diff --git a/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml b/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml new file mode 100644 index 0000000000..714c89ae57 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml @@ -0,0 +1,11 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-remove + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + remove: true \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml b/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml new file mode 100644 index 0000000000..16d11432f4 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml @@ -0,0 +1,11 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-rotate + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + rotateCertificates: true \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml new file mode 100644 index 0000000000..df73317be2 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml @@ -0,0 +1,24 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-add-tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zookeeper-ca-issuer + kind: Issuer + apiGroup: "cert-manager.io" + certificates: + - alias: client + subject: + organizations: + - zookeeper + organizationalUnits: + - client + timeout: 5m + apply: IfReady + ``` \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml new file mode 100644 index 0000000000..5d0f5284be --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml new file mode 100644 index 0000000000..f411e6c0f6 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-new-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-new-ca \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml new file mode 100644 index 0000000000..425f2eea92 --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml @@ -0,0 +1,14 @@ +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-update-issuer + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zk-new-issuer + kind: Issuer + apiGroup: "cert-manager.io" \ No newline at end of file diff --git a/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml b/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml new file mode 100644 index 0000000000..c121a2d2fd --- /dev/null +++ b/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml @@ -0,0 +1,16 @@ +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-quickstart + namespace: demo +spec: + version: "3.8.3" + adminServerPort: 8080 + replicas: 3 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" \ No newline at end of file diff --git a/docs/examples/zookeeper/tls/zookeeper-issuer.yaml b/docs/examples/zookeeper/tls/zookeeper-issuer.yaml new file mode 100644 index 0000000000..cee750e080 --- /dev/null +++ b/docs/examples/zookeeper/tls/zookeeper-issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zookeeper-ca-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca \ No newline at end of file diff --git a/docs/examples/zookeeper/tls/zookeeper-tls.yaml b/docs/examples/zookeeper/tls/zookeeper-tls.yaml new file mode 100644 index 0000000000..eafa468bb7 --- /dev/null +++ b/docs/examples/zookeeper/tls/zookeeper-tls.yaml @@ -0,0 +1,22 @@ +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-quickstart + namespace: demo +spec: + version: "3.8.3" + enableSSL: true + tls: + issuerRef: + apiGroup: "cert-manager.io" + kind: Issuer + name: zookeeper-ca-issuer + adminServerPort: 8080 + replicas: 5 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" \ No newline at end of file diff --git a/docs/guides/zookeeper/reconfigure-tls/_index.md b/docs/guides/zookeeper/reconfigure-tls/_index.md new file mode 100644 index 0000000000..5d3b1e62d4 --- /dev/null +++ b/docs/guides/zookeeper/reconfigure-tls/_index.md @@ -0,0 +1,10 @@ +--- +title: Reconfigure TLS/SSL +menu: + docs_{{ .version }}: + identifier: zk-reconfigure-tls + name: Reconfigure TLS/SSL + parent: zk-zookeeper-guides + weight: 46 +menu_name: docs_{{ .version }} +--- diff --git a/docs/guides/zookeeper/reconfigure-tls/overview.md b/docs/guides/zookeeper/reconfigure-tls/overview.md new file mode 100644 index 0000000000..0fb04d0833 --- /dev/null +++ b/docs/guides/zookeeper/reconfigure-tls/overview.md @@ -0,0 +1,54 @@ +--- +title: Reconfiguring TLS/SSL +menu: + docs_{{ .version }}: + identifier: kf-reconfigure-tls-overview + name: Overview + parent: kf-reconfigure-tls + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# Reconfiguring TLS of ZooKeeper + +This guide will give an overview on how KubeDB Ops-manager operator reconfigures TLS configuration i.e. add TLS, remove TLS, update issuer/cluster issuer or Certificates and rotate the certificates of `ZooKeeper`. + +## Before You Begin + +- You should be familiar with the following `KubeDB` concepts: + - [ZooKeeper](/docs/guides/zookeeper/concepts/zookeeper.md) + - [ZooKeeperOpsRequest](/docs/guides/zookeeper/concepts/zookeeperopsrequest.md) + +## How Reconfiguring ZooKeeper TLS Configuration Process Works + +The following diagram shows how KubeDB Ops-manager operator reconfigures TLS of a `ZooKeeper`. Open the image in a new tab to see the enlarged version. + + + +Fig: Reconfiguring TLS process of ZooKeeper + + +The Reconfiguring ZooKeeper TLS process consists of the following steps: + +1. At first, a user creates a `ZooKeeper` Custom Resource Object (CRO). + +2. `KubeDB` Provisioner operator watches the `ZooKeeper` CRO. + +3. When the operator finds a `ZooKeeper` CR, it creates required number of `PetSets` and related necessary stuff like secrets, services, etc. + +4. Then, in order to reconfigure the TLS configuration of the `ZooKeeper` database the user creates a `ZooKeeperOpsRequest` CR with desired information. + +5. `KubeDB` Ops-manager operator watches the `ZooKeeperOpsRequest` CR. + +6. When it finds a `ZooKeeperOpsRequest` CR, it pauses the `ZooKeeper` object which is referred from the `ZooKeeperOpsRequest`. So, the `KubeDB` Provisioner operator doesn't perform any operations on the `ZooKeeper` object during the reconfiguring TLS process. + +7. Then the `KubeDB` Ops-manager operator will add, remove, update or rotate TLS configuration based on the Ops Request yaml. + +8. Then the `KubeDB` Ops-manager operator will restart all the Pods of the database so that they restart with the new TLS configuration defined in the `ZooKeeperOpsRequest` CR. + +9. After the successful reconfiguring of the `ZooKeeper` TLS, the `KubeDB` Ops-manager operator resumes the `ZooKeeper` object so that the `KubeDB` Provisioner operator resumes its usual operations. + +In the next docs, we are going to show a step by step guide on reconfiguring TLS configuration of a ZooKeeper database using `ZooKeeperOpsRequest` CRD. \ No newline at end of file diff --git a/docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md b/docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md new file mode 100644 index 0000000000..07e3dcde73 --- /dev/null +++ b/docs/guides/zookeeper/reconfigure-tls/reconfigure-tls.md @@ -0,0 +1,1014 @@ +--- +title: Reconfigure ZooKeeper TLS/SSL Encryption +menu: + docs_{{ .version }}: + identifier: zk-reconfigure-tls-zookeeper + name: Reconfigure ZooKeeper TLS/SSL Encryption + parent: zk-reconfigure-tls + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# Reconfigure ZooKeeper TLS/SSL (Transport Encryption) + +KubeDB supports reconfigure i.e. add, remove, update and rotation of TLS/SSL certificates for existing ZooKeeper database via a ZooKeeperOpsRequest. This tutorial will show you how to use KubeDB to reconfigure TLS/SSL encryption. + +## Before You Begin + +- At first, you need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one by using [kind](https://kind.sigs.k8s.io/docs/user/quick-start/). + +- Install [`cert-manger`](https://cert-manager.io/docs/installation/) v1.0.0 or later to your cluster to manage your SSL/TLS certificates. + +- Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md). + +- To keep things isolated, this tutorial uses a separate namespace called `demo` throughout this tutorial. + + ```bash + $ kubectl create ns demo + namespace/demo created + ``` + +> Note: YAML files used in this tutorial are stored in [docs/examples/zookeeper](https://github.com/kubedb/docs/tree/{{< param "info.version" >}}/docs/examples/zookeeper) folder in GitHub repository [kubedb/docs](https://github.com/kubedb/docs). + +## Add TLS to a ZooKeeper database + +Here, We are going to create a ZooKeeper without TLS and then reconfigure the database to use TLS. + +### Deploy ZooKeeper without TLS + +In this section, we are going to deploy a ZooKeeper ensemble without TLS. In the next few sections we will reconfigure TLS using `ZooKeeperOpsRequest` CRD. Below is the YAML of the `ZooKeeper` CR that we are going to create, + +```yaml +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-quickstart + namespace: demo +spec: + version: "3.8.3" + adminServerPort: 8080 + replicas: 3 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" + +``` + +Let's create the `ZooKeeper` CR we have shown above, + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper.yaml +zookeeper.kubedb.com/zk-quickstart created +``` + +Now, wait until `zk-quickstart` has status `Ready`. i.e, + +```bash +$ watch kubectl get zookeeper -n demo +NAME TYPE VERSION STATUS AGE +zk-quickstart kubedb.com/v1alpha2 3.8.3 Ready 60s +``` + +Now, we can exec one zookeeper broker pod and verify configuration that the TLS is disabled. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cat ../conf/zoo.cfg +4lw.commands.whitelist=* +dataDir=/data +tickTime=2000 +initLimit=10 +syncLimit=2 +clientPort=2181 +globalOutstandingLimit=1000 +preAllocSize=65536 +snapCount=10000 +commitLogCount=500 +snapSizeLimitInKb=4194304 +maxCnxns=0 +maxClientCnxns=60 +minSessionTimeout=4000 +maxSessionTimeout=40000 +autopurge.snapRetainCount=3 +autopurge.purgeInterval=1 +quorumListenOnAllIPs=false +admin.serverPort=8080 +authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider +reconfigEnabled=true +standaloneEnabled=false +dynamicConfigFile=/data/zoo.cfg.dynamic +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ +``` + +We can verify from the above output that TLS is disabled for this Ensemble. + +### Create Issuer/ ClusterIssuer + +Now, We are going to create an example `Issuer` that will be used to enable SSL/TLS in ZooKeeper. Alternatively, you can follow this [cert-manager tutorial](https://cert-manager.io/docs/configuration/ca/) to create your own `Issuer`. + +- Start off by generating a ca certificates using openssl. + +```bash +$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=ca/O=kubedb" +Generating a RSA private key +................+++++ +........................+++++ +writing new private key to './ca.key' +----- +``` + +- Now we are going to create a ca-secret using the certificate files that we have just generated. + +```bash +$ kubectl create secret tls zookeeper-ca \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=demo +secret/zookeeper-ca created +``` + +Now, Let's create an `Issuer` using the `zookeeper-ca` secret that we have just created. The `YAML` file looks like this: + +```yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca +``` + +Let's apply the `YAML` file: + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-issuer.yaml +issuer.cert-manager.io/zk-issuer created +``` + +### Create ZooKeeperOpsRequest + +In order to add TLS to the zookeeper, we have to create a `ZooKeeperOpsRequest` CRO with our created issuer. Below is the YAML of the `ZooKeeperOpsRequest` CRO that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-add-tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zookeeper-ca-issuer + kind: Issuer + apiGroup: "cert-manager.io" + certificates: + - alias: client + subject: + organizations: + - zookeeper + organizationalUnits: + - client + timeout: 5m + apply: IfReady +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart` cluster. +- `spec.type` specifies that we are performing `ReconfigureTLS` on zookeeper. +- `spec.tls.issuerRef` specifies the issuer name, kind and api group. +- `spec.tls.certificates` specifies the certificates. You can learn more about this field from [here](/docs/guides/zookeeper/concepts/zookeeper.md#spectls). + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-add-tls.yaml +zookeeperopsrequest.ops.kubedb.com/zkops-add-tls created +``` + +#### Verify TLS Enabled Successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequest -n demo +NAME TYPE STATUS AGE +zkops-add-tls ReconfigureTLS Successful 4m36s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-add-tls +Name: zkops-add-tls +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T05:46:18Z + Generation: 1 + Resource Version: 2118117 + UID: aa25e2b8-2583-4757-b3f7-b053fc21819f +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Issuer Ref: + API Group: cert-manager.io + Kind: Issuer + Name: zookeeper-ca-issuer + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T05:46:18Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T05:46:31Z + Message: Successfully synced all certificates + Observed Generation: 1 + Reason: CertificateSynced + Status: True + Type: CertificateSynced + Last Transition Time: 2024-11-04T05:46:26Z + Message: get certificate; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: GetCertificate + Last Transition Time: 2024-11-04T05:46:26Z + Message: check ready condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: CheckReadyCondition + Last Transition Time: 2024-11-04T05:46:26Z + Message: issuing condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: IssuingCondition + Last Transition Time: 2024-11-04T05:46:36Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T05:48:56Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T05:46:41Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T05:46:41Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T05:46:46Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T05:47:26Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T05:47:26Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T05:48:16Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T05:48:16Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T05:48:56Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: +``` + +Now, Let's exec into a zookeeper ensemble pod and verify the configuration that the TLS is enabled. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cat ../conf/zoo.cfg +4lw.commands.whitelist=* +dataDir=/data +tickTime=2000 +initLimit=10 +syncLimit=2 +clientPort=2181 +globalOutstandingLimit=1000 +preAllocSize=65536 +snapCount=10000 +commitLogCount=500 +snapSizeLimitInKb=4194304 +maxCnxns=0 +maxClientCnxns=60 +minSessionTimeout=4000 +maxSessionTimeout=40000 +autopurge.snapRetainCount=3 +autopurge.purgeInterval=1 +quorumListenOnAllIPs=false +admin.serverPort=8080 +authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider +reconfigEnabled=true +standaloneEnabled=false +dynamicConfigFile=/data/zoo.cfg.dynamic +secureClientPort=2182 +serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory +authProvider.x509=org.apache.zookeeper.server.auth.X509AuthenticationProvider +ssl.keyStore.location=/var/private/ssl/server.keystore.jks +ssl.keyStore.password=fdjk2dgffqn9 +ssl.trustStore.location=/var/private/ssl/server.truststore.jks +ssl.trustStore.password=fdjk2dgffqn9 +sslQuorum=true +ssl.quorum.keyStore.location=/var/private/ssl/server.keystore.jks +ssl.quorum.keyStore.password=fdjk2dgffqn9 +ssl.quorum.trustStore.location=/var/private/ssl/server.truststore.jks +ssl.quorum.trustStore.password=fdjk2dgffqn9 +ssl.quorum.hostnameVerification=false +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ +``` + +We can see from the above output that, keystore location is `/var/private/ssl/server.keystore.jks` which means that TLS is enabled. + +## Rotate Certificate + +Now we are going to rotate the certificate of this cluster. First let's check the current expiration date of the certificate. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ openssl x509 -in /var/private/ssl/tls.crt -inform PEM -enddate -nameopt RFC2253 -noout +notAfter=Feb 2 12:53:30 2025 GMT +``` + +So, the certificate will expire on this time `Feb 2 12:53:30 2025 GMT`. + +### Create ZooKeeperOpsRequest + +Now we are going to increase it using a ZooKeeperOpsRequest. Below is the yaml of the ops request that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-rotate + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + rotateCertificates: true +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart`. +- `spec.type` specifies that we are performing `ReconfigureTLS` on our cluster. +- `spec.tls.rotateCertificates` specifies that we want to rotate the certificate of this zookeeper cluster. + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zkops-rotate.yaml +zookeeperopsrequest.ops.kubedb.com/zkops-rotate created +``` + +#### Verify Certificate Rotated Successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequests -n demo zkops-rotate +NAME TYPE STATUS AGE +zkops-rotate ReconfigureTLS Successful 4m4s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-rotate +Name: zkops-rotate +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T13:10:03Z + Generation: 1 + Resource Version: 2153555 + UID: a1886cd3-784b-4523-936c-a510327d6129 +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Rotate Certificates: true + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T13:10:03Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T13:10:16Z + Message: Successfully synced all certificates + Observed Generation: 1 + Reason: CertificateSynced + Status: True + Type: CertificateSynced + Last Transition Time: 2024-11-04T13:10:11Z + Message: get certificate; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: GetCertificate + Last Transition Time: 2024-11-04T13:10:11Z + Message: check ready condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: CheckReadyCondition + Last Transition Time: 2024-11-04T13:10:11Z + Message: issuing condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: IssuingCondition + Last Transition Time: 2024-11-04T13:10:22Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T13:12:42Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T13:10:27Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:10:27Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:10:32Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T13:11:07Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:11:07Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:11:52Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:11:52Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:12:42Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Starting 2m57s KubeDB Ops-manager Operator Start processing for ZooKeeperOpsRequest: demo/zkops-rotate + Normal Starting 2m57s KubeDB Ops-manager Operator Pausing ZooKeeper database: demo/zk-quickstart + Normal Successful 2m57s KubeDB Ops-manager Operator Successfully paused ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-rotate + Warning get certificate; ConditionStatus:True 2m49s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m49s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m49s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m49s KubeDB Ops-manager Operator Successfully synced all certificates + Warning get certificate; ConditionStatus:True 2m44s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m44s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m44s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m44s KubeDB Ops-manager Operator Successfully synced all certificates + Normal UpdatePetSets 2m38s KubeDB Ops-manager Operator successfully reconciled the ZooKeeper with tls configuration + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning running pod; ConditionStatus:False 2m28s KubeDB Ops-manager Operator running pod; ConditionStatus:False + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-1 113s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-1 113s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-2 68s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-2 68s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Normal RestartNodes 18s KubeDB Ops-manager Operator Successfully restarted all nodes + Normal Starting 18s KubeDB Ops-manager Operator Resuming ZooKeeper database: demo/zk-quickstart + Normal Successful 18s KubeDB Ops-manager Operator Successfully resumed ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-rotate +``` + +Now, let's check the expiration date of the certificate. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ openssl x509 -in /var/private/ssl/tls.crt -inform PEM -enddate -nameopt RFC2253 -noout +notAfter=Feb 2 13:12:42 2025 GMT +``` + +As we can see from the above output, the certificate has been rotated successfully. + +## Change Issuer/ClusterIssuer + +Now, we are going to change the issuer of this database. + +- Let's create a new ca certificate and key using a different subject `CN=ca-update,O=kubedb-updated`. + +```bash +$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=ca-updated/O=kubedb-updated" +Generating a RSA private key +..............................................................