Exposing Relic

The relic Service serves HTTPS on port 443, or HTTP on port 80 with tls.enabled: false. Clients need one host name that serves every path.

The server's certificate

By default each server pod generates its own certificate authority (TLS). A single node keeps it on the data volume. With several replicas each pod has its own, and it changes on restart.

For clients that verify the server, set tls.existingSecret to a kubernetes.io/tls Secret. The chart mounts it at /etc/relic/tls. Relic reloads a renewed certificate without a restart, so cert-manager works well. This Certificate covers the Service's names and the public host name:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: relic-server-tls
  namespace: relic
spec:
  secretName: relic-server-tls
  privateKey:
    algorithm: ECDSA
    size: 384
  dnsNames:
    - relic
    - relic.relic
    - relic.relic.svc
    - relic.relic.svc.cluster.local
    - relic.example.com
  issuerRef:
    kind: ClusterIssuer
    name: internal-ca

Create it from certificate.yaml:

kubectl apply -f certificate.yaml

Then point the chart at the Secret:

tls:
  existingSecret: relic-server-tls

The generated certificate holds the Service's names and the ingress hosts. tls.hostnames adds more.

Ingress with TLS

ingress:
  enabled: true
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
  hosts:
    - host: relic.example.com
  tls:
    - hosts: [relic.example.com]
      secretName: relic-tls

Remove or raise the controller's body size limit, or large uploads fail.

While tls.enabled is on, the chart adds nginx.ingress.kubernetes.io/backend-protocol: HTTPS unless you set it. Other controllers need an HTTPS backend configured their own way, or tls.enabled: false.

Relic trusts X-Forwarded-* headers only from trustedProxies. Narrow it to the ingress controller's pod CIDR.

NodePort

service:
  type: NodePort
  nodePort: 30880

Relic is then at https://<node-ip>:30880. Without nodePort, Kubernetes picks the port. Add the node's address to tls.hostnames or to your certificate.

LoadBalancer

service:
  type: LoadBalancer

Give it a trusted certificate with tls.existingSecret. To terminate TLS in a proxy instead, set tls.enabled: false and add the proxy to trustedProxies.

Network policy

networkPolicy.allowServerAccessFrom lists the peers that can reach the server; empty admits everyone. Include the ingress controller's namespace:

networkPolicy:
  allowServerAccessFrom:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: ingress-nginx

See Hardening.