Skip to content
This repository was archived by the owner on Jan 19, 2024. It is now read-only.

Commit c4538b6

Browse files
author
Andrew Jefferson
committed
added deployment scenario for cluster internal ssl
1 parent eb71d64 commit c4538b6

File tree

4 files changed

+227
-0
lines changed

4 files changed

+227
-0
lines changed

‎deployment-scenarios/cluster-internal-ssl/cluster-internal-ssl-configmap.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: cluster-internal-ssl-config
6+
data:
7+
NEO4J_unsupported_dbms_ssl_system_ignore__dot__files: "true"
8+
9+
# Cluster ssl policy
10+
NEO4J_dbms_ssl_policy_cluster_enabled: "true"
11+
NEO4J_dbms_ssl_policy_cluster_client__auth: "REQUIRE"
12+
NEO4J_dbms_ssl_policy_cluster_verify__hostname: "true"
13+
14+
# Fabric ssl policy
15+
NEO4J_dbms_ssl_policy_fabric_enabled: "true"
16+
NEO4J_dbms_ssl_policy_fabric_client__auth: "REQUIRE"
17+
NEO4J_dbms_ssl_policy_fabric_verify__hostname: "true"
18+
19+
# Backup ssl policy
20+
NEO4J_dbms_ssl_policy_backup_enabled: "true"
21+
NEO4J_dbms_ssl_policy_backup_client__auth: "REQUIRE"
22+
NEO4J_dbms_ssl_policy_backup_verify__hostname: "false"

