Add pod-level TLS termination for Keystone and Barbican - 007 WP-4 - #12641

Open

bbobrov wants to merge 54 commits into

007-wp4-implementation

Commits on Sep 3, 2026

Add TLS termination and ingress passthrough support to Barbican

bbobrov
and
rajivmucheli
committed
adf9fdc
Add TLS termination and ingress passthrough support to Keystone
bbobrov
committed
93e66df
Add TLS bootstrap Job and weekly rotation CronJob to Keystone
bbobrov
committed
be8050d
Add TLS bootstrap Job and weekly rotation CronJob to Barbican

bbobrov
and
rajivmucheli
committed
3ca5746
Add Prometheus alerts for TLS certificate rotation failures
bbobrov
committed
3f83b65
Use Keystone LOCI image for TLS init container instead of busybox
bbobrov
committed
c87b48d
Lower TLS rotation alert severity from critical to warning
bbobrov
committed
6dd908d
Use DigicertIssuer (namespace-scoped) instead of ClusterDigicertIssuer
bbobrov
committed
0a21594
Move TLS manager RBAC out of Helm hook into regular templates
bbobrov
committed
94024e7
Make TLS manager RBAC a pre-install hook with weight -10
bbobrov
committed
9c2f60f
Enable mod_ssl for TLS termination via read-only conf for Barbican
bbobrov
committed
58af1ea
Move TLS hardening Include outside VirtualHost block
bbobrov
committed
88b0483
Remove duplicate Listen 443 — ports.conf already declares it
bbobrov
committed
4d5a411
Disable Apache default site when TLS is enabled
bbobrov
committed
d0ef107
Move x509 client cert verification from ingress to Apache in passthrough mode
bbobrov
committed
2a8e378
Add ingress.kubernetes.io prefix for ssl-passthrough and backend-protocol
bbobrov
committed
5878e80
Change issuerKind default from DigicertIssuer to ClusterIssuer
bbobrov
committed
4974d01
Enable ssl-passthrough on the ingress-nginx controller
bbobrov
committed
a9ad662
Suppress tls-acme ingress annotation whenever pod-level TLS is enabled
bbobrov
committed
68a5554
Drop Deployment RBAC and --deployment-name from TLS rotation CronJobs
bbobrov
committed
d37516c
Add pluggable key lifecycle configuration with Helm validation
bbobrov
committed
f290ce9
Add internal-k8s-secret storage option and wire --allow-insecure-storage
bbobrov
committed
2b52103
Replace ingress TLS passthrough with direct /32 exposure for Keystone and Barbican

bbobrov
and
rajivmucheli
committed
2770cb6
Announce Keystone TLS /32 via LoadBalancer and Calico BGP
bbobrov
committed
6992d32
Rebuild client-certificate headers for cc_x509 at Apache TLS
bbobrov
committed
989ae9d
Set pod fsGroup so the non-root tls-init can read the TLS Secret
bbobrov
committed
beee4b5
Support non-Calico external IP for Keystone TLS service
bbobrov
committed
847e6b5
Probe served TLS certificate and alert on expiry and stale rotation
bbobrov
committed
cf3f9ca
Replace runtime a2enmod/a2dissite with static Apache config for Keystone
bbobrov
committed
18db635
Add LoadBalancer TLS service, DNS record, and Calico support for Barbican

bbobrov
and
rajivmucheli
committed
6145bbb
Default the TLS service to spec.externalIPs for Keystone and Barbican
bbobrov
committed
8f96fbd
Harden Barbican pod-level TLS and pin the TLS lifecycle image
bbobrov
committed
b102802
Harden Apache TLS ciphers, add HTTP security headers and server hardening
bbobrov
committed
974cd47
Suppress absence alerting on the TLS rotation failure alerts
bbobrov
committed
4ad1bca
Remove non-functional tls-secret-hash pod annotation
bbobrov
committed
821fd30
Include per-tenant SAML config in the TLS vhost
bbobrov
committed
223a500
Require an external IP when pod-level TLS is enabled
bbobrov
committed
d1f52b6
Harden x509 header handling, unify Barbican WSGI group, restore keystone external IP
bbobrov
committed
feeb038
Allow the WebSSO auto-submit script under the Keystone CSP
bbobrov
committed
c638e00
Store the OIDC session in the client cookie for multi-replica keystone
bbobrov
committed
2c4721b
Set the RoleBinding subject namespace for the TLS manager

bbobrov
and
rajivmucheli
committed
08cc497
Gate the apache-sites override on pod-level TLS

bbobrov
and
rajivmucheli
committed
9b03a21
Drop the redundant tls-hardening include from the TLS vhost

bbobrov
and
rajivmucheli
committed
843b7ea
Validate the TLS configuration on every render path

bbobrov
and
rajivmucheli
committed
2867512
Make the TLS rotation schedule configurable

bbobrov
and
rajivmucheli
committed
2cc82fa
Ignore client proxy and trust-key headers on the direct TLS endpoint
bbobrov
committed
bb7b806
Share one WSGI daemon group across the keystone TLS and internal vhosts
bbobrov
committed
0bfd66a
Scope the TLS rotation-failed alert to the latest job
bbobrov
committed
1b9dd35
Drop the broken, out-of-scope SAML assertion-failure alert
bbobrov
committed
dfc2095
Bump chart versions for TLS support
bbobrov
committed
249fa91
Always strip inbound client-cert headers on the TLS endpoint
bbobrov
committed
028a86b

Commits on Sep 7, 2026