+++++ +......................................................................................+++++ +writing new private key to './ca.key' +----- +``` + +- Now we are going to create a new ca-secret using the certificate files that we have just generated. + +```bash +$ kubectl create secret tls zookeeper-new-ca \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=demo +secret/zookeeper-new-ca created +``` + +Now, Let's create a new `Issuer` using the `mongo-new-ca` secret that we have just created. The `YAML` file looks like this: + +```yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zk-new-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-new-ca +``` + +Let's apply the `YAML` file: + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-new-issuer.yaml +issuer.cert-manager.io/zk-new-issuer created +``` + +### Create ZooKeeperOpsRequest + +In order to use the new issuer to issue new certificates, we have to create a `ZooKeeperOpsRequest` CRO with the newly created issuer. Below is the YAML of the `ZooKeeperOpsRequest` CRO that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-update-issuer + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + issuerRef: + name: zk-new-issuer + kind: Issuer + apiGroup: "cert-manager.io" +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart` cluster. +- `spec.type` specifies that we are performing `ReconfigureTLS` on our zookeeper. +- `spec.tls.issuerRef` specifies the issuer name, kind and api group. + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zookeeper-update-tls-issuer.yaml +zookeeperpsrequest.ops.kubedb.com/zkops-update-issuer created +``` + +#### Verify Issuer is changed successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequests -n demo zkops-update-issuer +NAME TYPE STATUS AGE +zkops-update-issuer ReconfigureTLS Successful 8m6s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-update-issuer +Name: zkops-update-issuer +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T13:27:25Z + Generation: 1 + Resource Version: 2155331 + UID: 399cae54-a6ab-4848-93ff-5dba09a128d7 +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Issuer Ref: + API Group: cert-manager.io + Kind: Issuer + Name: zk-new-issuer + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T13:27:25Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T13:27:35Z + Message: Successfully synced all certificates + Observed Generation: 1 + Reason: CertificateSynced + Status: True + Type: CertificateSynced + Last Transition Time: 2024-11-04T13:27:30Z + Message: get certificate; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: GetCertificate + Last Transition Time: 2024-11-04T13:27:30Z + Message: check ready condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: CheckReadyCondition + Last Transition Time: 2024-11-04T13:27:30Z + Message: issuing condition; ConditionStatus:True + Observed Generation: 1 + Status: True + Type: IssuingCondition + Last Transition Time: 2024-11-04T13:27:40Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T13:30:00Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T13:27:45Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:27:45Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:27:50Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T13:28:30Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:28:30Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:29:20Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:29:20Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:30:00Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Starting 2m53s KubeDB Ops-manager Operator Start processing for ZooKeeperOpsRequest: demo/zkops-update-issuer + Warning get certificate; ConditionStatus:True 2m48s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m48s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m48s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m48s KubeDB Ops-manager Operator Successfully synced all certificates + Warning get certificate; ConditionStatus:True 2m43s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Warning get certificate; ConditionStatus:True 2m43s KubeDB Ops-manager Operator get certificate; ConditionStatus:True + Warning check ready condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator check ready condition; ConditionStatus:True + Warning issuing condition; ConditionStatus:True 2m43s KubeDB Ops-manager Operator issuing condition; ConditionStatus:True + Normal CertificateSynced 2m43s KubeDB Ops-manager Operator Successfully synced all certificates + Normal UpdatePetSets 2m38s KubeDB Ops-manager Operator successfully reconciled the ZooKeeper with tls configuration + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-0 2m33s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning running pod; ConditionStatus:False 2m28s KubeDB Ops-manager Operator running pod; ConditionStatus:False + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-1 108s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-1 108s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-2 58s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-2 58s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Normal RestartNodes 18s KubeDB Ops-manager Operator Successfully restarted all nodes + Normal Starting 18s KubeDB Ops-manager Operator Resuming ZooKeeper database: demo/zk-quickstart + Normal Successful 18s KubeDB Ops-manager Operator Successfully resumed ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-update-issuer +``` + +Now, Let's exec into a zookeeper node and find out the ca subject to see if it matches the one we have provided. + +```bash +>$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ keytool -list -v -keystore /var/private/ssl/server.keystore.jks -storepass fdjk2dgffqn9 | grep 'Issuer' +Issuer: O=kubedb-updated, CN=ca-updated +Issuer: O=kubedb-updated, CN=ca-updated +``` + +We can see from the above output that, the subject name matches the subject name of the new ca certificate that we have created. So, the issuer is changed successfully. + +## Remove TLS from the Database + +Now, we are going to remove TLS from this database using a ZooKeeperOpsRequest. + +### Create ZooKeeperOpsRequest + +Below is the YAML of the `ZooKeeperOpsRequest` CRO that we are going to create, + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: ZooKeeperOpsRequest +metadata: + name: zkops-remove + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: zk-quickstart + tls: + remove: true +``` + +Here, + +- `spec.databaseRef.name` specifies that we are performing reconfigure TLS operation on `zk-quickstart` cluster. +- `spec.type` specifies that we are performing `ReconfigureTLS` on ZooKeeper. +- `spec.tls.remove` specifies that we want to remove tls from this cluster. + +Let's create the `ZooKeeperOpsRequest` CR we have shown