We use cookies and other similar technology to collect data to improve your experience on our site, as described in our Privacy Policy.

AppsCode
  • KubeDB

    Run Production-Grade Databases on Kubernetes

    arrow_forward
    Stash

    Backup and Recovery Solution for Kubernetes

    arrow_forward
    KubeVault

    Run Production-Grade Vault on Kubernetes

    arrow_forward
    Voyager

    Secure HAProxy Ingress Controller for Kubernetes

    arrow_forward
    ConfigSyncer

    Kubernetes Configuration Syncer

    arrow_forward
    Guard

    Kubernetes Authentication WebHook Server

    arrow_forward
    KubeDB

    KubeDB simplifies Provision, Upgrade, Scaling, Volume Expansion, Monitor, Backup, Restore for various Databases in Kubernetes on any Public & Private Cloud

    • task_altLower administrative burden
    • task_altNative Kubernetes Support
    • task_altPerformance
    • task_altAvailability and durability
    • task_altManageability
    • task_altCost-effectiveness
    • task_altSecurity
    Stash

    A complete Kubernetes native disaster recovery solution for backup and restore your volumes and databases in Kubernetes on any public and private clouds.

    • task_altDeclarative API
    • task_altBackup Kubernetes Volumes
    • task_altBackup Database
    • task_altMultiple Storage Support
    • task_altDeduplication
    • task_altData Encryption
    • task_altVolume Snapshot
    • task_altPolicy Based Backup
    KubeVault

    KubeVault is a Git-Ops ready, production-grade solution for deploying and configuring Hashicorp's Vault on Kubernetes.

    • task_altVault Kubernetes Deployment
    • task_altAuto Initialization & Unsealing
    • task_altVault Backup & Restore
    • task_altConsume KubeVault Secrets with CSI
    • task_altManage DB Users Privileges
    • task_altStorage Backend
    • task_altAuthentication Method
    • task_altDatabase Secret Engine
    Voyager

    Secure HAProxy Ingress Controller for Kubernetes

    • task_altHTTP & TCP
    • task_altSSL
    • task_altPlatform support
    • task_altHAProxy
    • task_altPrometheus
    • task_altLet's Encrypt
    configsyncer

    Kubernetes Configuration Syncer

    • task_altConfiguration Syncer
    Guard

    Kubernetes Authentication WebHook Server

    • task_altIdentity Providers
    • task_altCLI
    • task_altRBAC
  • RESOURCES
  • Webinar New
CONTACT SALES
KubeDB KubeDB
github-icon twitterx-icon
TRY NOW FREE
You are looking at the documentation of a prior release. To read the documentation of the latest release, please visit here.

New to KubeDB? Please start here.

Postgres TLS/SSL Encryption

Prerequisite : To configure TLS/SSL in Postgres, KubeDB uses cert-manager to issue certificates. So first you have to make sure that the cluster has cert-manager installed. To install cert-manager in your cluster following steps here.

To issue a certificate, the following cr of cert-manager is used:

  • Issuer/ClusterIssuer: Issuers and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details here.

  • Certificate: cert-manager has the concept of Certificates that define the desired x509 certificate which will be renewed and kept up to date. You can learn more details here.

Postgres CRD Specification:

KubeDB uses the following cr fields to enable SSL/TLS encryption in Postgres.

  • spec:
    • sslMode
    • tls:
      • issuerRef
      • certificates

Read about the fields in details from postgres concept,

  • sslMode supported values are [disable, allow, prefer, require, verify-ca, verify-full]
    • disable: It ensures that the server does not use TLS/SSL
    • allow: you don’t care about security, but I will pay the overhead of encryption if the server insists on it.
    • prefer: you don’t care about encryption, but you wish to pay the overhead of encryption if the server supports it.
    • require: you want your data to be encrypted, and you accept the overhead. you want to be sure that you connect to a server that you trust.
    • verify-ca: you want your data to be encrypted, and you accept the overhead. you want to be sure that you connect to a server you trust, and that it’s the one you specify.

When, sslMode is set and the value is not disable then, the users must specify the tls.issuerRef field. KubeDB uses the issuer or clusterIssuer referenced in the tls.issuerRef field, and the certificate specs provided in tls.certificate to generate certificate secrets using Issuer/ClusterIssuers specification. These certificates secrets including ca.crt, tls.crt and tls.key etc. are used to configure Postgres server, exporter etc. respectively.

How TLS/SSL configures in Postgres

The following figure shows how KubeDB enterprise is used to configure TLS/SSL in Postgres. Open the image in a new tab to see the enlarged version.

Postgres with TLS/SSL Flow
Fig: Deploy Postgres with TLS/SSL

Deploying Postgres with TLS/SSL configuration process consists of the following steps:

  1. At first, a user creates an Issuer/ClusterIssuer cr.

  2. Then the user creates a Postgres cr.

  3. KubeDB community operator watches for the Postgres cr.

  4. When it finds one, it creates Secret, Service, etc. for the Postgres database.

  5. KubeDB enterprise operator watches for Postgres(5c), Issuer/ClusterIssuer(5b), Secret and Service(5a).

  6. When it finds all the resources(Postgres, Issuer/ClusterIssuer, Secret, Service), it creates Certificates by using tls.issuerRef and tls.certificates field specification from Postgres cr.

  7. cert-manager watches for certificates.

  8. When it finds one, it creates certificate secrets cert-secrets(server, client, exporter secrets, etc.) that hold the actual self-signed certificate.

  9. KubeDB community operator watches for the Certificate secrets tls-secrets.

  10. When it finds all the tls-secret, it creates a StatefulSet so that Postgres server is configured with TLS/SSL.

In the next doc, we are going to show a step by step guide on how to configure a Postgres database with TLS/SSL.

What's on this Page

Search
Improve This Page