Network and communication

This section provides information on network and communication security.

Secure topology

The CDF is designed to be part of a secure architecture, and can meet the challenge of dealing with the security threats to which it could potentially be exposed.

To securely deploy the CDF, HPE recommends to use the TLS/SSL communication protocol.

Replace the ingress service certificate with a custom certificate

To replace the certificate and private key of Ingress Service with a custom certificate and private key, follow the steps below:

1. Generate a certificate and private key for the host on which the Ingress Service is running on. Put it somewhere on the master node.

2. on the master node, delete a secret with the following command:

kubectl delete secret nginx-default-secret -n core

3. on the master node, recreate the secret with a new certificate and private key:

   Note: You must keep the format of the following commands as it is, especially the indented spaces.

   echo "

   apiVersion: v1

   kind: Secret

   metadata:

     name: nginx-default-secret

     namespace: core

   data:

     tls.crt: `base64 <your custom certificate file directory> |tr -d \"\n\"`

     tls.key: `base64 <your custom private key file directory> |tr -d \"\n\"`

   " | kubectl create -f -

4. on the master node, delete and recreate the ingress service:

kubectl delete -f ${K8S_HOME}/objectdefs/nginx-ingress.yaml

kubectl create -f ${K8S_HOME}/objectdefs/nginx-ingress.yaml

Renew the client.crt, client.key, server.crt and server.key

Follow the steps below to replace the client.crt, client.key, server.crt, and server.key with custom certificates.

1. Generate new server certificates or client certificates with the following commands:

   cd ${K8S_HOME}/scripts

   ./renewCert.sh

2. Restart the kubelete service with the following commands:

   cd ${K8S_HOME}/bin

   ./ kube-restart.sh

3. Delete three default tokens in the core, default, and suite namespaces with the following commands:

   kubectl get secrets --all-namespaces

   kubectl get delete secret xxxx -n default-token-xxxx

4. Recreate the yaml files with the following commands:

   cd ${K8S_HOME}/objectives

   kubectl delete -f kube-vault.yaml

   kubectl delete -f mng-portal.yaml

   kubectl delete -f nginx-ingress.yaml

   kubectl create -f kube-vault.yaml

   kubectl create -f mng-portal.yaml

   kubectl create -f nginx-ingress.yaml

   kubectl delete -f ingress yaml

5. Recreate the suite ingress yaml with the following commands:

   cd /var/vols/itom/core/suite-install/{suite_ingress _yaml_directory}/objectives

   kubectl delete -f xxxx-nginx-ingress.yaml

   kubectl create -f xxxx-nginx-ingress.yaml

FAQ

Question

Answer

Browsers access HPE CDF via the HTTPS ports (TCP/5443). End users need to add it to the firewall exception policy.