above, + +```bash +$ kubectl apply -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/reconfigure-tls/zkops-remove.yaml +zookeeperopsrequest.ops.kubedb.com/zkops-remove created +``` + +#### Verify TLS Removed Successfully + +Let's wait for `ZooKeeperOpsRequest` to be `Successful`. Run the following command to watch `ZooKeeperOpsRequest` CRO, + +```bash +$ kubectl get zookeeperopsrequest -n demo zkops-remove +NAME TYPE STATUS AGE +zkops-remove ReconfigureTLS Successful 105s +``` + +We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed. + +```bash +$ kubectl describe zookeeperopsrequest -n demo zkops-remove +Name: zkops-remove +Namespace: demo +Labels: +Annotations: +API Version: ops.kubedb.com/v1alpha1 +Kind: ZooKeeperOpsRequest +Metadata: + Creation Timestamp: 2024-11-04T13:39:19Z + Generation: 1 + Resource Version: 2156556 + UID: 8f669fe1-169f-4446-9d12-bf959216e2e0 +Spec: + Apply: IfReady + Database Ref: + Name: zk-quickstart + Tls: + Remove: true + Type: ReconfigureTLS +Status: + Conditions: + Last Transition Time: 2024-11-04T13:39:19Z + Message: ZooKeeper ops-request has started to reconfigure tls for zookeeper nodes + Observed Generation: 1 + Reason: ReconfigureTLS + Status: True + Type: ReconfigureTLS + Last Transition Time: 2024-11-04T13:39:27Z + Message: successfully reconciled the ZooKeeper with tls configuration + Observed Generation: 1 + Reason: UpdatePetSets + Status: True + Type: UpdatePetSets + Last Transition Time: 2024-11-04T13:41:42Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-11-04T13:39:32Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:39:32Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-0 + Last Transition Time: 2024-11-04T13:39:37Z + Message: running pod; ConditionStatus:False + Observed Generation: 1 + Status: False + Type: RunningPod + Last Transition Time: 2024-11-04T13:40:22Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:40:22Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-11-04T13:41:02Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:41:02Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-11-04T13:41:42Z + Message: Successfully completed reconfigureTLS for zookeeper. + Observed Generation: 1 + Reason: Successful + Status: True + Type: Successful + Observed Generation: 1 + Phase: Successful +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Starting 2m26s KubeDB Ops-manager Operator Start processing for ZooKeeperOpsRequest: demo/zkops-remove + Normal Starting 2m26s KubeDB Ops-manager Operator Pausing ZooKeeper database: demo/zk-quickstart + Normal Successful 2m26s KubeDB Ops-manager Operator Successfully paused ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-remove + Normal UpdatePetSets 2m18s KubeDB Ops-manager Operator successfully reconciled the ZooKeeper with tls configuration + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-0 2m13s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-0 2m13s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-0 + Warning running pod; ConditionStatus:False 2m8s KubeDB Ops-manager Operator running pod; ConditionStatus:False + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-1 83s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-1 83s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-1 + Warning get pod; ConditionStatus:True; PodName:zk-quickstart-2 43s KubeDB Ops-manager Operator get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Warning evict pod; ConditionStatus:True; PodName:zk-quickstart-2 43s KubeDB Ops-manager Operator evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Normal RestartNodes 3s KubeDB Ops-manager Operator Successfully restarted all nodes + Normal Starting 3s KubeDB Ops-manager Operator Resuming ZooKeeper database: demo/zk-quickstart + Normal Successful 3s KubeDB Ops-manager Operator Successfully resumed ZooKeeper database: demo/zk-quickstart for ZooKeeperOpsRequest: zkops-remove +``` + +Now, Let's exec into one of the broker node and find out that TLS is disabled or not. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cat ../conf/zoo.cfg +4lw.commands.whitelist=* +dataDir=/data +tickTime=2000 +initLimit=10 +syncLimit=2 +clientPort=2181 +globalOutstandingLimit=1000 +preAllocSize=65536 +snapCount=10000 +commitLogCount=500 +snapSizeLimitInKb=4194304 +maxCnxns=0 +maxClientCnxns=60 +minSessionTimeout=4000 +maxSessionTimeout=40000 +autopurge.snapRetainCount=3 +autopurge.purgeInterval=1 +quorumListenOnAllIPs=false +admin.serverPort=8080 +authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider +reconfigEnabled=true +standaloneEnabled=false +dynamicConfigFile=/data/zoo.cfg.dynamic +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ +``` + +So, we can see from the above that, output that tls is disabled successfully. + +## Cleaning up + +To cleanup the Kubernetes resources created by this tutorial, run: + +```bash +kubectl delete opsrequest zkops-add-tls zkops-remove zkops-rotate zkops-update-issuer +kubectl delete zookeeper -n demo zk-quickstart +kubectl delete issuer -n demo zk-issuer zk-new-issuer +kubectl delete ns demo +``` + +## Next Steps + +- Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). +- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). + diff --git a/docs/guides/zookeeper/reconfigure/reconfigure.md b/docs/guides/zookeeper/reconfigure/reconfigure.md index 8d67c1cf86..fc45e67f15 100644 --- a/docs/guides/zookeeper/reconfigure/reconfigure.md +++ b/docs/guides/zookeeper/reconfigure/reconfigure.md @@ -97,7 +97,7 @@ zookeeper.kubedb.com/zk-quickstart created Now, wait until `zk-quickstart` has status `Ready`. i.e, ```bash -$ kubectl get mc -n demo +$ kubectl get zk -n demo NAME VERSION STATUS AGE zk-quickstart 3.8.3 Ready 23s ``` @@ -300,7 +300,7 @@ Now need to check the new configuration we have provided. Now, wait until `zk-quickstart` has status `Ready`. i.e, ```bash -$ kubectl get mc -n demo +$ kubectl get zk -n demo NAME VERSION STATUS AGE zk-quickstart 3.8.3 Ready 20s ``` @@ -390,112 +390,140 @@ zk-reconfig-apply Reconfigure Successful 38s We can see from the above output that the `ZooKeeperOpsRequest` has succeeded. If we describe the `ZooKeeperOpsRequest` we will get an overview of the steps that were followed to reconfigure the database. ```bash -$ kubectl describe zookeeperopsrequest -n demo zk-apply-reconfig -Name: zk-apply-reconfig +$ kubectl describe zookeeperopsrequest -n demo zk-reconfig-apply +Name: zk-reconfig-apply Namespace: demo Labels: Annotations: API Version: ops.kubedb.com/v1alpha1 Kind: ZooKeeperOpsRequest Metadata: - Creation Timestamp: 2024-09-03T06:02:41Z + Creation Timestamp: 2024-10-30T08:27:00Z Generation: 1 - Resource Version: 178039 - UID: d1f90151-abeb-4035-87f4-e2bc89c35b89 + Resource Version: 1548116 + UID: 4f3daa11-c41b-4079-a8d8-1040931284ef Spec: Apply: IfReady Configuration: - Apply Config: - memcached.conf: --conn-limit=3000 - + Config Secret: + Name: zk-new-configuration Database Ref: Name: zk-quickstart Type: Reconfigure Status: Conditions: - Last Transition