Enable TLS
There are two alternative approaches to enabling TLS: TLS termination and end-to-end TLS.
For testing purposes, you could use the self-signed-certificates operator as a stand-in for a local/external ca.
TLS termination
You can deploy grafana together with traefik, and enable TLS in traefik rather than in grafana. This way, when grafana is reached via the ingress URL, communication is TLS-encrypted to traefik, and the communication between traefik and grafana is plain HTTP. Moreover, in-cluster communication with related charms would also be unencrypted.
graph LR
external-ca ---|tls-certificates| traefik
subgraph your-model
traefik ---|ingress| grafana
end
Deploy the following bundle:
bundle: kubernetes
applications:
ca:
charm: self-signed-certificates
channel: edge
scale: 1
grafana:
charm: grafana-k8s
channel: edge
series: focal
scale: 1
trust: true
traefik:
charm: traefik-k8s
channel: edge
series: focal
scale: 1
trust: true
relations:
- - ca:certificates
- traefik:certificates
- - grafana:ingress
- traefik:traefik-route
- - traefik:grafana-dashboard
- grafana:grafana-dashboard
End-to-end TLS
By relating grafana to a certificates provider, this operator ensures all communications are behind TLS: both in-cluster and via ingress.
graph LR
external-ca ---|tls-certificates| traefik
subgraph your-model
traefik ---|ingress| grafana
grafana ---|tls-certificates| local-ca
traefik ---|send-ca-cert| local-ca
end
Deploy the following bundle:
bundle: kubernetes
applications:
ca:
charm: self-signed-certificates
channel: edge
scale: 1
external-ca:
charm: self-signed-certificates
channel: edge
scale: 1
grafana:
charm: grafana-k8s
channel: edge
series: focal
scale: 1
trust: true
traefik:
charm: traefik-k8s
channel: edge
series: focal
scale: 1
trust: true
relations:
- - traefik:traefik-route
- grafana:ingress
- - ca:send-ca-cert
- traefik:receive-ca-cert
- - ca:certificates
- grafana:certificates
- - traefik:certificates
- external-ca:certificates