You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -4,120 +4,154 @@ TLS can be configured via the `tls.secretName` and `tls.clientAuth` parameters o
4
4
5
5
When TLS is enabled for the external inferencing interface, all of the ModelMesh Serving internal (intra-Pod) communication will be secured using the same certificates. The internal links will use mutual TLS regardless of whether client authentication is required for the external connections.
6
6
7
-
There are various ways to generate TLS certificates, below are steps on how to do this using OpenSSL or CertManager.
7
+
There are various ways to generate TLS certificates. Below are steps on how to do this using OpenSSL or CertManager.
8
8
9
9
## Generating TLS Certificates for Dev/Test using OpenSSL
10
10
11
-
To create a SAN key/cert for TLS, use command:
11
+
First, define the variables that will be used in the commands below. Change the values to suit your environment:
With the generated key/cert, create a kube secret with contents like:
40
+
From there, you can create a secret using the generated certificate and key:
27
41
28
-
```yaml
42
+
```shell
43
+
kubectl apply -f - <<EOF
44
+
---
29
45
apiVersion: v1
30
46
kind: Secret
31
47
metadata:
48
+
namespace: ${NAMESPACE}
32
49
name: ${SECRET_NAME}
33
50
type: kubernetes.io/tls
34
51
stringData:
35
-
tls.crt: <contents-of-example.crt>
36
-
tls.key: <contents-of-example.key>
37
-
ca.crt: <contents-of-example.crt>
52
+
tls.crt: $(cat server.crt)
53
+
tls.key: $(cat server.key)
54
+
ca.crt: $(cat server.crt)
55
+
EOF
38
56
```
39
57
40
-
For basic TLS, only the fields `tls.crt` and `tls.key` are needed in the kube secret. For mutual TLS, add `ca.crt` in the kube secret and set the configuration `tls.clientAuth` to `require` in the ConfigMap `model-serving-config`.
41
-
42
-
## Creating TLS Certificates using CertManager
58
+
**Note:** For basic TLS, only the fields `tls.crt` and `tls.key` are required. For mutual TLS, `ca.crt` should be included and `tls.clientAuth` should be set to `require` in the [`model-serving-config` ConfigMap](./README.md).
43
59
44
-
1. If necessary, install `cert-manager` in the cluster - follow the steps here: https://cert-manager.io/docs/installation/.
60
+
Alternatively, you can create this secret imperatively using:
45
61
46
-
2. Create an `Issuer` CR
47
-
48
-
kubectl apply -f - <<EOF
49
-
apiVersion: cert-manager.io/v1
50
-
kind: Issuer
51
-
metadata:
52
-
name: modelmesh-serving-selfsigned-issuer
53
-
spec:
54
-
selfSigned: {}
55
-
EOF
56
-
57
-
3. Create a `Certificate` CR
58
-
59
-
kubectl apply -f - <<EOF
60
-
apiVersion: cert-manager.io/v1
61
-
kind: Certificate
62
-
metadata:
63
-
name: modelmesh-serving-cert
64
-
spec:
65
-
secretName: ${SECRET_NAME}
66
-
duration: 2160h0m0s # 90d
67
-
renewBefore: 360h0m0s # 15d
68
-
commonName: modelmesh-serving
69
-
isCA: true
70
-
privateKey:
71
-
size: 4096
72
-
algorithm: RSA
73
-
encoding: PKCS8
74
-
dnsNames:
75
-
- ${HOSTNAME}
76
-
- modelmesh-serving.${NAMESPACE}
77
-
- modelmesh-serving
78
-
issuerRef:
79
-
name: modelmesh-serving-selfsigned-issuer
80
-
kind: Issuer
81
-
EOF
82
-
83
-
Where `${NAMESPACE}` is the namespace where the ModelMesh Serving Service resides, and `modelmesh-serving` is the name of that service (configured via the `inferenceServiceName` global ConfigMap parameter).
84
-
85
-
Replace `modelmesh-serving-selfsigned-issuer` by the name of the issuer that you're using if needed (see previous step).
`${HOSTNAME}`is optional but should be set as follows when configuring an external Kubernetes Ingress or OpenShift route as described [here](./README.md#exposing-an-external-endpoint-using-an-openshift-route):
66
+
## Creating TLS Certificates using CertManager
88
67
89
-
HOSTNAME=`oc get route modelmesh-serving -o jsonpath='{.spec.host}'`
68
+
First, define the variables that will be used in the commands below and change the values as needed.
