TLS

OpenEverest can use Transport Layer Security (TLS) for all incoming connections to its UI and API. TLS ensures that communication between clients and the API server is encrypted, protecting data from interception or tampering. Administrators can configure server certificates and private keys to enable secure HTTPS access, enhancing the overall security posture for production environments.

note

• When TLS is enabled, the everest service listens on port 443 and accepts only https traffic; http traffic is rejected.
• We do not support redirects from http to https.
• Self-signed certificates aren't trusted by most browsers, so it's best to use a trusted certificate from a Certificate Authority (CA) in production.

TLS setup with OpenEverest

Important

The examples below use Helm. To enable TLS on an existing installation, use the same values with helm upgrade everest-core openeverest/openeverest --namespace everest-system --reuse-values.

Use Cert-manager (recommended)

Prerequisites

• Ensure that cert-manager has been deployed on your Kubernetes cluster.

• Ensure that you have a properly configured Issuer or ClusterIssuer in place. See the documentation for details.

Set up OpenEverest using cert-manager

Here are the steps to set up the OpenEverest server using cert-manager:

1. Create a configuration file named values.yaml:

   server:
     tls: 
       enabled: true
       certificate:
         create: true
         domain: example.com
         issuer:
           group: cert-manager.io
           kind: ClusterIssuer 
           name: your-cluster-issuer

   Replace example.com with your actual domain name.

2. Install OpenEverest using the above values:

   helm install everest-core openeverest/openeverest --devel --create-namespace \
   -n everest-system \
   -f values.yaml

Alternative methods for configuring TLS in OpenEverest

Use self-signed certificates

Use self-signed certificates (automatically generated during installation):

helm install everest-core openeverest/openeverest --devel --create-namespace \
-n everest-system \
--set server.tls.enabled=true

Configure TLS with custom certificates

Here are the steps to set up the OpenEverest server using custom certificates:

1. Prepare your certificate public key (tls.crt) and private key (tls.key) files.

2. Create a configuration file named values.yaml:

   server:
     tls: 
       enabled: true
       secret:
         certs:
           tls.key: YOUR_PRIVATE_KEY_FILE
           tls.crt: YOUR_CERTIFICATE_FILE

   Replace YOUR_PRIVATE_KEY_FILE and YOUR_CERTIFICATE_FILE with the actual contents of your public and private key files.

3. Install OpenEverest using the above values:

   helm install everest-core openeverest/openeverest --devel --create-namespace \
   -n everest-system \
   -f values.yaml