mariadb-operator 📦 0.37.1 · TLS support, native cert-manager integration and more!

We're excited to introduce TLS 🔐 support in this release, one of the major features of mariadb-operator so far!✨ Check out the TLS docs, our example catalog and the release notes to start using it.

Issue certificates for MariaDB and MaxScale

Issuing and configuring TLS certificates for your instances has never been easier, you just need to set tls.enabled=true:

yaml apiVersion: k8s.mariadb.com/v1alpha1 kind: MariaDB metadata: name: mariadb-galera spec: ... tls: enabled: true

yaml apiVersion: k8s.mariadb.com/v1alpha1 kind: MaxScale metadata: name: maxscale spec: ... mariaDbRef: name: mariadb-galera tls: enabled: true

A self-signed Certificate Authority (CA) will be automatically generated to issue leaf certificates for your instances. The operator will also manage a CA bundle that your applications can use in order to establish trust.

TLS will be enabled by default in MariaDB, but it will not enforced. You can enforce TLS connections by setting tls.required=true to ensure that all connections are encrypted. In the case of MaxScale, TLS will only be enabled if you explicitly set tls.enabled=true or the referred MariaDB (via mariaDbRef) instance enforces TLS.

Native integration with cert-manager

cert-manager is the de facto standard for managing certificates in Kubernetes. This certificate controller simplifies the automatic provisioning, management, and renewal of certificates. It supports a variety of certificate backends (e.g. in-cluster, Hashicorp Vault), which are configured using Issuer or ClusterIssuer resources.

In your MariaDB and MaxScale resources, you can directly reference ClusterIssuer or Issuer objects to seamlessly issue certificates:

yaml apiVersion: k8s.mariadb.com/v1alpha1 kind: MariaDB metadata: name: mariadb-galera spec: ... tls: enabled: true serverCertIssuerRef: name: root-ca kind: ClusterIssuer clientCertIssuerRef: name: root-ca kind: ClusterIssuer yaml apiVersion: k8s.mariadb.com/v1alpha1 kind: MaxScale metadata: name: maxscale-galera spec: ... tls: enabled: true adminCertIssuerRef: name: root-ca kind: ClusterIssuer listenerCertIssuerRef: name: root-ca kind: ClusterIssuer

Under the scenes, the operator will create cert-manager's Certificate resources with all the required Subject Alternative Names (SANs) required by your instances. These certificates will be automatically managed by cert-manager and the CA bundle will be updated by the operator so you can establish trust with your instances.

The advantage of this approach is that you can use any of the cert-manager's certificate backends, such as the in-cluster CA or HashiCorp Vault, and potentially reuse the same Issuer/ClusterIssuer with multiple instances.

Certificate rotation

Whether the certificates are managed by the operator or by cert-manager, they will be automatically renewed before expiration. Additionally, the operator will update the CA bundle whenever the CAs are rotated, temporarily retaining the old CA in the bundle to ensure a seamless update process.

In both scenarios, the standard update strategies apply, allowing you to control how the Pods are restarted during certificate rotation.

TLS requirements for Users

We have extended our User SQL resource to include TLS-specific requirements for user connections over TLS. For example, if you want to enforce the use of a valid x509 certificate for a user to connect:

yaml apiVersion: k8s.mariadb.com/v1alpha1 kind: User metadata: name: user spec: ... require: x509: true

To restrict the subject of the user's certificate and/or require a specific issuer, you may set:

yaml apiVersion: k8s.mariadb.com/v1alpha1 kind: User metadata: name: user spec: ... require: issuer: "/CN=mariadb-galera-ca" subject: "/CN=mariadb-galera-client"

If any of these TLS requirements are not satisfied, the user will be unable to connect to the instance.

Check out the release notes for more detail:
https://github.com/mariadb-operator/mariadb-operator/releases/tag/0.37.1

Finally, we’d like to send a massive THANK YOU to all the amazing contributors who made this release happen! Your dedication and effort are what keep this project thriving. We’re beyond grateful to have such an amazing community!