Skip to content

Commit 2578d40

Browse files
dveedendveeden
authored
enable-tls-between-components: add TiProxy for cert-manager (#2929)
1 parent 7604a33 commit 2578d40

File tree

2 files changed

+124
-0
lines changed

2 files changed

+124
-0
lines changed

‎en/enable-tls-between-components.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1167,6 +1167,68 @@ This section describes how to issue certificates using two methods: `cfssl` and
11671167
11681168
After the object is created, `cert-manager` generates a `${cluster_name}-ticdc-cluster-secret` Secret object to be used by the TiCDC component of the TiDB server.
11691169
1170+
- TiProxy
1171+
1172+
```yaml
1173+
apiVersion: cert-manager.io/v1
1174+
kind: Certificate
1175+
metadata:
1176+
name: ${cluster_name}-tiproxy-cluster-secret
1177+
namespace: ${namespace}
1178+
spec:
1179+
secretName: ${cluster_name}-tiproxy-cluster-secret
1180+
duration: 8760h # 365d
1181+
renewBefore: 360h # 15d
1182+
subject:
1183+
organizations:
1184+
- PingCAP
1185+
commonName: "TiDB"
1186+
usages:
1187+
- server auth
1188+
- client auth
1189+
dnsNames:
1190+
- "${cluster_name}-tiproxy"
1191+
- "${cluster_name}-tiproxy.${namespace}"
1192+
- "${cluster_name}-tiproxy.${namespace}.svc"
1193+
- "${cluster_name}-tiproxy-peer"
1194+
- "${cluster_name}-tiproxy-peer.${namespace}"
1195+
- "${cluster_name}-tiproxy-peer.${namespace}.svc"
1196+
- "*.${cluster_name}-tiproxy-peer"
1197+
- "*.${cluster_name}-tiproxy-peer.${namespace}"
1198+
- "*.${cluster_name}-tiproxy-peer.${namespace}.svc"
1199+
ipAddresses:
1200+
- 127.0.0.1
1201+
- ::1
1202+
issuerRef:
1203+
name: ${cluster_name}-tidb-issuer
1204+
kind: Issuer
1205+
group: cert-manager.io
1206+
```
1207+
1208+
`${cluster_name}` is the name of the cluster. Configure the items as follows:
1209+
1210+
- Set `spec.secretName` to `${cluster_name}-tiproxy-cluster-secret`.
1211+
- Add `server auth` and `client auth` in `usages`.
1212+
- Add the following DNSs in `dnsNames`. You can also add other DNSs according to your needs:
1213+
1214+
- `${cluster_name}-tiproxy`
1215+
- `${cluster_name}-tiproxy.${namespace}`
1216+
- `${cluster_name}-tiproxy.${namespace}.svc`
1217+
- `${cluster_name}-tiproxy-peer`
1218+
- `${cluster_name}-tiproxy-peer.${namespace}`
1219+
- `${cluster_name}-tiproxy-peer.${namespace}.svc`
1220+
- `*.${cluster_name}-tiproxy-peer`
1221+
- `*.${cluster_name}-tiproxy-peer.${namespace}`
1222+
- `*.${cluster_name}-tiproxy-peer.${namespace}.svc`
1223+
1224+
- Add the following 2 IPs in `ipAddresses`. You can also add other IPs according to your needs:
1225+
- `127.0.0.1`
1226+
- `::1`
1227+
- Add the Issuer created above in `issuerRef`.
1228+
- For other attributes, refer to [cert-manager API](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
1229+
1230+
After the object is created, `cert-manager` generates a `${cluster_name}-tiproxy-cluster-secret` Secret object to be used by the TiProxy component of the TiDB server.
1231+
11701232
- TiFlash
11711233
11721234
```yaml

‎zh/enable-tls-between-components.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1158,6 +1158,68 @@ aliases: ['/docs-cn/tidb-in-kubernetes/dev/enable-tls-between-components/']
11581158
11591159
创建这个对象以后，`cert-manager` 会生成一个名字为 `${cluster_name}-ticdc-cluster-secret` 的 Secret 对象供 TiDB 集群的 TiCDC 组件使用。
11601160
1161+
- TiProxy 组件的 Server 端证书。
1162+
1163+
```yaml
1164+
apiVersion: cert-manager.io/v1
1165+
kind: Certificate
1166+
metadata:
1167+
name: ${cluster_name}-tiproxy-cluster-secret
1168+
namespace: ${namespace}
1169+
spec:
1170+
secretName: ${cluster_name}-tiproxy-cluster-secret
1171+
duration: 8760h # 365d
1172+
renewBefore: 360h # 15d
1173+
subject:
1174+
organizations:
1175+
- PingCAP
1176+
commonName: "TiDB"
1177+
usages:
1178+
- server auth
1179+
- client auth
1180+
dnsNames:
1181+
- "${cluster_name}-tiproxy"
1182+
- "${cluster_name}-tiproxy.${namespace}"
1183+
- "${cluster_name}-tiproxy.${namespace}.svc"
1184+
- "${cluster_name}-tiproxy-peer"
1185+
- "${cluster_name}-tiproxy-peer.${namespace}"
1186+
- "${cluster_name}-tiproxy-peer.${namespace}.svc"
1187+
- "*.${cluster_name}-tiproxy-peer"
1188+
- "*.${cluster_name}-tiproxy-peer.${namespace}"
1189+
- "*.${cluster_name}-tiproxy-peer.${namespace}.svc"
1190+
ipAddresses:
1191+
- 127.0.0.1
1192+
- ::1
1193+
issuerRef:
1194+
name: ${cluster_name}-tidb-issuer
1195+
kind: Issuer
1196+
group: cert-manager.io
1197+
```
1198+
1199+
其中 `${cluster_name}` 为集群的名字：
1200+
1201+
- `spec.secretName` 请设置为 `${cluster_name}-tiproxy-cluster-secret`；
1202+
- `usages` 请添加上 `server auth` 和 `client auth`；
1203+
- `dnsNames` 需要填写这些 DNS，根据需要可以填写其他 DNS：
1204+
1205+
- `${cluster_name}-tiproxy`
1206+
- `${cluster_name}-tiproxy.${namespace}`
1207+
- `${cluster_name}-tiproxy.${namespace}.svc`
1208+
- `${cluster_name}-tiproxy-peer`
1209+
- `${cluster_name}-tiproxy-peer.${namespace}`
1210+
- `${cluster_name}-tiproxy-peer.${namespace}.svc`
1211+
- `*.${cluster_name}-tiproxy-peer`
1212+
- `*.${cluster_name}-tiproxy-peer.${namespace}`
1213+
- `*.${cluster_name}-tiproxy-peer.${namespace}.svc`
1214+
1215+
- `ipAddresses` 需要填写这两个 IP，根据需要可以填写其他 IP：
1216+
- `127.0.0.1`
1217+
- `::1`
1218+
- `issuerRef` 请填写上面创建的 Issuer；
1219+
- 其他属性请参考 [cert-manager API](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec)。
1220+
1221+
创建这个对象以后，`cert-manager` 会生成一个名字为 `${cluster_name}-tiproxy-cluster-secret` 的 Secret 对象供 TiDB 集群的 TiProxy 组件使用。
1222+
11611223
- TiFlash 组件的 Server 端证书。
11621224
11631225
```yaml

0 commit comments

Comments
 (0)