/{{< param "info.version" >}}/docs/examples/zookeeper) folder in GitHub repository [kubedb/docs](https://github.com/kubedb/docs). + +## Overview + +KubeDB uses following crd fields to enable SSL/TLS encryption in ZooKeeper. + +- `spec:` + - `enableSSL` + - `tls:` + - `issuerRef` + - `certificate` + +Read about the fields in details in [zookeeper concept](/docs/guides/zookeeper/concepts/zookeeper.md), + +Users must specify the `tls.issuerRef` field. KubeDB uses the `issuer` or `clusterIssuer` referenced in the `tls.issuerRef` field, and the certificate specs provided in `tls.certificate` to generate certificate secrets. These certificate secrets are then used to generate required certificates including `ca.crt`, `tls.crt`, `tls.key`, `keystore.jks` and `truststore.jks`. + +## Create Issuer/ ClusterIssuer + +We are going to create an example `Issuer` that will be used throughout the duration of this tutorial to enable SSL/TLS in ZooKeeper. Alternatively, you can follow this [cert-manager tutorial](https://cert-manager.io/docs/configuration/ca/) to create your own `Issuer`. + +- Start off by generating you ca certificates using openssl. + +```bash +openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=zookeeper/O=kubedb" +``` + +- Now create a ca-secret using the certificate files you have just generated. + +```bash +kubectl create secret tls zookeeper-ca \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=demo +``` + +Now, create an `Issuer` using the `ca-secret` you have just created. The `YAML` file looks like this: + +```yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zookeeper-ca-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca +``` + +Apply the `YAML` file: + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/tls/zookeeper-issuer.yaml +issuer.cert-manager.io/zookeeper-ca-issuer created +``` + +## TLS/SSL encryption in ZooKeeper Ensemble + +Below is the YAML for ZooKeeper with TLS enabled: + +```yaml +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-tls + namespace: demo +spec: + version: "3.8.3" + enableSSL: true + tls: + issuerRef: + apiGroup: "cert-manager.io" + kind: Issuer + name: zookeeper-ca-issuer + adminServerPort: 8080 + replicas: 5 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" + +``` + +Here, +- `spec.enableSSL` is set to `true` to enable TLS/SSL encryption. +- `spec.tls.issuerRef` refers to the `Issuer` that we have created in the previous step. +- +### Deploy ZOoKeeper Ensemble with TLS/SSL + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/tls/zookeeper-tls.yaml +zookeeper.kubedb.com/zk-tls created +``` + +Now, wait until `zookeeper-tls created` has status `Ready`. i.e, + +```bash +$ watch kubectl get zookeeper -n demo +NAME TYPE VERSION STATUS AGE +zk-tls kubedb.com/v1alpha2 3.8.3 Ready 60s +``` + +### Verify TLS/SSL in ZooKeeper Ensemble + +```bash +$ kubectl describe secret -n demo zk-quickstart-client-cert +Name: zk-quickstart-client-cert +Namespace: demo +Labels: app.kubernetes.io/component=database + app.kubernetes.io/instance=zk-quickstart + app.kubernetes.io/managed-by=kubedb.com + app.kubernetes.io/name=zookeepers.kubedb.com + controller.cert-manager.io/fao=true +Annotations: cert-manager.io/alt-names: + *.zk-quickstart-pods.demo.svc.cluster.local,localhost,zk-quickstart,zk-quickstart-pods,zk-quickstart-pods.demo.svc,zk-quickstart-pods.demo... + cert-manager.io/certificate-name: zk-quickstart-client-cert + cert-manager.io/common-name: zk-quickstart-pods.demo.svc + cert-manager.io/ip-sans: 127.0.0.1 + cert-manager.io/issuer-group: cert-manager.io + cert-manager.io/issuer-kind: Issuer + cert-manager.io/issuer-name: zookeeper-ca-issuer + cert-manager.io/uri-sans: + +Type: kubernetes.io/tls + +Data +==== +ca.crt: 1159 bytes +keystore.jks: 3258 bytes +tls-combined.pem: 3198 bytes +tls.crt: 1493 bytes +tls.key: 1704 bytes +truststore.jks: 873 bytes +``` + +Now, Let's exec into a ZooKeeper pod and verify the configuration that the TLS is enabled. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cd ../var/private/ssl +zookeeper@zk-quickstart-0:/var/private/ssl$ openssl s_client -connect localhost:2182 -CAfile ca.crt -cert tls.crt -key tls.key +CONNECTED(00000003) +depth=1 CN = zookeeper, O = kubedb +verify return:1 +depth=0 CN = zk-quickstart.demo.svc +verify return:1 +--- +Certificate chain + 0 s:CN = zk-quickstart.demo.svc + i:CN = zookeeper, O = kubedb + a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 + v:NotBefore: Nov 4 05:46:21 2024 GMT; NotAfter: Feb 2 05:46:21 2025 GMT +--- +Server certificate +-----BEGIN CERTIFICATE----- +MIIEJTCCAw2gAwIBAgIQaWLGhg/TgVF8oXGcsLQkKjANBgkqhkiG9w0BAQsFADAl +MRIwEAYDVQQDDAl6b29rZWVwZXIxDzANBgNVBAoMBmt1YmVkYjAeFw0yNDExMDQw +NTQ2MjFaFw0yNTAyMDIwNTQ2MjFaMCExHzAdBgNVBAMTFnprLXF1aWNrc3RhcnQu +ZGVtby5zdmMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeeiLZeNa7 +wHOUwD76fmp45Ae9qlpHCW/lGz+lGO48FBDUBbG2Tm2BZVW2297HOzb/Lax6Molb +9qCDsV7ITCUYXLBGz0pCGqGYS/icZupShhKAvD33Gn8kH/QeANwFonpxBAtr36vi +WxwcRD+dfVAu7OCATwSakZh3zdbRPQXLiAVqj8qn4zNSYL5bzUXQ5dHFzvgwZve5 +FR3QYLvVjUEu2tFjCKM+/HTzQ/IMUAjcU0lU4qnWqnhgcGp8ZE3hDyL9OOOsjrWx +CGNhB0Orf6Efztkqq4FMZ//w3DUQgnRglGKl1rGK015//W0MGSPlT4uve6Z7zaRU +aUqa7Y8P5wZxAgMBAAGjggFTMIIBTzAOBgNVHQ8BAf8EBAMCAqQwHQYDVR0lBBYw +FAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FC7Wrn4SOKhsT4TQFEMtSao72H5TMB8GA1UdIwQYMBaAFDe7/VhWOllB39U/xOht +MxmZu9wQMIHMBgNVHREEgcQwgcGCKyouemstcXVpY2tzdGFydC1wb2RzLmRlbW8u +c3ZjLmNsdXN0ZXIubG9jYWyCCWxvY2FsaG9zdIINemstcXVpY2tzdGFydIISemst +cXVpY2tzdGFydC1wb2Rzght6ay1xdWlja3N0YXJ0LXBvZHMuZGVtby5zdmOCKXpr +LXF1aWNrc3RhcnQtcG9kcy5kZW1vLnN2Yy5jbHVzdGVyLmxvY2FsghZ6ay1xdWlj +a3N0YXJ0LmRlbW8uc3ZjhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQCGGxgGzdjF +Vo9VALc6ddZD50M7bfh5L5z2KfSY4ZH7kuokM52LGzJYwREV3UpVAhjBqn0XEf9p +JX8ePo0Z9zjtWIIZg4ctjlCvKDy+HpKlqh2RJejnl+NoLPV628QJDiEksLzdVl4v +z36AwdGeUhADpvoGQiXUT6LgrD++Uv0akpDEzWOB2LUKsvCRKnxyBNyBqpsW8/Pu +DeC/RUGXT/JFtZtDBGp8d/FOIpJ0t/ZjrI9Hyu5DLFB08oTYmEVE3Lv2owZZV/o8 +6YqlpTu2efKEzMFZudUWpnGUrb69sZeDR9hwxGcAdKobTB8SZOBU61nsRn95BH7O +S4dKhcrbzP70 +-----END CERTIFICATE----- +subject=CN = zk-quickstart.demo.svc +issuer=CN = zookeeper, O = kubedb +--- +Acceptable client certificate CA names +CN = zookeeper, O = kubedb +Client Certificate Types: ECDSA sign, RSA sign, DSA sign +Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:DSA+SHA256:ECDSA+SHA224:RSA+SHA224:DSA+SHA224:ECDSA+SHA1:RSA+SHA1:DSA+SHA1 +Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:DSA+SHA256:ECDSA+SHA224:RSA+SHA224:DSA+SHA224 +Peer signing digest: SHA256 +Peer signature type: RSA-PSS +Server Temp Key: X25519, 253 bits +--- +SSL handshake has read 1611 bytes and written 2553 bytes +Verification: OK +--- +New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 +Server public key is 2048 bit +Secure Renegotiation IS supported +Compression: NONE +Expansion: NONE +No ALPN negotiated +SSL-Session: + Protocol : TLSv1.2 + Cipher : ECDHE-RSA-AES128-GCM-SHA256 + Session-ID: 057DF7D5B8BCE6DA3EAE6101136E644057BE67AF0A4931DC8FD15848D4E74D38 + Session-ID-ctx: + Master-Key: 807690ACC8782745D1C8AB6E4CF42FCAE7B13CAAC75A27FF4538FEA136DB9E6A332FDDB18703367593EBAD77629919C3 + PSK identity: None + PSK identity hint: None + SRP username: None + Start Time: 1730703067 + Timeout : 7200 (sec) + Verify return code: 0 (ok) + Extended master secret: yes +--- +``` + +From the above output, we can see that we are able to connect to the ZooKeeper Ensemble using the TLS configuration. + +## Cleaning up + +To cleanup the Kubernetes resources created by this tutorial, run: + +```bash +kubectl delete zookeeper -n demo zk-tls +kubectl delete issuer -n demo zookeeper-ca-issuer +kubectl delete ns demo +``` + +## Next Steps + +- Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). +- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). \ No newline at end of file diff --git a/docs/guides/zookeeper/tls/overview.md b/docs/guides/zookeeper/tls/overview.md new file mode 100644 index 0000000000..91f5cfe0bc --- /dev/null +++ b/docs/guides/zookeeper/tls/overview.md @@ -0,0 +1,70 @@ +--- +title: ZooKeeper TLS/SSL Encryption Overview +menu: + docs_{{ .version }}: + identifier: zk-tls-overview + name: Overview + parent: zk-tls + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# ZooKeeper TLS/SSL Encryption + +**Prerequisite :** To configure TLS/SSL in `ZooKeeper`, `KubeDB` uses `cert-manager` to issue certificates. So first you have to make sure that the cluster has `cert-manager` installed. To install `cert-manager` in your cluster following steps [here](https://cert-manager.io/docs/installation/kubernetes/). + +To issue a certificate, the following crd of `cert-manager` is used: + +- `Issuer/ClusterIssuer`: Issuers, and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details [here](https://cert-manager.io/docs/concepts/issuer/). + +- `Certificate`: `cert-manager` has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details [here](https://cert-manager.io/docs/concepts/certificate/). + +**ZooKeeper CRD Specification :** + +KubeDB uses following crd fields to enable SSL/TLS encryption in `ZooKeeper`. + +- `spec:` + - `enableSSL` + - `tls:` + - `issuerRef` + - `certificates` + +Read about the fields in details from [zookeeper concept](/docs/guides/zookeeper/concepts/zookeeper.md), + +When, `enableSSL` is set to `true`, the users must specify the `tls.issuerRef` field. `KubeDB` uses the `issuer` or `clusterIssuer` referenced in the `tls.issuerRef` field, and the certificate specs provided in `tls.certificate` to generate certificate secrets using `Issuer/ClusterIssuers` specification. These certificates secrets including `ca.crt`, `tls.crt` and `tls.key` etc. are used to configure `zookeeper` server and clients. + +## How TLS/SSL configures in ZooKeeper + +The following figure shows how `KubeDB` enterprise used to configure TLS/SSL in ZooKeeper. Open the image in a new tab to see the enlarged version. + +
