Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add mtls server #12736

wants to merge 10 commits into
base: master


None yet
4 participants
Copy link

drGrove commented Apr 2, 2019

What this PR does / why we need it:

Adds mtls, a PGP web of trust based mutual TLS solution that integrates with nginx-ingress to add client certificate authentication.


[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

  • DCO signed
  • Variables are documented in the

drGrove added some commits Mar 25, 2019

Initial configuration
Signed-off-by: Danny Grove <>
Add persistence of sqlite3 db, add secrets, update deployment
Signed-off-by: Danny Grove <>
Add support for generating CA certificates, Fix PVC and mounts
Signed-off-by: Danny Grove <>
Break out seeds into it's own configmap, update secret to match needs…
… for client cert auth in nginx ingress

Signed-off-by: Danny Grove <>
Move to stable as we don't use alpha features
Signed-off-by: Danny Grove <>
Add configuration table, bump to v0.11.0
Signed-off-by: Danny Grove <>
Update docs, fix configmaps, bump to drgrove/mtls-server:v0.12.0
* Add information around integrating with nginx-ingress client auth
* Format the configuration table
* Break out config maps for User and Admin seeding
* Run container as 1000
* Mount folder as 1000
* Add a 2 day default max_lifetime
* Bump container tag and appVersion to v0.12.0

Signed-off-by: Danny Grove <>
Update notes, break out configmap and secrets, consolidate PVC
* Update notes to show warnings when persistence is missing
* Update notes to show ingress annotations
* Add helpers for converting map to ini mapping
* Use a single PVC with subPaths for secrets
* Only mount ca-creds if they exist
* Align values.yaml

Signed-off-by: Danny Grove <>

This comment has been minimized.

Copy link

k8s-ci-robot commented Apr 2, 2019


This pull-request has been approved by: drGrove
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: scottrigby

If they are not already assigned, you can assign the PR to them by writing /assign @scottrigby in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment


This comment has been minimized.

Copy link

k8s-ci-robot commented Apr 2, 2019

Hi @drGrove. Thanks for your PR.

I'm waiting for a helm member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Update maintainer to be github username
Signed-off-by: Danny Grove <>

This comment has been minimized.

Copy link

drGrove commented Apr 2, 2019

/assign @scottrigby

Add support for intermediate CA creation, Move to file based Cert inc…

* Bump chart version to 0.2.0
* Make intermediate key readonly after creation
* Separete ca/intermediate ssl configs, align notes with new upsdate, fix scripts
* intermediate CA and CA should have slightly different policies so
separate them
* Ignore yaml files in root of directory that are not values.yaml
* Update notes for new file based setup
* Fix ca/intermediate cert creation scripts
* Move to files for Cert Secrets
* Add secret-cert-password secret. Add env to values.yaml and deployment
* Update readme to match values, add intermediate domain for pulling correct files. Add docs for adding key for sec
* Ignore values that are not values.yaml in the root folder of the mtls

Signed-off-by: Danny Grove <>

@drGrove drGrove force-pushed the drGrove:master branch from cfbd20f to 05002ea Apr 10, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.