<!DOCTYPE html><htmllang="en"dir="auto"><head><metacharset="utf-8"><metaname="viewport"content="width=device-width, initial-scale=1, maximum-scale=5, user-scalable=no"><metaname="description"content="Communication security with TLS Table of contents Automated TLS certificate management using cert-manager Manual TLS certificate management DEPRECA..."><metaname="revised"content=""><metaname="author"content="Kubernetes SIGs"><metaname="generator"content="rundocs/jekyll-rtd-theme v2.0.10"><metaname="theme-color"content="#2980b9"><title>TLS authentication · Node Feature Discovery</title><metaname="twitter:title"content="TLS authentication · Node Feature Discovery"><metaname="twitter:description"content="Communication security with TLS Table of contents Automated TLS certificate management using cert-manager Manual TLS certificate management DEPRECA..."><metaname="twitter:card"content="summary"><metaname="twitter:site"content="@Kubernetes SIGs"><metaname="twitter:url"content="https://kubernetes-sigs.github.com/node-feature-discovery/master/deployment/tls.html"><metaname="twitter:creator"content="@rundocs/jekyll-rtd-theme v2.0.10"><metaproperty="og:title"content="TLS authentication · Node Feature Discovery"><metaproperty="og:description"content="Communication security with TLS Table of contents Automated TLS certificate management using cert-manager Manual TLS certificate management DEPRECA..."><metaproperty="og:locale"content="en"><metaproperty="og:url"content="https://kubernetes-sigs.github.com/node-feature-discovery/master/deployment/tls.html"><metaproperty="og:type"content="article"><metaproperty="article:author"content="Kubernetes SIGs"><metaproperty="article:published_time"content="2016-07-23T05:07:52+00:00"><metaproperty="article:modified_time"content="2023-12-01T14:17:54+00:00"><scripttype="application/ld+json">{"@context":"https://schema.org","@type":"Article","mainEntityOfPage":{"@type":"WebPage","@id":"https://kubernetes-sigs.github.com/node-feature-discovery/master/deployment/tls.html"},"headline":"TLS authentication · Node Feature Discovery","image":[],"author":{"@type":"Person","name":"Kubernetes SIGs"},"datePublished":"2016-07-23T05:07:52+00:00","dateModified":"2023-12-01T14:17:54+00:00","publisher":{"@type":"Organization","name":"Kubernetes SIGs","logo":{"@type":"ImageObject","url":"https://avatars.githubusercontent.com/u/36015203?v=4"}},"description":"Communication security with TLS Table of contents Automated TLS certificate management using cert-manager Manual TLS certificate management DEPRECA..."}</script><linkrel="dns-prefetch"href="https://cdn.jsdelivr.net"><linkrel="prev"href="https://kubernetes-sigs.github.com/node-feature-discovery/master/deployment/operator.html"><linkrel="next"href="https://kubernetes-sigs.github.com/node-feature-discovery/master/deployment/uninstallation.html"><linkrel="canonical"href="https://kubernetes-sigs.github.com/node-feature-discovery/master/deployment/tls.html"><linkrel="icon"type="image/svg+xml"href="/node-feature-discovery/master/assets/images/favicon.svg"><linkrel="icon"type="image/png"href="/node-feature-discovery/master/assets/images/favicon-16x16.png"sizes="16x16"><linkrel="icon"type="image/png"href="/node-feature-discovery/master/assets/images/favicon-32x32.png"sizes="32x32"><linkrel="icon"type="image/png"href="/node-feature-discovery/master/assets/images/favicon-96x96.png"sizes="96x96"><linkrel="mask-icon"href="/node-feature-discovery/master/assets/images/favicon.svg"color="#2980b9"><linkrel="apple-touch-icon"href="/node-feature-discovery/master/assets/images/apple-touch-icon-300x300.jpg"><linkrel="stylesheet"href="https://cdn.jsdelivr.net/gh/rundocs/jekyll-rtd-theme@2.0.10/assets/css/theme.min.css"><style>@media(min-width:1280px){.content-wrap{max-width:1200px}}</style><script>window.ui={title:"NodeFeatureDiscovery",baseurl:"/node-feature-discovery/master",i18n:{search_results:"SearchResults",search_
</code></pre></div></div><p>Alternatively, you can refer to cert-manager documentation for other installation methods such as the Helm chart they provide.</p><p>To use the kustomize overlay to install node-feature-discovery with TLS enabled, you may use the following:</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>kubectl apply <spanclass="nt">-k</span> deployment/overlays/samples/cert-manager
</code></pre></div></div><p>To make use of the helm chart, override <codeclass="language-plaintext highlighter-rouge notranslate">values.yaml</code> to enable both the <codeclass="language-plaintext highlighter-rouge notranslate">tls.enabled</code> and <codeclass="language-plaintext highlighter-rouge notranslate">tls.certManager</code> options. Note that if you do not enable <codeclass="language-plaintext highlighter-rouge notranslate">tls.certManager</code>, helm will successfully install the application, but deployment will wait until certificates are manually created, as demonstrated below.</p><p>See the sample installation commands in the Helm <ahref="/node-feature-discovery/master/deployment/helm.html#deployment">Deployment</a> and <ahref="/node-feature-discovery/master/deployment/helm.html#configuration">Configuration</a> sections above for how to either override individual values, or provide a yaml file with which to override default values.</p><h2id="manual-tls-certificate-management">Manual TLS certificate management</h2><p>If you do not with to make use of cert-manager, the certificates can be manually created and stored as secrets within the NFD namespace.</p><p>Create a CA certificate</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code>openssl req <spanclass="nt">-x509</span><spanclass="nt">-newkey</span> rsa:4096 <spanclass="nt">-keyout</span> ca.key <spanclass="nt">-nodes</span><spanclass="se">\</span>
</code></pre></div></div><p>Create a common openssl config file.</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code><spanclass="nb">cat</span><spanclass="o"><<</span><spanclass="no">EOF</span><spanclass="sh">> nfd-common.conf
[ req ]
default_bits = 4096
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
C = XX
ST = some-state
L = some-city
O = some-company
OU = node-feature-discovery
[ req_ext ]
subjectAltName = @alt_names
[ v3_ext ]
authorityKeyIdentifier=keyid,issuer:always
basicConstraints=CA:FALSE
keyUsage=keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=@alt_names
</span><spanclass="no">EOF
</span></code></pre></div></div><p>Now, create the nfd-master certificate.</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code><spanclass="nb">cat</span><spanclass="o"><<</span><spanclass="no">EOF</span><spanclass="sh">> nfd-master.conf
</code></pre></div></div><p>Create certificates for nfd-worker and nfd-topology-updater</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code><spanclass="nb">cat</span><spanclass="o"><<</span><spanclass="no">EOF</span><spanclass="sh">> nfd-worker.conf
</code></pre></div></div><p>Now, sign the certificates with the CA created earlier.</p><divclass="language-bash highlighter-rouge notranslate"><divclass="highlight"><preclass="highlight"><code><spanclass="k">for </span>cert <spanclass="k">in </span>nfd-master nfd-worker nfd-topology-updater<spanclass="p">;</span><spanclass="k">do
