Manage Ingress Certificates

Important

Ingress certificate management does not apply to the ARTESCA+ Veeam Unified Software Appliance.

Prerequisites

Introduction

ARTESCA workload services (as opposed to administrative services, exposed on the control plane network, or internal services, which are not exposed) are exposed to the outside with TLS enabled by default.

These services hostnames are described in this paragraph. Their access is defined in Ingress resources (Kubernetes objects), which also control the certificates used for TLS encryption.

The following certificates are created by default with ARTESCA installations:

Namespace

Name

Corresponding Ingress(es)

Purpose

artesca-auth

sso-crt-secret

artesca-auth/keycloak-public

ARTESCA Identity Provider

zenko

zenko-crt-secret

  • zenko/artesca-data-connector-vault

  • zenko/artesca-data-connector-vault-sts

  • zenko/artesca-data-management-orbit-api

  • zenko/artesca-data-management-ui

All ARTESCA Data Services except s3 and utilization endpoints

zenko

s3-[subdomain]-crt-secret

zenko/artesca-data-connector-cloudserver

ARTESCA Data Services s3 endpoints

zenko

utilization-[subdomain]-crt-secret

zenko/artesca-data-ops-scuba-external-api

Scality Utilization Reporting API

By default, all certificates are generated using the ARTESCA built-in Certificate Authority and are valid for 3 months. After that time period, the certificates are automatically renewed.

Important

To avoid a service interruption every time a certificate is being renewed, you must either trust the ARTESCA built-in Certificate Authority (which is valid for 10 years), or replace certificates using a custom or external Certificate Authority.

When creating a new S3 endpoint, it requires HTTPS access. HTTP requests will be redirected using a 308 Permanent Redirect response. By default the new S3 endpoint is configured with a certificate using the ARTESCA built-in Certificate Authority. To enable HTTP access, refer to Enable S3 Endpoint Access Through HTTP.

If you want to replace certificates configured by default for S3 endpoints, select one of the methods presented below and proceed as explained in the related procedures.

Method Selection

Follow one of the below methods to add (or replace) certificates for the above endpoints.

Method

Pros

Cons

(Default) Use the built-in Certificate Authority

  • Automatic renewal of the self-signed CA and server certificates

  • Automatic creation of new certificates when needed

  • Less operations required

  • Not trusted by clients

  • Not usable for public-facing services

Import externally signed certificates

  • Verifiable trust chain

  • Applicable for public-facing services

  • No signing permissions given to ARTESCA

  • No automatic renewal or creation

  • Requires external operations and monitoring

Import a custom Certificate Authority

  • Verifiable trust chain

  • Applicable for public-facing services

  • Automatic renewal of the server certificates

  • Automatic creation of new certificates when needed

  • Delegates signing permissions to ARTESCA

  • No automatic renewal of the CA certificate

Ingress Certificate Management

These procedures allow you to manage certificates used by the ARTESCA services.