90
69
91
-
If the certificate request is successful, a TLS secret with the PEM-encoded certs will be created as `${SECRET_NAME}`.
70
+
```shell
71
+
NAMESPACE="modelmesh-serving"# the controller namespace where ModelMesh Serving was deployed
72
+
SECRET_NAME="modelmesh-certificate"
73
+
HOSTNAME=localhost
74
+
```
92
75
93
-
4. Wait for the certificate to be successfully issued
76
+
1.[Install `cert-manager`](https://cert-manager.io/docs/installation/) in the cluster.
77
+
78
+
2. Create an `Issuer` CR, modifying its name if needed:
79
+
80
+
```shell
81
+
kubectl apply -f - <<EOF
82
+
---
83
+
apiVersion: cert-manager.io/v1
84
+
kind: Issuer
85
+
metadata:
86
+
name: modelmesh-serving-selfsigned-issuer
87
+
spec:
88
+
selfSigned: {}
89
+
EOF
90
+
```
91
+
92
+
3. Create a `Certificate` CR:
93
+
94
+
```shell
95
+
kubectl apply -f - <<EOF
96
+
---
97
+
apiVersion: cert-manager.io/v1
98
+
kind: Certificate
99
+
metadata:
100
+
name: modelmesh-serving-cert
101
+
spec:
102
+
secretName: ${SECRET_NAME}
103
+
duration: 2160h0m0s # 90d
104
+
renewBefore: 360h0m0s # 15d
105
+
commonName: modelmesh-serving
106
+
isCA: true
107
+
privateKey:
108
+
size: 4096
109
+
algorithm: RSA
110
+
encoding: PKCS8
111
+
dnsNames:
112
+
- ${HOSTNAME}
113
+
- modelmesh-serving.${NAMESPACE}
114
+
- modelmesh-serving
115
+
issuerRef:
116
+
name: modelmesh-serving-selfsigned-issuer
117
+
kind: Issuer
118
+
EOF
119
+
```
94
120
95
-
kubectl get certificate/${SECRET_NAME} --watch
121
+
**Note:**`${HOSTNAME}` is optional but should be set when configuring an external Kubernetes Ingress or OpenShift route as described [here](./README.md#exposing-an-external-endpoint-using-an-openshift-route).
96
122
97
-
Once you see `Ready` as `True`, proceed to the next step.
123
+
If the certificate request is successful, a TLS secret with the PEM-encoded certs will be created as `modelmesh-serving-cert`, assuming `metadata.name` wasn't modified.
98
124
99
-
NAME READY SECRET AGE
100
-
modelmesh-serving-cert True ${SECRET_NAME} 21h
125
+
4. Wait for the certificate to be successfully issued:
101
126
102
-
5. Enable TLS in ModelMesh Serving
127
+
```shell
128
+
kubectl get certificate/modelmesh-serving-cert --watch
129
+
```
103
130
104
-
As explained before, TLS is enabled through adding a value for `tls.secretName` in the user's ConfigMap that points to an existing kube secret with TLS key/cert details.
131
+
Once you see `READY` as `True`, proceed to the next step.
105
132
106
-
So in this case, it would be `${SECRET_NAME}`, which gets created once the `certificate` is `ready`.
5. Enable TLS in ModelMesh Serving by adding a value for `tls.secretName` in the ConfigMap, pointing to the secret created with the TLS key/cert details.
109
139
110
-
kubectl create -f - <<EOF
111
-
apiVersion: v1
112
-
kind: ConfigMap
113
-
metadata:
114
-
name: model-serving-config
115
-
data:
116
-
config.yaml: |
117
-
tls:
118
-
secretName: ${SECRET_NAME}
119
-
EOF
140
+
```shell
141
+
kubectl create -f - <<EOF
142
+
apiVersion: v1
143
+
kind: ConfigMap
144
+
metadata:
145
+
name: model-serving-config
146
+
data:
147
+
config.yaml: |
148
+
tls:
149
+
secretName: ${SECRET_NAME}
150
+
EOF
151
+
```
120
152
121
-
6. Retrieve the `ca.crt` (to be used in clients)
153
+
6. Retrieve the `ca.crt` (to be used in clients):
122
154
123
-
kubectl get secret ${SECRET_NAME} -o jsonpath="{.data.ca\.crt}" > ca.crt
155
+
```shell
156
+
kubectl get secret ${SECRET_NAME} -o jsonpath="{.data.ca\.crt}" > ca.crt
0 commit comments