‎deployment-scenarios/cluster-internal-ssl/cluster-internal-ssl-files.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: cluster-internal-ssl-cert-and-key
6+
type: Opaque
7+
stringData:
8+
private.key: |-
9+
-----BEGIN RSA PRIVATE KEY-----
10+
MIIEpAIBAAKCAQEAmE2+K+TO4WwFxeVdc72VOBTLHDt/anuHdgtgZpiXqhsvHlgj
11+
uiWfA7dYcQh4aRI8w0+aup9GfSsPfnpYWuXriVslRcV9NmpuUt+fHYyA4gZT6Unu
12+
dXZnr5W2knE2nAFer9u0X7AtVrwtEn6tdhjgfg4mKWbZyL9MKNMxxBuhU3GaetBH
13+
/YlrbovVEAUZededl7+/ePs8mHSOA/VnAXAoGqQ8kiQtQ8Z+3wwyZs2Gb6VFMcuf
14+
htMTxZJUFePa/YEaoSD5pUJJKVX45oAIkIGHtHoocwDV3ont/YsZB6Tj4G3N8bRu
15+
RD4bpg0By5rvurMPwowUt9lkHh/6PbZkyG6KIwIDAQABAoIBAQCHyskD2b2avvVm
16+
vFnWF/IzTlbJlULFbd4ZIYuR7ftLb3FTXMJ99Y0RgycXoLW6+Me0XAVY3ym57+qg
17+
mfStFtIqZVmWG77IBZzXxwnXDq7a10l5drFliWxo4NMnPkmyToZdxUXNCwdhjeWh
18+
19BQu11tBrB/uXPzyJveym5Uq03rVr6IqWCgetWHgvjC/M0y5avWGSjP2qzAc+Dk
19+
xZjQqWAlUIvTtp5egTXtk5SkhxTdgh64az2gkJqwHBQBBE3dyro0aCUGTD2RS9df
20+
6LeWhQmr0UoaCCl837lzh7FcOk/KhEvlRHwWgu1x6brxOZFdykt/Bt2r3IlLHvBB
21+
R51JcHgBAoGBAMZat/dMm1L+lyUNe+mSTnR9nY95lbTSuMJrfGspNNhtO1zVKMQV
22+
ZFGOtXOn2B+1f8NJcsOl0b7SbjQymJxGBjqC4on+31pgqwBqPr27D5IqYmDrF9Dd
23+
5sj7syoypGHx6JkHQWE00EdoXrKedPcfUJbx035YAAqoE5AtwMle3FZxAoGBAMSQ
24+
60Vuov5ZsoNmrrBlfYedDkjF5obP9xfBPdTFt0/ktuOBP1PHVybwrsd5BNoW2zgw
25+
FZud7bmbstPGBsN5Z7QZm2pmPZ+VUIFoEPYodOcGeEd7NmSYSk1MtClG7l6UtMaJ
26+
7AkEN7IU7BR0sv+Dtdk66PhKSLaon6Q+QpTje3vTAoGBALvEbvfcfgC/3qaFsDI4
27+
fKpLq1aBW1V0UNBC3eG3fT4PkS1c351XPsLx3BUi4zWJI+vi4JASrY39N7OT3eG5
28+
a/YBpp/JNPgiIF5hNQl4RdIw6zYh9kaTeP/zPPSKQhAx5uTN+HcjfrLKOzLNS54P
29+
98McIwAsH8X2u6Y1mZVGhkARAoGAMYAtP3b1JQiBpAWfyFxGmHg8uKbdvuVwXFMV
30+
txdzanM2e2R5BigVEoFaAnG/fwxyeFvjlSTYUP2csygTW/ae3wPz13+X1TBM7cm/
31+
O75Eckl20Ml+kSaoz36ZgCuUq8zXGYhyIHMnc3lBWoVo7l/E08e6E4zhct5UFZB4
32+
Q/ZlinECgYBaCBhUCMSmoqnJ8s3EpHCsYZUjFhEyQmNraG5kFVTcANDg/NNkdqQp
33+
HMHMBsvFWlgiEAcngM8LBC8yUtX1a/FL8YbmxZ9bqVlln0E7Z/+OawcR4LdyhMuh
34+
WL+fj/Kny16wyIWck+QR7cpXtXS8vFP+jI2mcKxOoB+hTVJexbWhlg==
35+
-----END RSA PRIVATE KEY-----
36+
public.crt: |-
37+
-----BEGIN CERTIFICATE-----
38+
MIIEEzCCAvugAwIBAgIJAMxkASGTREE2MA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNV
39+
BAYTAkdCMQswCQYDVQQIDAJHQjEPMA0GA1UEBwwGTG9uZG9uMSEwHwYDVQQKDBhN
40+
eSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxEDAOBgNVBAsMB0RpZ2l0YWwxGTAXBgNV
41+
BAMMEG15X2NhX19yb290X2NlcnQwHhcNMjAwODIwMDkyNTA2WhcNMjUwODE5MDky
42+
NTA2WjCBsTEiMCAGA1UEAwwZZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbDEuMCwG
43+
CSqGSIb3DQEJARYfYWRtaW5AZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbDEYMBYG
44+
A1UECgwPRXhhbXBsZSBDb21wYW55MRUwEwYDVQQLDAxFeGFtcGxlIFVuaXQxDTAL
45+
BgNVBAcMBENpdHkxDjAMBgNVBAgMBVN0YXRlMQswCQYDVQQGEwJVUzCCASIwDQYJ
46+
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJhNvivkzuFsBcXlXXO9lTgUyxw7f2p7
47+
h3YLYGaYl6obLx5YI7olnwO3WHEIeGkSPMNPmrqfRn0rD356WFrl64lbJUXFfTZq
