Chapter 11. Configuring TLS encryption in Eventing

Procedure

1. Create a SelfSigned ClusterIssuer resource as follows:

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: knative-eventing-selfsigned-issuer
   spec:
     selfSigned: {}

2. Apply the ClusterIssuer resource by running the following command:

   $ oc apply -f <filename>

3. Create a root certificate by using the SelfSigned ClusterIssuer resource as follows:

   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: knative-eventing-selfsigned-ca
     namespace: cert-manager
   spec:
     secretName: knative-eventing-ca
     isCA: true
     commonName: selfsigned-ca
     privateKey:
       algorithm: ECDSA
       size: 256
     issuerRef:
       name: knative-eventing-selfsigned-issuer
       kind: ClusterIssuer
       group: cert-manager.io

   • namespace: cert-manager specifies the cert-manager Operator for Red Hat OpenShift that is used by default.
   • secretName: knative-eventing-ca specifies the secret where the certificate is stored. The name is later used by the ClusterIssuer for Eventing.

4. Apply the Certificate resource by running the following:

   $ oc apply -f <filename>

Procedure

1. Create the knative-eventing-ca-issuer ClusterIssuer resource as follows:

   Every Eventing component uses this issuer to issue their server’s certs.

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: knative-eventing-ca-issuer
   spec:
     ca:
       secretName: knative-eventing-ca 

   1

   1 1 1 1

   The secretName value in the cert-manager namespace (default for cert-manager Operator for Red Hat OpenShift) contains the certificate that can be used by Knative Eventing components.

   Note

   The ClusterIssuer name must be knative-eventing-ca-issuer.

2. Apply the ClusterIssuer resource by running the following command:

   $ oc apply -f <filename>

Procedure

1. Enable the transport-encryption in KnativeEventing as follows:

   apiVersion: operator.knative.dev/v1beta1
   kind: KnativeEventing
   metadata:
     name: knative-eventing
     namespace: knative-eventing
   spec:
   
     # Other spec fields omitted ...
     # ...
   
     config:
       features:
         transport-encryption: strict

2. Apply the KnativeEventing resource by running the following command:

   $ oc apply -f <filename>

Procedure

1. Export the CA from the knative-eventing-ca secret in the cert-manager Operator for Red Hat OpenShift namespace (default is cert-manager certificate) by running the following command:

   $ oc get secret -n cert-manager knative-eventing-ca -o=jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

2. Create a CA trust bundle in the knative-eventing namespace by running the following command:

   $ oc create configmap -n knative-eventing my-org-selfsigned-ca-bundle --from-file=ca.crt

3. Label the ConfigMap by running the following command:

   $ oc label configmap -n knative-eventing my-org-selfsigned-ca-bundle networking.knative.dev/trust-bundle=true

Procedure

1. Create a CA certificate.

2. Add the public key of the new CA certificate to the CA trust bundles.

   Ensure that you also keep the public key of the existing CA.

3. Ensure all clients use the latest CA trust bundles.

   Knative Eventing components automatically reload the updated CA trust bundles. For custom workloads that consume trust bundles, reload or restart them as needed.

4. Update the knative-eventing-ca-issuer ClusterIssuer to reference the secret containing the CA certificate that you created in step 1.
5. Force cert-manager to renew certificates in the knative-eventing namespace.
6. As soon as the CA rotation is fully completed, remove the public key of the old CA from the trust bundle config map.

Procedure

1. Create an InMemoryChannel resource as follows:

   apiVersion: messaging.knative.dev/v1
   kind: InMemoryChannel
   metadata:
     name: transport-encryption-test

2. Apply the InMemoryChannel resource by running the following command:

   $ oc apply -f <filename>

3. View the InMemoryChannel address by running the following command:

   $ oc get inmemorychannels.messaging.knative.dev transport-encryption-test

   You get an output similar to the following example:

   NAME                        URL                                                                                           AGE   READY   REASON
   transport-encryption-test   https://imc-dispatcher.knative-eventing.svc.cluster.local/default/transport-encryption-test   17s   True