Overview
This example will demonstrate how to connect to a PostgreSQL database with TLS enabled from Artifactory
Prerequisites
- Kubernetes 1.19+
- Artifactory enabled and installed through Artifactory Charts
- Kubectl was installed and set up to use the cluster
- Helm v3 installed
- Database certificates used
How to configure it?
As we are using the artifactory charts in this example, make sure to add the JFrog helm repository to your helm client using the commands below
helm repo add jfrog https://charts.jfrog.io
helm repo update
Note:
Since Artifactory is based on Java and Metadata service is written in Golang, it is required to have the certificates available in both formats
In order to make the server certificate available to Java, convert it to Java format:
openssl x509 -in server.cert -out server.crt.der -outform der
Also, convert the client key in DER format
openssl pkcs8 -topk8 -outform DER -in ca.key -out ca.key.pk8 -nocrypt
Step 1: Construction of Kubernetes Secrets: Once the certificates are converted to the required formats, let’s construct the Kubernetes secrets required for Artifactory to connect to PostgreSQL database
Secret for DB Certificates:
kubectl create secret generic artifactory-cloud-sql-certs --from-file=ca.key.pk8 --from-file=ca.key --from-file=ca.cert --from-file=server.crt.der --from-file=server.cert
Secret for Database Credentials and Connection String:
kubectl create secret generic rds-artifactory --from-literal=db-user=artifactory --from-literal=db-password=pass --from-literal=db-url=
Step 2: Preparation of Values file: Now, let's create the values.yaml to install Artifactory.
Under the database section available in values.yaml, we can update the secrets
postgresql:
enabled: false
database:
type: postgresql
driver: org.postgresql.Driver
secrets:
user:
name: "rds-artifactory"
key: "db-user"
password:
name: "rds-artifactory"
key: "db-password"
url:
name: "rds-artifactory"
key: "db-url"
Note:
Since we are using an external database, the default PostgreSQL bundled with helm charts is disabled in this example.
The above section will be using the java based connection string and it is required to use the sslrootcert with “.der” extension and sslkey should be with “.pk8” extensions using the conversion example as mentioned above.
Step 3: Construct the Database url for Metadata: As a next step, we also need to construct the database url connection strings based on “golang” format for Metadata services to connect with the database.
To achieve this, we need to manually update the customized system.yaml with the parameters on the values.yaml file and note that the should be of .cert and sslkey should be of .key formats.
Example:
artifactory:
replicaCount: 1
extraSystemYaml:
metadata:
database:
type: postgresql
url: "go:user='artifactory' password='password' dbname=artifactory host=postgres.com port=5432 sslmode=verify-ca sslrootcert=/tmp/db-certs/server.cert sslcert=/tmp/db-certs/ca.cert sslkey=/tmp/db-certs/ca.key"
Step 4: Creating Custom Volumes for Secrets: In this example, we used a custom path for saving the certificates within the pod and this can be achieved by using a customVolumes and customVolumeMounts in the values.yaml file.
Also, the certificate files should be assigned with 600 permissions by configuring it via the preStartCommand under artifactory section
The final values.yaml file will look like below
postgresql:
enabled: false
database:
type: postgresql
driver: org.postgresql.Driver
secrets:
user:
name: "rds-artifactory"
key: "db-user"
password:
name: "rds-artifactory"
key: "db-password"
url:
name: "rds-artifactory"
key: "db-url"
databaseUpgradeReady: true
unifiedUpgradeAllowed: true
mc:
enabled: false
artifactory:
replicaCount: 1
extraSystemYaml:
metadata:
database:
type: postgresql
url: "go:user='artifactory' password='password' dbname=artifactory host=postgres.com port=5432 sslmode=verify-ca sslrootcert=/tmp/db-certs/server.cert sslcert=/tmp/db-certs/ca.cert sslkey=/tmp/db-certs/ca.key"
preStartCommand: "chmod -R 600 /tmp/db-certs/* && ls -ltr /tmp/db-certs/db-certs"
customCertificates:
enabled: true
certificateSecretName: artifactory-cloud-sql-certs
customVolumes: |
- name: artifactory-cloud-sql-certs
secret:
secretName: artifactory-cloud-sql-certs
customVolumeMounts: |
- name: artifactory-cloud-sql-certs
mountPath: /tmp/db-certs
masterKeySecretName: masterkey-secret
joinKeySecretName: joinkey-secret
nginx:
enabled: true
Step 5: Install Artifactory: Finally, perform the installation of Artifactory
helm upgrade --install artifactory jfrog/artifactory -f values.yaml