48+
blLfnx2MgOIGU+lJ7nV2Z6+VtpJxNpwBXq/btF+wLVa8LRJ+rXYY4H4OJilm2ci/
49+
TCjTMcQboVNxmnrQR/2Ja26L1RAFGXnXnZe/v3j7PJh0jgP1ZwFwKBqkPJIkLUPG
50+
ft8MMmbNhm+lRTHLn4bTE8WSVBXj2v2BGqEg+aVCSSlV+OaACJCBh7R6KHMA1d6J
51+
7f2LGQek4+BtzfG0bkQ+G6YNAcua77qzD8KMFLfZZB4f+j22ZMhuiiMCAwEAAaNj
52+
MGEwHwYDVR0jBBgwFoAU/6oW29HV8UxJMX7HfipHrhbfDHIwCQYDVR0TBAIwADAL
53+
BgNVHQ8EBAMCBPAwJgYDVR0RBB8wHYIbKi5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxv
54+
Y2FsMA0GCSqGSIb3DQEBCwUAA4IBAQAardQ4u2ezwxWeUHrK7hDI7kjWVB8vvaqC
55+
W3Gi9scdMzZExnMk/adk07aYjF6jso8m7+MH0MFIO7d2q4r1gPIOR9ToEkcwg/VO
56+
8qMCtMm7TBpM7uyR9GoirZ4QPsvh3f2qDd0BH/i3/aHJFguo4L3SOHsiNB23GsQ/
57+
Rqe5DqDbCr3osHoT8E4cDXUxdQO0rbAMsr79ME7oaJBFh0+reH1UI8LK7FWqm5pi
58+
atbTCMXzH650Zc4yNh+m0/lHmii8kKZXuNWZ0su1xA6jfVRViqB2yvLvB78NRUKH
59+
iq/a6qatJorvd6akaxAMupp18BUtLeyshEXkv2EoN3MFgBfl/jif
60+
-----END CERTIFICATE-----
61+
62+
---
63+
64+
apiVersion: v1
65+
kind: ConfigMap
66+
metadata:
67+
name: cluster-internal-ssl-trusted-certs
68+
data:
69+
#Add trusted public certificates as new keys to this configmap
70+
root.crt: |-
71+
-----BEGIN CERTIFICATE-----
72+
MIIDyTCCArGgAwIBAgIJANRHW99Q6S6EMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNV
73+
BAYTAkdCMQswCQYDVQQIDAJHQjEPMA0GA1UEBwwGTG9uZG9uMSEwHwYDVQQKDBhN
74+
eSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxEDAOBgNVBAsMB0RpZ2l0YWwxGTAXBgNV
75+
BAMMEG15X2NhX19yb290X2NlcnQwHhcNMjAwODIwMDkyNTA1WhcNMzAwODE4MDky
76+
NTA1WjB7MQswCQYDVQQGEwJHQjELMAkGA1UECAwCR0IxDzANBgNVBAcMBkxvbmRv
77+
bjEhMB8GA1UECgwYTXkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRAwDgYDVQQLDAdE
78+
aWdpdGFsMRkwFwYDVQQDDBBteV9jYV9fcm9vdF9jZXJ0MIIBIjANBgkqhkiG9w0B
79+
AQEFAAOCAQ8AMIIBCgKCAQEA3hcl3lVYOoAb6B0ji0DRRfUD2bq/kJveT6V96B1p
80+
ItAeikaVDDrYm4w8mcg/rb/3ny5Sr5p71lBbQAygXDvOwQLon+BQuEfMPmUmmWPC
81+
IVQIQ3wHHmF2vs+oBGamDASlX8dLrm1BCPuiL4XtPOejomHdVucbGhtSUe3APRyz
82+
AGTjj/HiysEHWiTn5PnCSRduYjof9lraosolsW4NrnYiX2f5miC6DREqsnHgUivA
83+
Q/Q3q26fPXGxLIanIU6P1wDlGrm0C//FCNSLlYNlDRzDsW5NHClT1xI047edBsMF
84+
MwGM12cscIqupujcWwdIvApzjeAF7MpRfyQtBIyFR4ebewIDAQABo1AwTjAdBgNV
85+
HQ4EFgQU/6oW29HV8UxJMX7HfipHrhbfDHIwHwYDVR0jBBgwFoAU/6oW29HV8UxJ
86+
MX7HfipHrhbfDHIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAPGfZ
87+
5/a4Y9/j4TMAqO7VRLNpt8YhIful54cI75srpBdG+AG/XD2uhDT/X5cJo/0c1ssZ
88+
JXzg4Ht5GTrs+LmxgksnLRelF2dd1yPS2aJWLenIrorFkMkf+p4440pXzWf/qMqO
89+
j9dpQsa588mw7+bFrujys/6OTu8ocSiO+EXq9H+D6HAtQMJ0SJpE0/RnAYJ3sxPu
90+
7Eb/AUdzjeIKlZBxsTsrtHEZAhgrJPSxhyYm7ZGyWaurhegiHpFSCrvbIK2IRiaH
91+
YfqOKWO4QP/JSQkldSs1PXNRtSqQ10k+XY+A5Tzy5yTzuCodtVmMLEovull5hg7h
92+
nGwJ+IlGC+Q0z94LUw==
93+
-----END CERTIFICATE-----
94+
95+
---
96+
97+
apiVersion: v1
98+
kind: ConfigMap
99+
metadata:
100+
name: cluster-internal-ssl-revoked-certs
101+
data:
102+
# Add revoked public certificates as new keys to this configmap e.g. `revoked1.crt: |- ...`

