Installation

Operator TLS

Configure TLS once at the platform level and auto-inject it into every deployment

View as Markdown

The Dynamo operator can inject TLS configuration into every DynamoGraphDeployment (DGD) pod automatically, so you don’t have to set the DYN_TCP_TLS_* and NATS_TLS_* environment variables on each component. TLS is configured once at the platform level via InfrastructureConfiguration, and the operator propagates the corresponding env vars to all DGD pods it manages.

For the full list of TLS/mTLS environment variables and CLI flags, and for the per-component configuration method, see the TLS reference.

Operator-level TLS configuration

Set the values in the operator Helm chart. When installing the operator as part of the platform chart, prefix them with dynamo-operator.:

1dynamo-operator:
2  tcpTLSCertPath: /etc/certs/server/cert.pem
3  tcpTLSKeyPath: /etc/certs/server/key.pem
4  tcpTLSCAPath: /etc/certs/ca/ca.pem
5  # Override the TLS SNI hostname when dialing by IP to a server whose
6  # certificate has a DNS SAN (e.g. a *.svc.cluster.local cert).
7  tcpTLSServerName: dynamo-worker.dynamo-system.svc.cluster.local
8  natsTLSCAPath: /etc/certs/ca/ca.pem
9  # NATS TLS requires a tls:// server address — see the note below.
10  natsAddr: "tls://dynamo-platform-nats.dynamo-system.svc.cluster.local:4222"

Or pass them via --set during helm install/helm upgrade (platform chart shown; drop the dynamo-operator. prefix if installing the subchart directly):

$helm upgrade dynamo-platform ... \
>  --set dynamo-operator.tcpTLSCertPath=/etc/certs/server/cert.pem \
>  --set dynamo-operator.tcpTLSKeyPath=/etc/certs/server/key.pem \
>  --set dynamo-operator.tcpTLSCAPath=/etc/certs/ca/ca.pem \
>  --set dynamo-operator.tcpTLSServerName=dynamo-worker.dynamo-system.svc.cluster.local \
>  --set dynamo-operator.natsTLSCAPath=/etc/certs/ca/ca.pem \
>  --set dynamo-operator.natsAddr=tls://dynamo-platform-nats.dynamo-system.svc.cluster.local:4222

Per-component env vars in podTemplate take precedence over operator-level values when both are set.

When any natsTLS* value is set, natsAddr must use the tls:// scheme — the runtime fails closed at startup otherwise. If you are using the bundled NATS subchart, also enable TLS on the server side (see Enabling TLS on the NATS server).

Operator-level mTLS configuration

mTLS certificate paths can also be configured at the operator level:

1dynamo-operator:
2  tcpTLSClientCertPath: /etc/certs/client/cert.pem
3  tcpTLSClientKeyPath: /etc/certs/client/key.pem
4  tcpTLSClientCAPath: /etc/certs/client-ca/ca.pem
5  natsTLSClientCertPath: /etc/certs/client/cert.pem
6  natsTLSClientKeyPath: /etc/certs/client/key.pem

The certificates themselves are typically delivered by a certificate management system (such as cert-manager) and mounted into the pods at the paths referenced above. The operator injects the paths (via env vars), not the volumes — the cert files must exist at those paths in every DGD pod.

A common setup is to issue a Certificate with cert-manager, store it in a Kubernetes Secret, and mount that Secret as a volume in the pod template:

1spec:
2  components:
3  - name: Frontend
4    podTemplate:
5      spec:
6        containers:
7        - name: main
8          volumeMounts:
9          - name: tls-server-certs
10            mountPath: /etc/certs/server
11            readOnly: true
12          - name: tls-ca-cert
13            mountPath: /etc/certs/ca
14            readOnly: true
15        volumes:
16        - name: tls-server-certs
17          secret:
18            secretName: dynamo-tls-server
19            # cert-manager Secrets use tls.crt / tls.key; map them to the
20            # filenames the operator's tcpTLSCertPath / tcpTLSKeyPath point at.
21            items:
22            - key: tls.crt
23              path: cert.pem
24            - key: tls.key
25              path: key.pem
26        - name: tls-ca-cert
27          secret:
28            secretName: dynamo-tls-ca
29            # Mount the CA certificate at the path tcpTLSCAPath / natsTLSCAPath
30            # point at (e.g. /etc/certs/ca/ca.pem).
31            items:
32            - key: ca.crt
33              path: ca.pem

This example shows a single component (Frontend); every component that receives the TLS env vars needs the same volume mounts. If you are using the operator’s auto-injection, apply these mounts in each component’s podTemplate.

For NATS TLS to work, the NATS server itself must also be configured to listen on TLS. The operator injects the client-side env vars, but enabling TLS on the NATS server subchart is a separate step — see Enabling TLS on the NATS server in the TLS reference.