feat: Add TLS modes with a How-to doc

[MichaelThamm]

Fixes #61, canonical/observability#273

Related:

• feat: Add offers in TF outputs.tf self-signed-certificates-operator#361
• Enable conditionally signing inter-COS charms with the external (or internal) CA #74

Warning

Due to this issue, we cannot validate ingress with TLS -> curl -k https://INGRESS_IP/cos-catalogue:

• certificate transfer is not working when related to some revisions of self-signed-certificates traefik-k8s-operator#495

Features

• TF root module for deploying SSC integrated with COS/COS Lite's Traefik via CMR.
• Conditionally enable TLS termination depending on the existence of a CA's offer URL
• Replace the TLS diagram with a mermaid diagram

This enables integrating either the manual TLS certificates charm or self-signed-certificates with COS to provide certificates to Traefik.

Tip

Traefik has config options for: tls-ca, tls-cert, tls-key which overrides the certs from the integration. This is tecnically no longer needed, but is still convenient. FYI we limit the certificates relation count to 1 in Traefik.

Juju status differences

Note

I tested this for COS as well. I just prove COS Lite since it's less LOC

Relevant end-to-end TLS model components:

+   self-signed-certificates:
+     charm: self-signed-certificates
+     channel: 1/stable
+     revision: 317
+     scale: 1
+     constraints: arch=amd64

+ - - traefik:certificates
+   - certificates:certificates
+ - - catalogue:certificates
+   - self-signed-certificates:certificates
+ - - loki:certificates
+   - self-signed-certificates:certificates
+ - - alertmanager:certificates
+   - self-signed-certificates:certificates
+ - - prometheus:certificates
+   - self-signed-certificates:certificates
+ - - grafana:certificates
+   - self-signed-certificates:certificates
+ - - traefik:receive-ca-cert
+   - self-signed-certificates:send-ca-cert

Relevant reverse-tls-termination model components:

+   self-signed-certificates:
+     charm: self-signed-certificates
+     channel: 1/stable
+     revision: 317
+     scale: 1
+     constraints: arch=amd64

- - - traefik:certificates
-   - certificates:certificates
+ - - catalogue:certificates
+   - self-signed-certificates:certificates
+ - - loki:certificates
+   - self-signed-certificates:certificates
+ - - alertmanager:certificates
+   - self-signed-certificates:certificates
+ - - prometheus:certificates
+   - self-signed-certificates:certificates
+ - - grafana:certificates
+   - self-signed-certificates:certificates
+ - - traefik:receive-ca-cert
+   - self-signed-certificates:send-ca-cert

Relevant only tls-termination model components:

-   self-signed-certificates:
-     charm: self-signed-certificates
-     channel: 1/stable
-     revision: 317
-     scale: 1
-     constraints: arch=amd64

+ - - traefik:certificates
+   - certificates:certificates
- - - catalogue:certificates
-   - self-signed-certificates:certificates
- - - loki:certificates
-   - self-signed-certificates:certificates
- - - alertmanager:certificates
-   - self-signed-certificates:certificates
- - - prometheus:certificates
-   - self-signed-certificates:certificates
- - - grafana:certificates
-   - self-signed-certificates:certificates
- - - traefik:receive-ca-cert
-   - self-signed-certificates:send-ca-cert

Relevant unencrypted model components:

-   self-signed-certificates:
-     charm: self-signed-certificates
-     channel: 1/stable
-     revision: 317
-     scale: 1
-     constraints: arch=amd64

- - - traefik:certificates
-   - certificates:certificates
- - - catalogue:certificates
-   - self-signed-certificates:certificates
- - - loki:certificates
-   - self-signed-certificates:certificates
- - - alertmanager:certificates
-   - self-signed-certificates:certificates
- - - prometheus:certificates
-   - self-signed-certificates:certificates
- - - grafana:certificates
-   - self-signed-certificates:certificates
- - - traefik:receive-ca-cert
-   - self-signed-certificates:send-ca-cert

TODO

• Merge my SSC fork
• Check if Traefik can handle certificates integration and config options
• Remove all TODO/FIXMEs in docs
  • Replace traefik_channel back to latest/stable once Traefik is backwards compatible (related to this PR)

Testing

Juju

Create a root module file something.tf:

# Note: The deployment order matters since the 'traefik:certificates' integration depends on 'module.ssc'
#   'terraform apply -target module.ssc'
#   'terraform apply'

module "ssc" {
  source = "git::https://github.com/canonical/self-signed-certificates-operator//terraform
  model  = "external-ca"
}

module "cos-lite" {
  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=feat/tls-termination"
  model                           = "cos"
  channel                         = "1/stable"
  traefik_channel                 = "latest/edge"
  internal_tls                    = true  # Set to 'false' to disable intra-model TLS
  external_certificates_offer_url = module.ssc.offers.certificates.url  # Set to 'null' or remove this line to communicate with Traefik via HTTP
}

terraform {
  required_version = ">= 1.5"
  required_providers {
    juju = {
      source  = "juju/juju"
      version = ">= 0.14.0"
    }
  }
}

Documentation

1. git checkout feat/tls-termination
2. cd docs
3. make run
4. Inspect the docs pages at http://0.0.0.0:8000/how-to/configure-tls-encryption

Manual TLS

• Follow the same steps as this PR

Documentation

This PR changes this TLS explanation doc to be a How-to doc with sample TF modules. This doc uses Sphinx tabs to only display one TLS mode at a time for COS or COS Lite:

This is the rendered mermaid diagram of the default TLS architecture: