search

owncloud / ocis-charts

:chart_with_upwards_trend: Helm Charts for ownCloud's OCIS
https://owncloud.dev/ocis/deployment/kubernetes/
Apache License 2.0
46 stars 27 forks source link

365 days after inital deployment authentication starts failing #760

Open DaDummy opened 6 days ago

DaDummy commented 6 days ago

I initially deployed my test instance 365 days ago and was actively using it till yesterday.

Today all authentication attempts are failing and idm is logging the following message roughly three times per second at the moment:

{"level":"error","service":"idm","error":"remote error: tls: bad certificate","time":"2024-10-01T14:49:37Z","line":"github.com/owncloud/ocis/v2/ocis-pkg/log/logrus_wrapper.go:50","message":"handleConnection ber.ReadPacket"}

Due to the timing I suspect that the idm TLS certificate just expired.

I understand that using an external LDAP is strongly recommended, still it might be nice to support the necessary certificate rotation from the chart.

I guess the necessary steps would be to check the age of the cert in charts/ocis/templates/idm/secret.yaml and update the cert secret if it expired, then restart the idm pods. Though that would probably also require retaining the CA key.

As an alternative I guess it would also be possible to roll over CA and cert and then restart all affected pods, though that would be more disruptive.

Workaround:

kubectl delete secrets ldap-ca ldap-cert
(install helm chart again)
kubectl rollout restart deployment
wkloucek commented 20 hours ago

This chart will not change around the builtin IDM and IDP. Those two services are only there for testing purposes since they will never be production ready in the Kubernetes context.

From what I know, there is no sane way to do the certificate rotation with Helm.

I'd propose to look into CertManager and provide the CA and cert by it. You need to configure secretRefs.ldapCaRef and secretRefs.ldapCertRef for it.

On the stable-5 branch you can find a starting point on how to manage a CA and certs with cert-manager:

https://github.com/owncloud/ocis-charts/blob/stable-5/deployments/custom-certificate-authority/helmfile.yaml#L6-L18

https://github.com/owncloud/ocis-charts/blob/3811ec1af68d8a28067e09a79c0fd8db7a07083c/deployments/custom-certificate-authority/charts/certificate-authority/ca.yaml