Time: 2024-09-03T06:02:41Z - Message: ZooKeeper ops request is reconfiguring the cluster + Last Transition Time: 2024-10-30T08:27:00Z + Message: ZooKeeper ops-request has started to reconfigure ZooKeeper nodes Observed Generation: 1 Reason: Reconfigure Status: True Type: Reconfigure - Last Transition Time: 2024-09-03T06:02:44Z - Message: reconfiguring memcached + Last Transition Time: 2024-10-30T08:27:08Z + Message: successfully reconciled the ZooKeeper with new configure Observed Generation: 1 Reason: UpdatePetSets Status: True Type: UpdatePetSets - Last Transition Time: 2024-09-03T06:02:49Z + Last Transition Time: 2024-10-30T08:29:18Z + Message: Successfully restarted all nodes + Observed Generation: 1 + Reason: RestartNodes + Status: True + Type: RestartNodes + Last Transition Time: 2024-10-30T08:27:13Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-0 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-0 + Last Transition Time: 2024-10-30T08:27:13Z Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-0 Observed Generation: 1 Status: True Type: EvictPod--zk-quickstart-0 - Last Transition Time: 2024-09-03T06:02:49Z - Message: is pod ready; ConditionStatus:False + Last Transition Time: 2024-10-30T08:27:18Z + Message: running pod; ConditionStatus:False Observed Generation: 1 Status: False - Type: IsPodReady - Last Transition Time: 2024-09-03T06:02:54Z - Message: is pod ready; ConditionStatus:True; PodName:zk-quickstart-0 + Type: RunningPod + Last Transition Time: 2024-10-30T08:27:58Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-1 Observed Generation: 1 Status: True - Type: IsPodReady--zk-quickstart-0 - Last Transition Time: 2024-09-03T06:02:54Z - Message: Restarted pods after reconfiguration + Type: GetPod--zk-quickstart-1 + Last Transition Time: 2024-10-30T08:27:58Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-1 Observed Generation: 1 - Reason: RestartPods Status: True - Type: RestartPods - Last Transition Time: 2024-09-03T06:02:54Z - Message: Successfully completed the modification process. + Type: EvictPod--zk-quickstart-1 + Last Transition Time: 2024-10-30T08:28:38Z + Message: get pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: GetPod--zk-quickstart-2 + Last Transition Time: 2024-10-30T08:28:38Z + Message: evict pod; ConditionStatus:True; PodName:zk-quickstart-2 + Observed Generation: 1 + Status: True + Type: EvictPod--zk-quickstart-2 + Last Transition Time: 2024-10-30T08:29:18Z + Message: Successfully completed reconfigure ZooKeeper Observed Generation: 1 Reason: Successful Status: True Type: Successful Observed Generation: 1 Phase: Successful -Events: - Type Reason Age From Message - ---- ------ ---- ---- ------- - Normal PauseDatabase 26s KubeDB Ops-manager Operator Pausing ZooKeeper demo/zk-quickstart - Normal RestartPods 13s KubeDB Ops-manager Operator Restarted pods after reconfiguration - Normal ResumeDatabase 13s KubeDB Ops-manager Operator Resuming ZooKeeper demo/zk-quickstart - Normal ResumeDatabase 13s KubeDB Ops-manager Operator Successfully resumed ZooKeeper demo/zk-quickstart - Normal Successful 13s KubeDB Ops-manager Operator Successfully Reconfigured Database - +Events: ``` -Now let's check the new configuration we have provided. +Now need to check the new configuration we have provided. -We will connect to `zk-quickstart-0` pod from local-machine using port-frowarding. +Now, wait until `zk-quickstart` has status `Ready`. i.e, ```bash -$ kubectl port-forward -n demo zk-quickstart-0 11211 -Forwarding from 127.0.0.1:11211 -> 11211 -Forwarding from [::1]:11211 -> 11211 +$ kubectl get zk -n demo +NAME VERSION STATUS AGE +zk-quickstart 3.8.3 Ready 20s ``` -Now, connect to the memcached server from a different terminal through `telnet`. +Now let’s exec into the zookeeper pod and check the new configuration we have provided. ```bash -$ telnet 127.0.0.1 11211 -Trying 127.0.0.1... -Connected to 127.0.0.1. -Escape character is '^]'. -stats -... -STAT max_connections 3000 -... -END +$ Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ echo conf | nc localhost 2181 +clientPort=2181 +secureClientPort=-1 +dataDir=/data/version-2 +dataDirSize=134218330 +dataLogDir=/data/version-2 +dataLogSize=134218330 +tickTime=2000 +maxClientCnxns=90 +minSessionTimeout=4000 +maxSessionTimeout=40000 +clientPortListenBacklog=-1 +serverId=1 +initLimit=10 +syncLimit=2 +electionAlg=3 +electionPort=3888 +quorumPort=2888 +peerType=0 +membership: +server.1=zk-quickstart-0.zk-quickstart-pods.demo.svc.cluster.local:2888:3888:participant;0.0.0.0:2181 +server.2=zk-quickstart-1.zk-quickstart-pods.demo.svc.cluster.local:2888:3888:participant;0.0.0.0:2181 +server.3=zk-quickstart-2.zk-quickstart-pods.demo.svc.cluster.local:2888:3888:participant;0.0.0.0:2181 +version=100000011zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ exit +exit ``` -As we can see from the configuration of running memcached, the value of `maxclients` has been changed from `2000` to `3000`. So, the reconfiguration of the database using the `applyConfig` field is successful. +As we can see from the configuration of running zookeeper, the value of `maxClientCnxns` has been changed from `100` to `90`. So, the reconfiguration of the database using the `applyConfig` field is successful. ## Cleaning Up To clean up the Kubernetes resources created by this tutorial, run: ```bash -kubectl delete mc -n demo zk-quickstart -kubectl delete zookeeperopsrequest -n demo zk-reconfig zk-apply-reconfig +kubectl delete zk -n demo zk-quickstart +kubectl delete zookeeperopsrequest -n demo zk-reconfig zk-reconfig-apply ``` \ No newline at end of file diff --git a/docs/guides/zookeeper/restart/restart.md b/docs/guides/zookeeper/restart/restart.md index 387b837774..583f8b0de2 100644 --- a/docs/guides/zookeeper/restart/restart.md +++ b/docs/guides/zookeeper/restart/restart.md @@ -201,6 +201,5 @@ kubectl delete ns demo ## Next Steps -- Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). - Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). - Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). diff --git a/docs/guides/zookeeper/tls/_index.md b/docs/guides/zookeeper/tls/_index.md new file mode 100644 index 0000000000..d1b1b06277 --- /dev/null +++ b/docs/guides/zookeeper/tls/_index.md @@ -0,0 +1,10 @@ +--- +title: Run ZooKeeper with TLS +menu: + docs_{{ .version }}: + identifier: zk-tls + name: TLS/SSL Encryption + parent: zk-zookeeper-guides + weight: 45 +menu_name: docs_{{ .version }} +--- diff --git a/docs/guides/zookeeper/tls/configure_ssl.md b/docs/guides/zookeeper/tls/configure_ssl.md new file mode 100644 index 0000000000..378d70c619 --- /dev/null +++ b/docs/guides/zookeeper/tls/configure_ssl.md @@ -0,0 +1,268 @@ +--- +title: ZooKeeper TLS/SSL Encryption +menu: + docs_{{ .version }}: + identifier: zk-tls-configure + name: ZooKeeper_SSL + parent: zk-zookeeper-guides + weight: 20 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# Run ZooKeeper Ensemble with TLS/SSL + +KubeDB supports providing TLS/SSL encryption