How do I use SSL while installing anycable using Helm

[adimania]

I see that env.anycableSslKey and env.anycableSslCert exist but how do I get the certificate and the key inside the pod without modifying the deployment.yml template and adding a volume there?

[Envek]

Hello! Yeah, apparently, this part of Helm chart isn't finished yet.

However, we usually place anycable-go behind Ingress resource and let Ingress controller terminate SSL. Does this approach work for you?

---

If you're using Let's Encrypt (and have cert-manager in your cluster) then place something like this in Helm values:

  fullNameOverride: anycable-go
  ingress:
    enable: true
    path: /cable
    acme:
      hosts:
        - your-app.example.com

And then it will search for certificates in secret named anycable-go-tls-acme:

anycable-helm/anycable-go/templates/acme-ingress.yml

Line 20 in d0948a6

secretName: "{{ template "anycableGo.fullname" $root }}-tls-acme"

---

If you're using your own certificates, specify their contents in values like this:

  ingress:
    enable: true
    path: /cable
    nonAcme:
      hosts:
      - names:
        - your-app.example.com
        secretName: your-app-tls-secret
        tls: # Omit this part if you already have created your-app-tls-secret
          crt: "Optional: Place PEM-encoded certificate chain here"
          key: "Optional: Place PEM-encoded private key here"

---

If you need to avoid Ingress or to terminate SSL in anycable-go itself, please tell us more about your use case

[adimania]

Ingress is helpful but we are required to do an end-to-end TLS. I'll see if I can fix it and give you folks a PR.

[Envek]

What certificates you're planning to use? Let's Encrypt, buy certificates in public CA, or issue in your own private CA?

[Envek]

@adimania I've created PR with a fix. Please take a look at it at #8

[Envek]

@adimania, please tell us more about your desired setup. Do you plan to use Ingress at all? What certificates you plan to use with Ingress (from public or your own private CA), with anycable?

[adimania]

We don't use Ingress. We are using certificates issued by a public CA.
I'll check out the PR. Thanks for implementing this so fast.

[Envek]

Then you should be good with #8 (I have not tested it with encryption between Ingress and anycable-go yet)

[Envek]

Released in v0.4.0 of Helm chart anycable-go