greymatter.io Documentation | Enable mTLS for Mesh

Greymatter Version

v1.8.0

Enable Mesh-wide mTLS

Using the greymatter operator with GitOps makes it simple to enable TLS on an edge gateway and internal sidecars. In this scenario, the edge gateway handles TLS termination while all internal communication within the mesh between sidecars is mutual TLS (mTLS). In other words, all sidecar to sidecar connections are required to authenticate via TLS in both directions.

Configuration

Edge Encryption	Internal Encryption	defaults.edge.enable_tls	defaults.edge.require_client_certs	defaults.core_internal_tls_certs.enable	defaults.core_internal_tls_certs.require_client_certs	configs.spire
Plain Text	Plain Text	false	false	false	false	false
Plain Text	Spire	false	false	false	false	true
TLS	Plain Text	true	false	false	false	false
TLS	TLS	true	false	true	false	false
TLS	mTLS	true	false	true	true	false
TLS	Spire	true	false	false	false	true
mTLS	Plain Text	true	true	false	false	false
mTLS	TLS	true	true	true	false	false
mTLS	mTLS	true	true	true	true	false
mTLS	Spire	true	true	false	false	true

For TLS/mTLS you must create gm-edge-ingress-cert (see below) For Spire Internal Encryption you must have Spire deployed

Create TLS Certificates

Your enterprise operations team may issue certificates at your request but if you’d like to generate your own self-signed certificates, follow these certbot instructions.

Apply TLS Certificates to Your Mesh

Using your terminal, navigate to the directory the certificates are located in and create a Kubernetes secret referencing the certificates you created in the previous step.

kubectl create secret generic gm-edge-ingress-certs \
    --from-file=ca.crt=./ca.crt \
    --from-file=server.crt=./server.crt \
    --from-file=server.key=./server.key \
    -n greymatter

In your editor, open inputs.cue in <your-org>/greymatter-core repository. Search for enable_tls and change the value from false to true.

enable_tls: true

Once you have finished and save, commit/push your changes to <your-org>/greymatter-core repository. Your pods will be restarted by the operator once this change is detected. Because the system is eventually consistent the change may not happen immediately but it will be fast.

Retrieve your external IP from the edge LoadBalancer service with the following command:

kubectl get service -n greymatter

You should see an output like:

NAME   TYPE           CLUSTER-IP   EXTERNAL-IP     PORT(S)           AGE
edge   LoadBalancer   x.x.x.x      x.x.x.x         10808:32021/TCP   48m

Once retrieved, navigate to https://{EXTERNAL_IP}:10808 and the greymatter.io dashboard will load through the edge gateway over TLS.

Using different certificates for internal mTLS (Optional)

By default the GitOps Core repo will re-use the Kubernetes secret defined above, containing your edge certificates, for internal mTLS; however, different certificates for internal traffic can be accommodated.

kubectl create secret generic gm-internal-certs \
    --from-file=ca.crt=./ca.crt \
    --from-file=server.crt=./server.crt \
    --from-file=server.key=./server.key \
    -n greymatter

In your editor, open inputs.cue in <your-org>/greymatter-core repository. Search for: core_internal_tls_certs and edit the cert_secret name gm-internal-certs. Once you have completed your changes, save and push your changes to <your-org>/greymatter-core repository.

Your pods will be restarted by the operator once this change is detected. Because the system is eventually consistent the change may not happen immediately but it will be fast.