Tracking issue for TLS

[sed-i]

Enhancement Proposal

This is a tracking issue for end-to-end TLS in COS Lite.

Spec

TODO: Update

Steps / History

Traefik

• Support HTTPS in loadBalancer servers traefik-k8s-operator#188 @PietroPasotti
• Ingress/scheme traefik-k8s-operator#196 @PietroPasotti
• cert-transfer integration (mutual_tls misnomer) traefik-k8s-operator#204 @PietroPasotti @lucabello
• [IPU] Add HTTPS scheme support to loadBalancer.servers[].url traefik-k8s-operator#219

Loki

• Implement TLS and enable it when a cert is available loki-k8s-operator#284 @Abuelodelanada
• update source_url when server_cert_changed event is emitted loki-k8s-operator#289 @Abuelodelanada
• fix Alertmanager settings to use proper scheme loki-k8s-operator#291 @Abuelodelanada
• Add scheme to loki client loki-k8s-operator#293 @Abuelodelanada
• update endpoint on cert changed loki-k8s-operator#295 @Abuelodelanada

Alertmanager

• TLS part 1: Enable TLS if cert is available alertmanager-k8s-operator#164 @sed-i
• swapped ingress v1 -> v2 alertmanager-k8s-operator#173 @PietroPasotti
• Add scheme to alertmanager client alertmanager-k8s-operator#174 @Abuelodelanada

Prometheus

• Enable TLS if certificate is available prometheus-k8s-operator#496

Prometheus – Alertmanager

• TLS part 2: Enable TLS for Prometheus alerting and self-monitoring alertmanager-k8s-operator#165 @sed-i
• Add scheme to alertmanagers config section prometheus-k8s-operator#495 @sed-i

Prometheus - grafana agent

• TODO: Cert for remote-write

Grafana agent

• Allow COSAgentProvider to scrape public TLS metrics endpoint grafana-agent-k8s-operator#211 @dstathis
• TLS grafana-agent-k8s-operator#228
• implement certificate_transfer requirer grafana-agent-k8s-operator#225

Grafana

• Implement TLS and enable it when a cert is available grafana-k8s-operator#225 @lucabello
• Implement TLS grafana-k8s-operator#226
• Add insecureSkipVerify support for grafana_source grafana-k8s-operator#233
• Add scheme to grafana client grafana-k8s-operator#235
• TODO: GrafanaSourceProvider: source_url should be a callable, to solve code ordering issue. We already have a public .update_source() method, so hopefully that will suffice.

Catalogue

• Add TLS support to Catalogue catalogue-k8s-operator#27 @Abuelodelanada

For the whole stack

• Remove insecureSkipVerify
• Integration tests for TLS #78

To do later

• Future TLS work: Encrypt traffic of the gossip ring. alertmanager-k8s-operator#166
• Replicating for
  • Mimir Worker
  • Mimir Coordinator
  • Tempo
  • Karma

Won't do

• COS Config
• COS Proxy

Unresolved Questions

• With ingress per app, is it correct for all units of the same app have the same web_external_url in their certificate's SANs? I.e. would a CA complain if asked to generate two different certs for the same DNS? (The SANs of a unit's cert is made up of the unit's FQDN and the app's external url)
• Should we also allow provisioning certificates with IPs as part of the SAN?