search

k8up-io / k8up

Kubernetes and OpenShift Backup Operator
https://k8up.io/
Apache License 2.0
617 stars 63 forks source link

Allow using custom CA certificates #900

Open mpepping opened 10 months ago

mpepping commented 10 months ago

Summary

As "an operator"\ I want "to use my custom CA bundle with K8up"\ So that "I can use a trusted, verified TLS connection to my backup backend"

Context

To handle TLS connections that use a custom/self-signed CA as certificate issuer, we now create our own K8up container images that includes our own certificates. This allows us to have a verified connection to our S3 compatible backup backend.

We would prefer to have an option in the K8up container image itself to refer a custom CA bundle. This is supported in Restic via the --cacert flag.

Effectively, we want to appoint a CA bundle file via an env.var or config file for the K8s Pod.

Out of Scope

Further links

Acceptance Criteria

No response

Implementation Ideas

mpepping commented 10 months ago

Just FYI; This is roughly how we build a custom image now.

FROM registry.example.com/k8up-io/k8up:v2.7.1

USER root

RUN \
  apk add --no-cache openssl &&\
  /usr/bin/curl "http://pki.example.com/RootCACert.crt" |\
    /usr/bin/openssl x509 -inform DER -outform PEM -out /usr/local/share/ca-certificates/root.crt; \
  /usr/bin/curl "http://pki.example.com/intermediate.crt" |\
    /usr/bin/openssl x509 -inform DER -outform PEM -out /usr/local/share/ca-certificates/intermediate.crt; \
  /usr/bin/curl "http://pki.example.com/myissuer.crt" |\
    /usr/bin/openssl x509 -inform DER -outform PEM -out /usr/local/share/ca-certificates/myissuer.crt; \
  /usr/sbin/update-ca-certificates

USER 6553
poyaz commented 9 months ago

Hi

We have the same problem with k8up and our s3 server runs as TLS with a self-sign certificate. We would like to use the feature for mounting certificate files.

I am interested in developing this feature. I'd like to add these features:

  1. First, add options for using extraMount options to add certificate files
  2. Second, add env (or s3 parse URI) for TLS insecure

Reference:

792

@Kidswiss @tobru