如何在 K8ssandra 中为 Cassandra 配置加密 TLS/SSL？

Question

我是 kubernetes/helm 的新手。 我正在尝试在 K8ssandra 中为 Cassandra 配置加密 TLS/SSL？ 我看过这个例子，但无法进一步了解。 点击here！

我按照本教程中的描述执行以下步骤 点击here！

helm repo add k8ssandra https://helm.k8ssandra.io/stable
helm repo update

cd ~/github
git clone https://github.com/k8ssandra/k8ssandra-operator.git
cd k8ssandra-operator

scripts/setup-kind-multicluster.sh --clusters 1 --kind-worker-nodes 4

helm repo add jetstack https://charts.jetstack.io
helm repo update
kubectl config use-context kind-k8ssandra-0

helm install cert-manager jetstack/cert-manager \
     --namespace cert-manager --create-namespace --set installCRDs=true

helm install k8ssandra-operator k8ssandra/k8ssandra-operator -n k8ssandra-operator --create-namespace

cat <<EOF | kubectl -n k8ssandra-operator apply -f -
apiVersion: k8ssandra.io/v1alpha1
kind: K8ssandraCluster
metadata:
  name: demo
spec:
  cassandra:
    serverVersion: "4.0.1"
    datacenters:
      - metadata:
          name: dc1
        size: 3
        storageConfig:
          cassandraDataVolumeClaimSpec:
            storageClassName: standard
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: 5Gi
        config:
          jvmOptions:
            heapSize: 512M
        stargate:
          size: 1
          heapSize: 256M
EOF

CASS_USERNAME=$(kubectl get secret demo-superuser -n k8ssandra-operator -o=jsonpath='{.data.username}' | base64 --decode)
echo $CASS_USERNAME


CASS_PASSWORD=$(kubectl get secret demo-superuser -n k8ssandra-operator -o=jsonpath='{.data.password}' | base64 --decode)
echo $CASS_PASSWORD

kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- nodetool -u $CASS_USERNAME -pw $CASS_PASSWORD status
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e "CREATE KEYSPACE test WITH replication = {'class': 'SimpleStrategy', 'replication_factor': 3};"

kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e "insert into test.users (email, name, state) values ('john@gamil.com', 'John Smith', 'NC');"
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e "insert into test.users (email, name, state) values ('joe@gamil.com', 'Joe Jones', 'VA');"
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e "insert into test.users (email, name, state) values ('sue@help.com', 'Sue Sas', 'CA');"
kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -c cassandra -- cqlsh -u $CASS_USERNAME -p $CASS_PASSWORD -e "insert into test.users (email, name, state) values ('tom@yes.com', 'Tom and Jerry', 'NV');"

文件 truststore.jks 和 keystore.jks 本地存储在 pc 的 ./mnt/keystore/... 和 ./mnt/truststore/... 目录下。 在这里，我创建了密钥 keystoreSecret 和 truststoreSecret。

kubectl create secret generic keystore --from-file=./mnt/keystore/keystore.jks -n k8ssandra-operator  
kubectl create secret generic truststore --from-file=./mnt/truststore/truststore.jks -n k8ssandra-operator  

现在我已经运行了上面的例子。 这是 value.yaml

cassandra:
  version: 4.0.1
  cassandraYamlConfigMap: cassandra-config
  encryption:
    keystoreSecret: keystore
    keystoreMountPath: /mnt/keystore
    truststoreSecret: truststore
    truststoreMountPath: /mnt/truststore
  heap:
    size: 512M
  datacenters:
  - name: dc1
    size: 1

我正在尝试按如下方式运行此示例。

helm upgrade  k8ssandra-operator k8ssandra/k8ssandra-operator -n k8ssandra-operator  -f  value.yaml

现在我正在尝试运行 configmap 文件。 配置文件.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: cassandra-config
data:
  cassandra.yaml: |-
    server_encryption_options:
      internode_encryption: all
      keystore: /mnt/keystore/keystore.jks
      keystore_password: cassandra
      truststore: /mnt/truststore/truststore.jks
      truststore_password: cassandra

kubectl apply -f config-file.yaml -n k8ssandra-operator

我可以毫无问题地切换到 cassandra bash

kubectl exec -it demo-dc1-default-sts-0 -n k8ssandra-operator -- /bin/bash

在 cassandra bash 环境中，我在 /mnt/truststore/truststore.jks 和 /mnt/keystore/keystore.jks 目录下找不到信任库和密钥库文件。

我正在尝试使用 ssl 登录 cassandra，但我不能。

cassandra@demo-dc1-default-sts-0:/$ cqlsh --ssl -u demo-superuser -p JKv59QPynp3s0qGSf1DZ demo-dc1-stargate-service
Validation is enabled; SSL transport factory requires a valid certfile to be specified. Please provide path to the certfile in [ssl] section as 'certfile' option in /home/cassandra/.cassandra/cqlshrc (or use [certfiles] section) or set SSL_CERTFILE environment variable.

Answer 1

你查过this doc了吗？ 它适用于 k8ssandra-operator（被认为是 K8ssandra v2），而您找到的链接适用于 K8ssandra v1（其中一切都是 helm 图表）。

让我知道这是否适合你。