DNS and Certificate Inventory Reference

This reference lists the DNS names each exposed Axual component needs, the two certificate authorities the platform expects, the certificates to request from each of them, and what the platform truststore has to contain.

Type

Reference

Goal

Draw up the list of DNS names and certificates to request before an installation starts.

Audience

Infrastructure engineers who can register DNS names and request certificates from the organisation’s certificate authority.

When to use

When planning a new installation, or when adding an externally exposed component to an existing one.

The names and addresses below are indicative. Every deployment substitutes its own domain, and the exact set of exposed components depends on which layers are installed.

Contents

The sections below cover each area in this reference:

DNS names

Each externally reachable component needs a DNS name resolving to the load balancer or ingress that fronts it. The rows below use company.org as the example domain and esp- as the example prefix.

The ports below are the Kafka listener ports the load balancer or ingress forwards to. Only 9094 is always present: 9095 exists when the SASL/SCRAM listener is enabled and 9096 when the inter-cluster listener is enabled. For the full set of listeners, the internal ports every component listens on, and the flows between them, see Listen ports per component.

Component Layer DNS name IP address Port Protocol Exposed by

Broker 1

Streaming

esp-broker-0.company.org

Custom LB IP

9094, and 9095 when enabled

mTLS+TCP, SASL

Load balancer

Broker 2

Streaming

esp-broker-1.company.org

Custom LB IP

9094, and 9095 when enabled

mTLS+TCP, SASL

Load balancer

Broker 3

Streaming

esp-broker-2.company.org

Custom LB IP

9094, and 9095 when enabled

mTLS+TCP, SASL

Load balancer

Broker bootstrap

Streaming

esp-broker-bootstrap.company.org

Custom LB IP

9094, and 9095 when enabled

mTLS+TCP, SASL

Load balancer

API Gateway

Governance

esp-gateway.company.org

Ingress LB IP

443

HTTPS

Ingress

Apicurio Registry

Streaming

esp-schemas.company.org

Ingress LB IP

443

HTTPS

Ingress

Rest Proxy

Streaming

esp-restproxy.company.org

Custom LB IP

443

mTLS+HTTPS

Load balancer

Broker 1 internal (optional)

Streaming

esp-broker-0-internal.company.org

Custom LB IP

9096

mTLS+TCP, SASL

Load balancer

Certificate authorities

The platform expects two certificate authorities, one for anything an external client reaches and one for traffic that never leaves the cluster.

Public Key Infrastructure (PKI) Purpose

Enterprise PKI

Trusted by the platform for its external interface components. Signs the server and client certificates of external-facing components, and the application certificates of clients connecting to the platform.

PKIESP (internal)

A custom certificate authority for internal certificates, preferably managed by cert-manager. Signs the private listener certificates of the Apache Kafka brokers on ports 9091 and 9093. Its private key is also installed in the Operator. Never exposed to externally connecting applications, and included in the platform package.
With a Service Mesh in place, the internal PKI and its certificates are no longer required, because the mesh secures component-to-component traffic without each component holding its own mTLS material.

Certificates to request

Certificates are required for service-to-service mutual TLS (mTLS) inside the Kubernetes cluster, and for external traffic from producers and consumers to Apache Kafka, Apicurio Registry and Rest Proxy.

In the table below, <prefix> is either of the following:

  • <tenant-short-name>-<instance-name>, giving names such as customer-dta-platform-manager. The tenant short name is the value of .Values.global.tenant.shortName and the instance name the value of .Values.global.instance.name.

  • The name of the chart, so a chart named axual gives axual-platform-manager.

Subject Issuer Component Subject Alternative Names Certificate type

CN=internal-server-only

PKIESP

  • API Gateway

  • Platform Manager

  • Platform UI

  • Organization Manager

  • Keycloak

  • Topic Browse

  • Apicurio Registry

  • Rest Proxy

  • Axual Connect

  • Axual Distributor

  • Vault

  • <prefix>-api-gateway

  • <prefix>-platform-manager

  • <prefix>-platform-ui

  • <prefix>-organization-mgmt

  • <prefix>-keycloak-http

  • <prefix>-topic-browse

  • <prefix>-schema-registry

  • <prefix>-rest-proxy

  • <prefix>-connect

  • <prefix>-distributor

  • <prefix>-vault

Server

CN=esp-company-server

Enterprise PKI

  • Apache Kafka brokers and bootstrap

  • API Gateway ingress

  • Apicurio Registry ingress

  • Rest Proxy ingress

  • esp-broker-0.company.org

  • esp-broker-1.company.org

  • esp-broker-2.company.org

  • esp-broker-bootstrap.company.org

  • esp-selfservice.company.org

  • esp-schemas.company.org

  • esp-restproxy.company.org

Server
cert-manager can issue and renew the internal certificates automatically. Where the organisation already runs cert-manager, integrate with that instance rather than deploying a second one. See cert-manager for what the platform expects of it.

Truststore contents

The platform needs one truststore, as a Kubernetes Secret or a JKS file, holding both certificate authorities: the Enterprise PKI and the internal PKIESP. The platform package ships a sample truststore.jks containing the internal PKI, to which the Enterprise PKI is added.

For the Secret shape a truststore takes on Kubernetes, see Truststore (CA) Secrets.