for ZooKeeper Ensemble. This tutorial will show you how to use KubeDB to run a ZooKeeper Ensemble with TLS/SSL encryption. + +## Before You Begin + +- At first, you need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one by using [kind](https://kind.sigs.k8s.io/docs/user/quick-start/). + +- Install [`cert-manger`](https://cert-manager.io/docs/installation/) v1.0.0 or later to your cluster to manage your SSL/TLS certificates. + +- Now, install KubeDB cli on your workstation and KubeDB operator in your cluster following the steps [here](/docs/setup/README.md). + +- To keep things isolated, this tutorial uses a separate namespace called `demo` throughout this tutorial. + + ```bash + $ kubectl create ns demo + namespace/demo created + ``` + +> Note: YAML files used in this tutorial are stored in [docs/examples/zookeeper](https://github.com/kubedb/docs/tree/{{< param "info.version" >}}/docs/examples/zookeeper) folder in GitHub repository [kubedb/docs](https://github.com/kubedb/docs). + +## Overview + +KubeDB uses following crd fields to enable SSL/TLS encryption in ZooKeeper. + +- `spec:` + - `enableSSL` + - `tls:` + - `issuerRef` + - `certificate` + +Read about the fields in details in [zookeeper concept](/docs/guides/zookeeper/concepts/zookeeper.md), + +Users must specify the `tls.issuerRef` field. KubeDB uses the `issuer` or `clusterIssuer` referenced in the `tls.issuerRef` field, and the certificate specs provided in `tls.certificate` to generate certificate secrets. These certificate secrets are then used to generate required certificates including `ca.crt`, `tls.crt`, `tls.key`, `keystore.jks` and `truststore.jks`. + +## Create Issuer/ ClusterIssuer + +We are going to create an example `Issuer` that will be used throughout the duration of this tutorial to enable SSL/TLS in ZooKeeper. Alternatively, you can follow this [cert-manager tutorial](https://cert-manager.io/docs/configuration/ca/) to create your own `Issuer`. + +- Start off by generating you ca certificates using openssl. + +```bash +openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./ca.key -out ./ca.crt -subj "/CN=zookeeper/O=kubedb" +``` + +- Now create a ca-secret using the certificate files you have just generated. + +```bash +kubectl create secret tls zookeeper-ca \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=demo +``` + +Now, create an `Issuer` using the `ca-secret` you have just created. The `YAML` file looks like this: + +```yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: zookeeper-ca-issuer + namespace: demo +spec: + ca: + secretName: zookeeper-ca +``` + +Apply the `YAML` file: + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/tls/zookeeper-issuer.yaml +issuer.cert-manager.io/zookeeper-ca-issuer created +``` + +## TLS/SSL encryption in ZooKeeper Ensemble + +Below is the YAML for ZooKeeper with TLS enabled: + +```yaml +apiVersion: kubedb.com/v1alpha2 +kind: ZooKeeper +metadata: + name: zk-tls + namespace: demo +spec: + version: "3.8.3" + enableSSL: true + tls: + issuerRef: + apiGroup: "cert-manager.io" + kind: Issuer + name: zookeeper-ca-issuer + adminServerPort: 8080 + replicas: 5 + storage: + resources: + requests: + storage: "1Gi" + accessModes: + - ReadWriteOnce + deletionPolicy: "WipeOut" + +``` + +Here, +- `spec.enableSSL` is set to `true` to enable TLS/SSL encryption. +- `spec.tls.issuerRef` refers to the `Issuer` that we have created in the previous step. +- +### Deploy ZOoKeeper Ensemble with TLS/SSL + +```bash +$ kubectl create -f https://github.com/kubedb/docs/raw/{{< param "info.version" >}}/docs/examples/zookeeper/tls/zookeeper-tls.yaml +zookeeper.kubedb.com/zk-tls created +``` + +Now, wait until `zookeeper-tls created` has status `Ready`. i.e, + +```bash +$ watch kubectl get zookeeper -n demo +NAME TYPE VERSION STATUS AGE +zk-tls kubedb.com/v1alpha2 3.8.3 Ready 60s +``` + +### Verify TLS/SSL in ZooKeeper Ensemble + +```bash +$ kubectl describe secret -n demo zk-quickstart-client-cert +Name: zk-quickstart-client-cert +Namespace: demo +Labels: app.kubernetes.io/component=database + app.kubernetes.io/instance=zk-quickstart + app.kubernetes.io/managed-by=kubedb.com + app.kubernetes.io/name=zookeepers.kubedb.com + controller.cert-manager.io/fao=true +Annotations: cert-manager.io/alt-names: + *.zk-quickstart-pods.demo.svc.cluster.local,localhost,zk-quickstart,zk-quickstart-pods,zk-quickstart-pods.demo.svc,zk-quickstart-pods.demo... + cert-manager.io/certificate-name: zk-quickstart-client-cert + cert-manager.io/common-name: zk-quickstart-pods.demo.svc + cert-manager.io/ip-sans: 127.0.0.1 + cert-manager.io/issuer-group: cert-manager.io + cert-manager.io/issuer-kind: Issuer + cert-manager.io/issuer-name: zookeeper-ca-issuer + cert-manager.io/uri-sans: + +Type: kubernetes.io/tls + +Data +==== +ca.crt: 1159 bytes +keystore.jks: 3258 bytes +tls-combined.pem: 3198 bytes +tls.crt: 1493 bytes +tls.key: 1704 bytes +truststore.jks: 873 bytes +``` + +Now, Let's exec into a ZooKeeper pod and verify the configuration that the TLS is enabled. + +```bash +$ kubectl exec -it -n demo zk-quickstart-0 -- bash +Defaulted container "zookeeper" out of: zookeeper, zookeeper-init (init) +zookeeper@zk-quickstart-0:/apache-zookeeper-3.8.3-bin$ cd ../var/private/ssl +zookeeper@zk-quickstart-0:/var/private/ssl$ openssl s_client -connect localhost:2182 -CAfile ca.crt -cert tls.crt -key tls.key +CONNECTED(00000003) +depth=1 CN = zookeeper, O = kubedb +verify return:1 +depth=0 CN = zk-quickstart.demo.svc +verify return:1 +--- +Certificate chain + 0 s:CN = zk-quickstart.demo.svc + i:CN = zookeeper, O = kubedb + a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 + v:NotBefore: Nov 4 05:46:21 2024 GMT; NotAfter: Feb 2 05:46:21 2025 GMT +--- +Server certificate +-----BEGIN CERTIFICATE----- +MIIEJTCCAw2gAwIBAgIQaWLGhg/TgVF8oXGcsLQkKjANBgkqhkiG9w0BAQsFADAl +MRIwEAYDVQQDDAl6b29rZWVwZXIxDzANBgNVBAoMBmt1YmVkYjAeFw0yNDExMDQw +NTQ2MjFaFw0yNTAyMDIwNTQ2MjFaMCExHzAdBgNVBAMTFnprLXF1aWNrc3RhcnQu +ZGVtby5zdmMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeeiLZeNa7 +wHOUwD76fmp45Ae9qlpHCW/lGz+lGO48FBDUBbG2Tm2BZVW2297HOzb/Lax6Molb +9qCDsV7ITCUYXLBGz0pCGqGYS/icZupShhKAvD33Gn8kH/QeANwFonpxBAtr36vi +WxwcRD+dfVAu7OCATwSakZh3zdbRPQXLiAVqj8qn4zNSYL5bzUXQ5dHFzvgwZve5 +FR3QYLvVjUEu2tFjCKM+/HTzQ/IMUAjcU0lU4qnWqnhgcGp8ZE3hDyL9OOOsjrWx +CGNhB0Orf6Efztkqq4FMZ//w3DUQgnRglGKl1rGK015//W0MGSPlT4uve6Z7zaRU +aUqa7Y8P5wZxAgMBAAGjggFTMIIBTzAOBgNVHQ8BAf8EBAMCAqQwHQYDVR0lBBYw +FAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FC7Wrn4SOKhsT4TQFEMtSao72H5TMB8GA1UdIwQYMBaAFDe7/VhWOllB39U/xOht +MxmZu9wQMIHMBgNVHREEgcQwgcGCKyouemstcXVpY2tzdGFydC1wb2RzLmRlbW8u +c3ZjLmNsdXN0ZXIubG9jYWyCCWxvY2FsaG9zdIINemstcXVpY2tzdGFydIISemst +cXVpY2tzdGFydC1wb2Rzght6ay1xdWlja3N0YXJ0LXBvZHMuZGVtby5zdmOCKXpr +LXF1aWNrc3RhcnQtcG9kcy5kZW1vLnN2Yy5jbHVzdGVyLmxvY2FsghZ6ay1xdWlj +a3N0YXJ0LmRlbW8uc3ZjhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQCGGxgGzdjF +Vo9VALc6ddZD50M7bfh5L5z2KfSY4ZH7kuokM52LGzJYwREV3UpVAhjBqn0XEf9p +JX8ePo0Z9zjtWIIZg4ctjlCvKDy+HpKlqh2RJejnl+NoLPV628QJDiEksLzdVl4v +z36AwdGeUhADpvoGQiXUT6LgrD++Uv0akpDEzWOB2LUKsvCRKnxyBNyBqpsW8/Pu +DeC/RUGXT/JFtZtDBGp8d/FOIpJ0t/ZjrI9Hyu5DLFB08oTYmEVE3Lv2owZZV/o8 +6YqlpTu2efKEzMFZudUWpnGUrb69sZeDR9hwxGcAdKobTB8SZOBU61nsRn95BH7O +S4dKhcrbzP70 +-----END CERTIFICATE----- +subject=CN = zk-quickstart.demo.svc +issuer=CN = zookeeper, O = kubedb +--- +Acceptable client certificate CA names +CN = zookeeper, O = kubedb +Client Certificate Types: ECDSA sign, RSA sign, DSA sign +Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:DSA+SHA256:ECDSA+SHA224:RSA+SHA224:DSA+SHA224:ECDSA+SHA1:RSA+SHA1:DSA+SHA1 +Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:DSA+SHA256:ECDSA+SHA224:RSA+SHA224:DSA+SHA224 +Peer signing digest: SHA256 +Peer signature type: RSA-PSS +Server Temp Key: X25519, 253 bits +--- +SSL handshake has read 1611 bytes and written 2553 bytes +Verification: OK +--- +New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 +Server public key is 2048 bit +Secure Renegotiation IS supported +Compression: NONE +Expansion: NONE +No ALPN negotiated +SSL-Session: + Protocol : TLSv1.2 + Cipher : ECDHE-RSA-AES128-GCM-SHA256 + Session-ID: 057DF7D5B8BCE6DA3EAE6101136E644057BE67AF0A4931DC8FD15848D4E74D38 + Session-ID-ctx: + Master-Key: 807690ACC8782745D1C8AB6E4CF42FCAE7B13CAAC75A27FF4538FEA136DB9E6A332FDDB18703367593EBAD77629919C3 + PSK identity: None + PSK identity hint: None + SRP username: None + Start Time: 1730703067 + Timeout : 7200 (sec) + Verify return code: 0 (ok) + Extended master secret: yes +--- +``` + +From the above output, we can see that we are able to connect to the ZooKeeper Ensemble using the TLS configuration. + +## Cleaning up + +To cleanup the Kubernetes resources created by this tutorial, run: + +```bash +kubectl delete zookeeper -n demo zk-tls +kubectl delete issuer -n demo zookeeper-ca-issuer +kubectl delete ns demo +``` + +## Next Steps + +- Detail concepts of [ZooKeeper object](/docs/guides/zookeeper/concepts/zookeeper.md). +- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). \ No newline at end of file diff --git a/docs/guides/zookeeper/tls/overview.md b/docs/guides/zookeeper/tls/overview.md new file mode 100644 index 0000000000..91f5cfe0bc --- /dev/null +++ b/docs/guides/zookeeper/tls/overview.md @@ -0,0 +1,70 @@ +--- +title: ZooKeeper TLS/SSL Encryption Overview +menu: + docs_{{ .version }}: + identifier: zk-tls-overview + name: Overview + parent: zk-tls + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# ZooKeeper TLS/SSL Encryption + +**Prerequisite :** To configure TLS/SSL in `ZooKeeper`, `KubeDB` uses `cert-manager` to issue certificates. So first you have to make sure that the cluster has `cert-manager` installed. To install `cert-manager` in your cluster following steps [here](https://cert-manager.io/docs/installation/kubernetes/). + +To issue a certificate, the following crd of `cert-manager` is used: + +- `Issuer/ClusterIssuer`: Issuers, and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details [here](https://cert-manager.io/docs/concepts/issuer/). + +- `Certificate`: `cert-manager` has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details [here](https://cert-manager.io/docs/concepts/certificate/). + +**ZooKeeper CRD Specification :** + +KubeDB uses following crd fields to enable SSL/TLS encryption in `ZooKeeper`. + +- `spec:` + - `enableSSL` + - `tls:` + - `issuerRef` + - `certificates` + +Read about the fields in details from [zookeeper concept](/docs/guides/zookeeper/concepts/zookeeper.md), + +When, `enableSSL` is set to `true`, the users must specify the `tls.issuerRef` field. `KubeDB` uses the `issuer` or `clusterIssuer` referenced in the `tls.issuerRef` field, and the certificate specs provided in `tls.certificate` to generate certificate secrets using `Issuer/ClusterIssuers` specification. These certificates secrets including `ca.crt`, `tls.crt` and `tls.key` etc. are used to configure `zookeeper` server and clients. + +## How TLS/SSL configures in ZooKeeper + +The following figure shows how `KubeDB` enterprise used to configure TLS/SSL in ZooKeeper. Open the image in a new tab to see the enlarged version. + + + +Fig: Deploy ZooKeeper with TLS/SSL + + +Deploying ZooKeeper with TLS/SSL configuration process consists of the following steps: + +1. At first, a user creates a `Issuer/ClusterIssuer` CR. + +2. Then the user creates a `ZooKeeper` CR which refers to the `Issuer/ClusterIssuer` CR that the user created in the previous step. + +3. `KubeDB` Provisioner operator watches for the `ZooKeeper` CR. + +4. When it finds one, it creates `Secret`, `Service`, etc. for the `ZooKeeper` cluster. + +5. `KubeDB` Ops-manager operator watches for `ZooKeeper`(5c), `Issuer/ClusterIssuer`(5b), `Secret` and `Service`(5a). + +6. When it finds all the resources(`ZooKeeper`, `Issuer/ClusterIssuer`, `Secret`, `Service`), it creates `Certificates` by using `tls.issuerRef` and `tls.certificates` field specification from `ZooKeeper` CR. + +7. `cert-manager` watches for certificates. + +8. When it finds one, it creates certificate secrets `tls-secrets`(server, client, exporter secrets etc.) that holds the actual certificate signed by the CA. + +9. `KubeDB` Provisioner operator watches for the Certificate secrets `tls-secrets`. + +10. When it finds all the tls-secret, it creates the related `PetSets` so that ZooKeeper database can be configured with TLS/SSL. + +In the next doc, we are going to show a step-by-step guide on how to configure a `ZooKeeper` cluster with TLS/SSL. \ No newline at end of file diff --git a/docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg b/docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg new file mode 100644 index 0000000000..00b4a4f6ab --- /dev/null +++ b/docs/images/day-2-operation/zookeeper/zk-reconfigure-tls.svg @@ -0,0 +1,3 @@ + + +1.Create zookeeper1.Create ZooKeeper2.Watch2.Watch3.Create3.Create4.Initiate Re-configuring TLS4.Initiate Re-c...6.Pause6.Pause8.Restart Pods8.Restart Pods7.Update TLS configuration7.Update TLS configurati...9.Resume9.ResumeReconfiguring TLS stageReconfiguring TLS stageUserUser Community Operator StatefulSet'sPodStateful...5.Watch5.Watch Enterprise OperatorZooKeeper OpsRequestZooKeeper...ZooKeeperZooKeeperrefers torefers toUpdatedZooKeeperUpdate...Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/docs/images/zookeeper/zk-tls.svg b/docs/images/zookeeper/zk-tls.svg new file mode 100644 index 0000000000..b29b566468 --- /dev/null +++ b/docs/images/zookeeper/zk-tls.svg @@ -0,0 +1,4 @@ + + + + Enterprise Operator Community Operatorservicese...secretse...tls-secrettls-secretCert- managerCert- ma...StatefulSetStatef...Issuer/Cluster IssuerIssuer...ZooKeeperZooKeeperCertificatesCertif...UserUser2.Create2.Create1.Create1.Create5a.Watch5a.Watch3.Watch3.Watch4.Create4.Create5c.Watch5c.Watch6.Create6.Create7.Watch7.Watchusesuses8.Create8.Create9.Watch9.Watch10.Create10.Create 5b.Watch5b.Watchrefers torefers toText is not SVG - cannot display \ No newline at end of file