search

clastix / kamaji

Kamaji is the Hosted Control Plane Manager for Kubernetes.
https://kamaji.clastix.io
Apache License 2.0
934 stars 81 forks source link

Making DataStore TLS configuration optional #451

Closed thecodeassassin closed 2 months ago

thecodeassassin commented 3 months ago

This PR will make tlsConfig on datastores optional. Allowing for the following setups:

This will allow operators to use datastores like PostgreSQL on providers that do not offer client certificates.

netlify[bot] commented 3 months ago

Deploy Preview for kamaji-documentation canceled.

Name Link
Latest commit 1b243868ea7295d732cae46ef0461691b282d476
Latest deploy log https://app.netlify.com/sites/kamaji-documentation/deploys/663b19acf59a2a0008a3cdd1
thecodeassassin commented 2 months ago

Some minor changes, something I didn't think of is that we have mandatory TLS configuration with etcd.

It would be perfect if we could have a validating webhook for Datastore of etcd kind which requires the struct field.

That is indeed a nice idea, can we introduce this in a future patch? it will require a bit more research on my end.

thecodeassassin commented 2 months ago

When we push this version we need to make sure people upgrade their CRDs otherwise NATS and no-tls configs won't be supported.

prometherion commented 2 months ago

When we push this version we need to make sure people upgrade their CRDs otherwise NATS and no-tls configs won't be supported

No problem for this, we're going to mark minor release both on Kamaji and its Helm Chart, and we'll document this extensively.

thecodeassassin commented 2 months ago

Not sure if I just asked for that or not, we should mark mandatory client-certificates for etcd datastores since we're just supporting that kind of authentication.

Edit: missed this, my bad That is indeed a nice idea, can we introduce this in a future patch? it will require a bit more research on my end.

Should be the case now

thecodeassassin commented 2 months ago

@prometherion should be good now