‎deployment-scenarios/cluster-internal-ssl/cluster-internal-ssl.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
imageTag: "4.0.8-enterprise"
2+
3+
core:
4+
configMap: "cluster-internal-ssl-config"
5+
additionalVolumes:
6+
- name: cluster-internal-cert-and-key
7+
secret:
8+
secretName: cluster-internal-ssl-cert-and-key
9+
- name: cluster-internal-revoked-certs
10+
configMap:
11+
name: cluster-internal-ssl-revoked-certs
12+
- name: cluster-internal-trusted-certs
13+
configMap:
14+
name: cluster-internal-ssl-trusted-certs
15+
additionalVolumeMounts:
16+
- name: cluster-internal-cert-and-key
17+
mountPath: /ssl/cluster
18+
readOnly: true
19+
- name: cluster-internal-revoked-certs
20+
mountPath: /ssl/cluster/revoked
21+
readOnly: true
22+
- name: cluster-internal-trusted-certs
23+
mountPath: /ssl/cluster/trusted
24+
readOnly: true
25+
- name: cluster-internal-cert-and-key
26+
mountPath: /ssl/fabric
27+
readOnly: true
28+
- name: cluster-internal-revoked-certs
29+
mountPath: /ssl/fabric/revoked
30+
readOnly: true
31+
- name: cluster-internal-trusted-certs
32+
mountPath: /ssl/fabric/trusted
33+
readOnly: true
34+
- name: cluster-internal-cert-and-key
35+
mountPath: /ssl/backup
36+
readOnly: true
37+
- name: cluster-internal-revoked-certs
38+
mountPath: /ssl/backup/revoked
39+
readOnly: true
40+
- name: cluster-internal-trusted-certs
41+
mountPath: /ssl/backup/trusted
42+
readOnly: true
43+
44+
readReplica:
45+
configMap: "cluster-internal-ssl-config"
46+
additionalVolumes:
47+
- name: cluster-internal-cert-and-key
48+
secret:
49+
secretName: cluster-internal-ssl-cert-and-key
50+
- name: cluster-internal-revoked-certs
51+
configMap:
52+
name: cluster-internal-ssl-revoked-certs
53+
- name: cluster-internal-trusted-certs
54+
secret:
55+
secretName: cluster-internal-ssl-trusted-certs
56+
additionalVolumeMounts:
57+
- name: cluster-internal-cert-and-key
58+
mountPath: /ssl/cluster
59+
readOnly: true
60+
- name: cluster-internal-revoked-certs
61+
mountPath: /ssl/cluster/revoked
62+
readOnly: true
63+
- name: cluster-internal-trusted-certs
64+
mountPath: /ssl/cluster/trusted
65+
readOnly: true
66+
- name: cluster-internal-cert-and-key
67+
mountPath: /ssl/fabric
68+
readOnly: true
69+
- name: cluster-internal-revoked-certs
70+
mountPath: /ssl/fabric/revoked
71+
readOnly: true
72+
- name: cluster-internal-trusted-certs
73+
mountPath: /ssl/fabric/trusted
74+
readOnly: true
75+
- name: cluster-internal-cert-and-key
76+
mountPath: /ssl/backup
77+
readOnly: true
78+
- name: cluster-internal-revoked-certs
79+
mountPath: /ssl/backup/revoked
80+
readOnly: true
81+
- name: cluster-internal-trusted-certs
82+
mountPath: /ssl/backup/trusted
83+
readOnly: true
84+
85+
acceptLicenseAgreement: "yes"
86+
neo4jPassword: mySecretPassword

‎deployment-scenarios/cluster-internal-ssl/instructions.txt‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
This directory contains quick instructions and an example of how to set up cluster internal ssl
2+
with Neo4j + Helm.
3+
4+
Step 1: Create custom ConfigMap.
5+
6+
kubectl apply -f deployment-scenarios/internal-ssl/cluster-internal-ssl-configmap.yaml
7+
8+
Step 2: Create ssl certificate ConfigMaps and key Secret.
9+
10+
This directory is populated with some example keys and certificates. You must use your own securely generated keys and certificates.
11+
12+
However if you want to use the example credentials FOR TESTING PURPOSES ONLY then you can install them using you can install using:
13+
kubectl apply -f deployment-scenarios/internal-ssl/cluster-internal-ssl-files.yaml
14+
15+
Step 3: Install a Neo4j cluster using the provided parameters.
16+
17+
helm install cluster-internal-ssl-example -f deployment-scenarios/internal-ssl/cluster-internal-ssl.yaml .

0 commit comments

Comments
 (0)