Using the example YAML file in Section 7.2, “Configuring TLS/SSL” (and calling it ssl.yaml), we can complete the SSL configuration by specifying the truststore and keystore files on the helm command line with the --set-file argument:

helm install mydb voltdb/voltdb                                           \
  --values myconfig.yaml                                                  \
  --values ssl.yaml                                                       \
  --set-file cluster.config.deployment.ssl.keystore.file=keystore.pem     \
  --set-file cluster.config.deployment.ssl.truststore.file=truststore.pem

Two important notes concerning TLS/SSL configuration:

An alternative method is to store the key and trust stores in a Kubernetes secret. Secrets are a standard feature of Kubernetes that allow you to store sensitive information as key value pairs in a protected space. Three advantages of using a secret are:

To use a Kubernetes secret to store the TLS/SSL information for your database, you must first create the necessary PEM files as described in the section on "Creating the TLS/SSL Certificates" in the Using VoltDB guide. Next you create your Kubernetes secret using the kubectl create secret command, specifying the key names and corresponding artifacts as arguments. For example:

$ kubectl create secret generic my-ssl-creds     \
    --from-file=keystore_data=keystore.pem       \
    --from-file=truststore_data=truststore.pem

It is critical you use the key names keystore_data and truststore_data (as well as keystore_password and truststore_password if you created a password for the certificate). If not, the Volt Operator will not be able to find them. Also, the secret must be in the same Kubernetes namespace as the Helm release you are configuring.

Once you create the secret you can use it to configure your database by not setting any of standard SSL properties such as the cluster.config.deployment.ssl... properties or cluster.clusterSpec.ssl.certificateFile. Instead, set the property cluster.config.deployment.ssl.sslSecret.certSecretName. Using the secret created in the preceding example, the configuration of your database will look something like this:

cluster:
  config:
    deployment:
      ssl:
        sslSecret:
          certSecretName: my-ssl-creds

Another alternative for maintaining the TLS/SSL information is to use the Kubernetes cert-manager (cert-manager.io). The cert-manager is an add-on for Kubernetes that helps you create and maintain certificates and other private information in Kubernetes. If you wish to use cert-manager for self-signed certificates, you not only use it to store the certificate and truststore, you create them with cert-manager as well. (For more detailed information concerning cert-manager, see the cert-manager documentation.)

The basic steps for storing self-signed TLS/SSL credentials in cert-manager are:

You create the cert-manager issuer and the certificate request using YAML properties. The easiest way to do this is by typing the property declarations into a YAML file. For example, the following two YAML files create a cert-manager issuer service and request a certificate.

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
   name: selfsigned-issuer
   namespace: mydb
spec:
   selfSigned: {}

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-ssl-certificate
  namespace: mydb
spec:
  commonName: voltdb.com
  duration: 8766h
  secretName: my-ssl-creds
  issuerRef:
    name: selfsigned-issuer
    kind: Issuer
  privateKey:
    algorithm: RSA
    encoding: PKCS8
    size: 2048
  usages:
    - server auth

Three key points to note about the certificate request are:

Once you create the YAML files, you can create the issuer and request the certificate:

$ kubectl apply -f create-issuer.yaml    # Do only once
$ kubectl apply -f request-cert.yaml 

Finally, in your database configuration, you point to the secret created by the certificate request (in this case, my-ssl-creds) the same way you would for a manually created secret:

cluster:
  config:
    deployment:
      ssl:
        sslSecret:
          certSecretName: my-ssl-creds

A certificate revocation list (CRL) lets you deny access to the server from certain clients based on their certificates, when using mutual TLS (mTLS). For example, say you had separate client certificates for each vendor with access to your database. If the partnership with a vendor ends, you want to now deny access to the vendor's clients by adding their certificate to the list of CRLs. Note that the CRL files must be in PEM format. See the section on Using CRLs in the Using VoltDB guide for instructions on converting files in other formats to PEM using the openssl utility.

In Kubernetes, you add CRLs to the server in one of two ways:

By default, when you enable TLS/SSL, the Volt Operator and the Volt Management Console (VMC) automatically use the truststore configured for the servers as their truststore for authenticating the server. In other words, you do not have to set any SSL configuration properties yourself for these two services. VMC will also use the server keystore to define its own certificate for encrypting user access to its HTTP port. This way clients and interactive users can use the same truststore to access both the servers' client ports and the VMC web console.

Of course, you can choose to explicitly identify a separate truststore for these other services and provide the associated files yourself, if you wish. But by default, configuring SSL for the server automatically configures the Operator and VMC correctly to respond to the encrypted messages.

The same is true if you enable mutual TLS (mTLS) for the cluster. In this case, the Operator and VMC use the same certificate (and truststore) as the servers by default. If you want to have these services use a distinct client certificate, you need to specify that certificate using the appropriate YAML properties for those services. For example, the following Helm command loads a separate certificate for the Volt Operator and uses the root truststore for both the server and Operator:

helm install mydb voltdb/voltdb                                                \
  --values myconfig.yaml                                                       \
  --values ssl.yaml                                                            \
  --set-file cluster.config.deployment.ssl.keystore.file=server.keystore.pem   \
  --set-file cluster.config.deployment.ssl.truststore.file=root.truststore.pem \
  --set-file cluster.clusterSpec.ssl.clientCertFile=client.keystore.pem