sslSetup returns the definition for an object storage setup using SSL
(namespace string)
| 365 | |
| 366 | // sslSetup returns the definition for an object storage setup using SSL |
| 367 | func sslSetup(namespace string) (Setup, error) { |
| 368 | setup, err := defaultSetup(namespace) |
| 369 | if err != nil { |
| 370 | return Setup{}, err |
| 371 | } |
| 372 | const tlsVolumeName = "secret-volume" |
| 373 | const tlsVolumeMountPath = "/etc/secrets/certs" |
| 374 | // RustFS enables TLS when it finds `rustfs_cert.pem` and `rustfs_key.pem` |
| 375 | // in the directory pointed to by RUSTFS_TLS_PATH |
| 376 | setup.Deployment.Spec.Template.Spec.Containers[0].Env = append( |
| 377 | setup.Deployment.Spec.Template.Spec.Containers[0].Env, |
| 378 | corev1.EnvVar{ |
| 379 | Name: "RUSTFS_TLS_PATH", |
| 380 | Value: tlsVolumeMountPath, |
| 381 | }) |
| 382 | setup.Deployment.Spec.Template.Spec.Containers[0].VolumeMounts = append( |
| 383 | setup.Deployment.Spec.Template.Spec.Containers[0].VolumeMounts, |
| 384 | corev1.VolumeMount{ |
| 385 | Name: tlsVolumeName, |
| 386 | MountPath: tlsVolumeMountPath, |
| 387 | }) |
| 388 | setup.Deployment.Spec.Template.Spec.Volumes = append( |
| 389 | setup.Deployment.Spec.Template.Spec.Volumes, |
| 390 | corev1.Volume{ |
| 391 | Name: tlsVolumeName, |
| 392 | VolumeSource: corev1.VolumeSource{ |
| 393 | Projected: &corev1.ProjectedVolumeSource{ |
| 394 | // DefaultMode is intentionally left at Kubernetes' 0644 |
| 395 | // default: the non-root RustFS server must read the cert |
| 396 | // and key whatever UID it runs as, and the pod sets no |
| 397 | // fsGroup, so a tighter mode would make them unreadable on |
| 398 | // clusters that don't auto-assign one. |
| 399 | Sources: []corev1.VolumeProjection{ |
| 400 | { |
| 401 | Secret: &corev1.SecretProjection{ |
| 402 | LocalObjectReference: corev1.LocalObjectReference{ |
| 403 | Name: "object-store-tls-secret", |
| 404 | }, |
| 405 | Items: []corev1.KeyToPath{ |
| 406 | { |
| 407 | Key: "tls.crt", |
| 408 | Path: "rustfs_cert.pem", |
| 409 | }, |
| 410 | { |
| 411 | Key: "tls.key", |
| 412 | Path: "rustfs_key.pem", |
| 413 | }, |
| 414 | }, |
| 415 | }, |
| 416 | }, |
| 417 | }, |
| 418 | }, |
| 419 | }, |
| 420 | }, |
| 421 | ) |
| 422 | // We also need to set the probes to HTTPS. Kubernetes will not verify |
| 423 | // the certificates, but this way we can connect |
| 424 | setup.Deployment.Spec.Template.Spec.Containers[0].LivenessProbe.HTTPGet.Scheme = corev1.URISchemeHTTPS |
no test coverage detected