search

coreos / tectonic-forum

Apache License 2.0
30 stars 9 forks source link

SSL using AWS Certificate Manager #228

Open sdomagala opened 7 years ago

sdomagala commented 7 years ago

Tectonic Version

1.7.5-tectonic.1

Environment

Cloud

What hardware/cloud provider/hypervisor is being used with Tectonic?

AWS

Expected Behavior

We'd like to use ACM to authenticate inside of tectonic cluster and we wonder if this is even possible. Right now in Terraform we can see that you can pass your certificates to cluster BUT there is no way to use ACM (maybe because they do not provide private key). Or did we miss something? There is a possibility to add certificates into the Ingress' Console ELB and it works but with one issue - we are getting 401's from Kubernetes API while trying to log in and we get redirected back to login page(if you log in and then change certificates you are able to navigate through page)

Actual Behavior

-

Reproduction Steps

  1. Change certificate on Ingress Console ELB
  2. Navigate to your cluster
  3. Try to log in
  4. Page redirects with an error

Other Information

I've also tried to change certificates on Ingress int/ext and nothing seemed to help with authorization issues

Also added annotations to LoadBalancers I thought might be relevant here

service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ARN}}

and btw. annotations are not well documented, I found it in issues/code snippets.

Feature Request

If it's already possible in Tectonic please make guidelines how it can be implemented

kbrwn commented 7 years ago

@sdomagala This is not currently supported but we do have an open feature request to add support form AWS ACM. I'll add a reference to this issue in our internal tracker.

adarshaj commented 6 years ago

I have similar issue with cloudflare's custom SSL (it has proper SAN set, but is a ECDSA signed), may be this is one of possible reasons where ECDSA certs are being checked wrongly for 'key enchiperment' (as per https://coreos.com/tectonic/docs/latest/tls/tls-ingress.html)? - https://forums.developer.amazon.com/answers/61280/view.html