+Deploy ZooKeeper with TLS/SSL +
Fig: Deploy ZooKeeper with TLS/SSL
+
+ +Deploying ZooKeeper with TLS/SSL configuration process consists of the following steps: + +1. At first, a user creates a `Issuer/ClusterIssuer` CR. + +2. Then the user creates a `ZooKeeper` CR which refers to the `Issuer/ClusterIssuer` CR that the user created in the previous step. + +3. `KubeDB` Provisioner operator watches for the `ZooKeeper` CR. + +4. When it finds one, it creates `Secret`, `Service`, etc. for the `ZooKeeper` cluster. + +5. `KubeDB` Ops-manager operator watches for `ZooKeeper`(5c), `Issuer/ClusterIssuer`(5b), `Secret` and `Service`(5a). + +6. When it finds all the resources(`ZooKeeper`, `Issuer/ClusterIssuer`, `Secret`, `Service`), it creates `Certificates` by using `tls.issuerRef` and `tls.certificates` field specification from `ZooKeeper` CR. + +7. `cert-manager` watches for certificates. + +8. When it finds one, it creates certificate secrets `tls-secrets`(server, client, exporter secrets etc.) that holds the actual certificate signed by the CA. + +9. `KubeDB` Provisioner operator watches for the Certificate secrets `tls-secrets`. + +10. When it finds all the tls-secret, it creates the related `PetSets` so that ZooKeeper database can be configured with TLS/SSL. + +In the next doc, we are going to show a step-by-step guide on how to configure a `ZooKeeper` cluster with TLS/SSL. \ No newline at end of file diff --git a/docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg b/docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg new file mode 100644 index 0000000000..00b4a4f6ab --- /dev/null +++ b/docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg @@ -0,0 +1,3 @@ + + +
1.Create zookeeper
1.Create ZooKeeper
2.Watch
2.Watch
3.Create
3.Create
4.Initiate Re-configuring TLS
4.Initiate Re-c...
6.Pause
6.Pause
8.Restart Pods
8.Restart Pods
7.Update TLS configuration
7.Update TLS configurati...
9.Resume
9.Resume
Reconfiguring TLS stage
Reconfiguring TLS stage
User
User            Community        Operator
              
              
StatefulSet's
Pod
Stateful...
5.Watch
5.Watch            Enterprise            Operator
ZooKeeper
 OpsRequest
ZooKeeper...
ZooKeeper
ZooKeeper
refers to
refers to
Updated
ZooKeeper
Update...Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/docs/images/zookeeper/zk-tls.svg b/docs/images/zookeeper/zk-tls.svg new file mode 100644 index 0000000000..b29b566468 --- /dev/null +++ b/docs/images/zookeeper/zk-tls.svg @@ -0,0 +1,4 @@ + + + +            Enterprise            Operator              Community            Operator
service
se...
secret
se...
tls-secret
tls-secret
Cert- manager
Cert- ma...
StatefulSet
Statef...
Issuer/Cluster Issuer
Issuer...
ZooKeeper
ZooKeeper
Certificates
Certif...
User
User
2.Create
2.Create
1.Create
1.Create
5a.Watch
5a.Watch
3.Watch
3.Watch
4.Create
4.Create
5c.Watch
5c.Watch
6.Create
6.Create
7.Watch
7.Watch
uses
uses
8.Create
8.Create
9.Watch
9.Watch
10.Create
10.Create
5b.Watch
5b.Watch
refers to
refers toText is not SVG - cannot display \ No newline at end of file