docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Lockdown CA (CFSSL) with mutual TLS 

This change re-wires the way we have CFSSL hooked up so
that it requires mutual TLS to access the service.

Instead of using command line arguments, and thus relying on environment
variables from linking, this change also switches to registering the
CAs via KV store entries.

The current CFSSL implementation does not support mutual TLS natively,
so I've leveraged socat and a proxy container (much like we do for
docker) in the interest of expediency.  (so under the covers it's still
a link between cfss and the proxy.) Once upstream supports mutual TLS
(or if we decide to fork/patch it) we can drop the proxy and eliminate
all the links.
This commit is contained in:
Daniel Hiltgen 2015-10-27 16:00:12 -07:00 committed by Joao Fernandes
parent 3d1dcd3672
commit c0912ad303
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
install-beta.md
View File

@ -61,6 +61,8 @@ Orca includes Docker Swarm as part of its installation. So, you don't need to in
| `2376` | Swarm manager | | `2376` | Swarm manager |
| `12376` | Engine proxy | | `12376` | Engine proxy |
| `12379`, `12380` | Key Value store | | `12379`, `12380` | Key Value store |
| `12381` | Swarm CA service|
| `12382` | Orca CA service |
The communication between the server, nodes, and key value store is all protected by mutual TLS. The Orca installation of Swarm provides TLS for you automatically. The communication between the server, nodes, and key value store is all protected by mutual TLS. The Orca installation of Swarm provides TLS for you automatically.
@ -129,6 +131,8 @@ If you choose this option, create your volumes prior to installing Orca. The vol
| `orca-swarm-root-ca` | The certificate and key for the Swarm root CA. | | `orca-swarm-root-ca` | The certificate and key for the Swarm root CA. |
| `orca-server-certs` | The server certificates for the Orca web server. | | `orca-server-certs` | The server certificates for the Orca web server. |
| `orca-swarm-node-certs` | The Swarm certificates for the current node (repeated on every node in the cluster). | | `orca-swarm-node-certs` | The Swarm certificates for the current node (repeated on every node in the cluster). |
| `orca-swarm-kv-certs` | The Swarm KV client certificates for the current node (repeated on every node in the cluster). |
| `orca-swarm-controller-certs` | The Orca Controller Swarm client certificates for the current node. |
| `orca-config` | Orca server configuration settings (ID, locations of key services). | | `orca-config` | Orca server configuration settings (ID, locations of key services). |
| `orca-kv` | Key value store persistence. | | `orca-kv` | Key value store persistence. |

5
quickstart.md
View File

@ -15,7 +15,8 @@ running quickly, so lets dive right in!
* Orca Server: 443 * Orca Server: 443
* Swarm Manager: 2376 (user configurable) - Protected via mutual TLS * Swarm Manager: 2376 (user configurable) - Protected via mutual TLS
* Engine Proxy: 12376 - Protected via mutual TLS * Engine Proxy: 12376 - Protected via mutual TLS
* KV Store: 12379, 12380 - Will be protected by mutual TLS soon * KV Store: 12379, 12380 - Protected by mutual TLS
* CAs: 12381, 12382 - Protected by mutual TLS
# Initial Installation # Initial Installation
@ -52,6 +53,8 @@ can pre-create volumes prior to installing Orca.
* **orca-swarm-root-ca** - The certificate and key for the Swarm Root CA * **orca-swarm-root-ca** - The certificate and key for the Swarm Root CA
* **orca-server-certs** - The server certificates for the Orca web server * **orca-server-certs** - The server certificates for the Orca web server
* **orca-swarm-node-certs** - The swarm certificates for the current node (repeated on every node in the cluster) * **orca-swarm-node-certs** - The swarm certificates for the current node (repeated on every node in the cluster)
* **orca-swarm-kv-certs** The Swarm KV client certificates for the current node (repeated on every node in the cluster)
* **orca-swarm-controller-certs** The Orca Controller Swarm client certificates for the current node
* **orca-config** - Orca server configuration settings (ID, locations of key services) * **orca-config** - Orca server configuration settings (ID, locations of key services)
* **orca-kv** - KV store persistence * **orca-kv** - KV store persistence