Ask or search…
K
Links
Comment on page

TLS - Securing Memphis Client with TLS

In order to ensure the secure deployment of Memphis on a Kubernetes cluster, you can use Transport Layer Security (TLS) certificates for encrypting communication.
The self-signed certificates generated in this section are intended for testing and development. In production environments, it is strongly recommended to use certificates issued by a trusted Certificate Authority (CA) for enhanced security.

Create Self-Signed Certificates for the Memphis Server

  • Generate self-signed certificates for the Memphis server using mkcert. These certificates are essential for securing the Memphis server:
mkcert -client \
-cert-file memphis_client.pem \
-key-file memphis-key_client.pem \
"127.0.0.1" "localhost" "*.memphis.dev" ::1 \
email@localhost
  • To locate the root certificate authority (CA) generated by mkcert, use the following command:
mkcert -CAROOT
  • To create self-signed certificates for client applications use the following command:
mkcert -client \
-cert-file client.pem \
-key-file key-client.pem \
localhost ::1

Securing Memphis Deployment with TLS

  • Create a Kubernetes secret in the "memphis" namespace to store the necessary TLS certificates and keys. Use the following command:
$ kubectl create secret generic tls-client-secret \
--from-file=memphis_client.pem \
--from-file=memphis-key_client.pem \
--from-file=rootCA.pem -n memphis
  • Edit your Helm values.yaml file to include the TLS configuration under the "memphis.tls" section as follows:
tls:
secret:
name: tls-client-secret
ca: "rootCA.pem"
cert: "memphis_client.pem"
key: "memphis-key_client.pem"
  • Now, deploy Memphis using Helm with the following command:
helm install my-memphis memphis \
--create-namespace --namespace memphis --wait
  • Alternatively, you can deploy Memphis using Helm in a single line with all the TLS configurations provided as parameters:
$ helm install my-memphis memphis \
--create-namespace --namespace memphis --wait \
--set \
memphis.tls.cert="memphis_client.pem",\
memphis.tls.key="memphis-key_client.pem",\
memphis.tls.secret.name="tls-client-secret",\
memphis.tls.ca="rootCA.pem"
Note: The global.cluster.enabled configuration, omitted in this command, is intended for situations in which Memphis is deployed within a cluster environment. Ensure that you activate it as necessary when configuring deployments as a cluster.
Last modified 15d ago