Provide for signed certificates about vcenter-event-broker-appliance

[pksrc]

Updating the Certificate on VEBA

 
The default certificate for OpenFaaS (/ui) or the EventBridge (/stats) and the other web endpoints running on VEBA are self signed. This might cause browsers to show the certificate as untrusted and would require you to specify the --no-tls-verify flag when working with faas-cli. We understand that this may be an inconvenience or unacceptable to some of our customers.
 
In order to update the certificates with a certificate from a trusted authority, please follow the steps outlined below
 
Assumptions

• Access to the VEBA
• Certificates from a trusted authority
  • The public/private key pair must exist before hand. The public key certificate must be .PEM encoded and match the given private key.

Steps

• Run the below commands to update the certificate on VEBA

cd /folder/certs/location
CERT_NAME=eventrouter-tls 
KEY_FILE=vebaof.pem
CERT_FILE=vebaof.cer

#recreate the tls secret
kubectl --kubeconfig /root/.kube/config -n vmware delete secret ${CERT_NAME}
kubectl --kubeconfig /root/.kube/config -n vmware create secret tls ${CERT_NAME} --key ${KEY_FILE} --cert ${CERT_FILE}

#reapply the config to take the new certificate
kubectl --kubeconfig /root/.kube/config apply -f /root/ingressroute-gateway.yaml

This video shows the steps being run on a lab environment and successfully update the certs for VEBA setup with OpenFaaS - https://youtu.be/7oMCvxvL2ns

[lamw]

Thanks for the feedback. Regarding custom certificates, this certainly make sense, especially from a security point of view and not having to disable TLS checking when deploying functions.

Having said that, given this is currently a Fling and we have a finite amount of resources and have to prioritize where we spend our time to ensure we get feedback on the overall solution. Is not having the ability to deploy your own custom certificates a blocker from trying out VEBA or is this more of an ask for Production deployment? We can certainly investigate into #1 to see if its possible to update the certificates post-deployment (@embano1 to comment) but wanted to understand if this is completely blocking you from trying out VEBA (which we recommend doing so in a development environment)

[meyeaard]

Thank you, William, This is not really a blocker and I am playing with VEBA in my lab currently. This would be twofold a convenience factor to negate the --tls-no-validate and if we were to productionize this at some point we would want to run with trusted certs. Thank you for all of the work, this is an interesting and novel toolset. Aaron

…

________________________________ From: William Lam [[email protected]] Sent: Wednesday, March 11, 2020 8:36 AM To: vmware-samples/vcenter-event-broker-appliance Cc: Aaron Meyer; Author Subject: Re: [vmware-samples/vcenter-event-broker-appliance] Provide for signed certificates (#77) Thanks for the feedback. Regarding custom certificates, this certainly make sense, especially from a security point of view and not having to disable TLS checking when deploying functions. Having said that, given this is currently a Fling and we have a finite amount of resources and have to prioritize where we spend our time to ensure we get feedback on the overall solution. Is not having the ability to deploy your own custom certificates a blocker from trying out VEBA or is this more of an ask for Production deployment? We can certainly investigate into #1<#1> to see if its possible to update the certificates post-deployment but wanted to understand if this is completely blocking you from trying out VEBA (which we recommend doing so in a development environment) — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#77 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ABFBUNB2ALHDIKRPLC6LX43RG6HU3ANCNFSM4LFVH4OA>.

-- This email was Virus checked by UTM 9.

[lamw]

Awesome Aaron, let us know how testing goes in your lab! I'd also like to mention we've got a temp Product Manager for VEBA, if you'd like to have a more in-depth conversation on the things you'd like to see (if) VEBA gets productized, we'd certainly welcome the feedback as well as anything else you see from the current Fling to make it more usable. Just let me know and we can connect offline

[pksrc]

Aaron, I'm the PM for VEBA and I'd happy to discuss VEBA, documentation needs and functions that you are looking to take advantage of or develop yourself. Let me know and i'm happy to jump on a call.

[pksrc]

This has been addressed with the documentaton on - https://vmweventbroker.io/kb/advanced-certificates. @meyeaard let us know if we are good to close this issue.

[meyeaard]

Perfect, please close the issue, thank you for your attention to this! From: PK <[email protected]> Sent: Wednesday, May 20, 2020 5:40 PM To: vmware-samples/vcenter-event-broker-appliance <[email protected]> Cc: Aaron Meyer <[email protected]>; Mention <[email protected]> Subject: Re: [vmware-samples/vcenter-event-broker-appliance] Provide for signed certificates (#77) This has been addressed with the documentaton on - https://vmweventbroker.io/kb/advanced-certificates. @meyeaard<https://github.com/meyeaard> let us know if we are good to close this issue. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#77 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ABFBUNFQYIAWSTPL3MUXKXLRSRL37ANCNFSM4LFVH4OA>.

…

-- This email was Virus checked by UTM 9.