Comment on page
TLS - Securing Memphis Client with TLS
In order to ensure the secure deployment of Memphis on a Kubernetes cluster, you can use Transport Layer Security (TLS) certificates for encrypting communication.
The self-signed certificates generated in this section are intended for testing and development. In production environments, it is strongly recommended to use certificates issued by a trusted Certificate Authority (CA) for enhanced security.
- Generate self-signed certificates for the Memphis server using
mkcert
. These certificates are essential for securing the Memphis server:
mkcert -client \
-cert-file memphis_client.pem \
-key-file memphis-key_client.pem \
"127.0.0.1" "localhost" "*.memphis.dev" ::1 \
email@localhost
- To locate the root certificate authority (CA) generated by
mkcert
, use the following command:
mkcert -CAROOT
- To create self-signed certificates for client applications use the following command:
mkcert -client \
-cert-file client.pem \
-key-file key-client.pem \
localhost ::1
- Create a Kubernetes secret in the "memphis" namespace to store the necessary TLS certificates and keys. Use the following command:
$ kubectl create secret generic tls-client-secret \
--from-file=memphis_client.pem \
--from-file=memphis-key_client.pem \
--from-file=rootCA.pem -n memphis
- Edit your Helm
values.yaml
file to include the TLS configuration under the "memphis.tls" section as follows:
tls:
secret:
name: tls-client-secret
ca: "rootCA.pem"
cert: "memphis_client.pem"
key: "memphis-key_client.pem"
- Now, deploy Memphis using Helm with the following command:
helm install my-memphis memphis \
--create-namespace --namespace memphis --wait
- Alternatively, you can deploy Memphis using Helm in a single line with all the TLS configurations provided as parameters:
$ helm install my-memphis memphis \
--create-namespace --namespace memphis --wait \
--set \
memphis.tls.cert="memphis_client.pem",\
memphis.tls.key="memphis-key_client.pem",\
memphis.tls.secret.name="tls-client-secret",\
memphis.tls.ca="rootCA.pem"
Note: The
global.cluster.enabled
configuration, omitted in this command, is intended for situations in which Memphis is deployed within a cluster environment. Ensure that you activate it as necessary when configuring deployments as a cluster.Last modified 15d ago