Configure FE SSL certificate when deploying via Helm

[aydasraf]

Hello Doris Community,

I am currently deploying a Doris cluster using Helm and need to enable HTTPS for the front end. However, I'm encountering challenges with configuring the SSL certificate keystore.

The Issue:

• Helm Deployment: Deployed Doris using the official Helm chart.
• Objective: Enable HTTPS on the front end.
• Problem: Configuring the SSL certificate keystore is problematic. Using systemInitialization to generate the certificate hasn't been helpful, as the Helm chart does not support mounting an additional volume for the certificate.

My Question:

Has anyone faced a similar situation and found a solution? How did you manage to configure the SSL certificate keystore in a Helm-deployed Doris cluster? Any input, suggestions, or ideas would be highly appreciated.

Thanks in advance for your help!

[catpineapple]

hi, Can you show me how your systemInitialization is configured after removing sensitive information?

[catpineapple]

hi, I want to share two pieces of information:

1. The current operator crd does not have the ability to mount secrets, but this is already planned
2. You can temporarily mount the generated Certificates through the configmap configuration, but I don't think this is a final solution.
   In addition, here are some things that may help you, for reference only : https://github.com/voor/certificate-example

[aydasraf]

Hi @catpineapple ,

Thank you so much for jumping in and adding more info and context, the issue is that as long as we cannot persist the certificate or mount it under the ${DORIS_HOME}/conf/ssl/ no workaround will work, in systemInitialization i create the certificate key store just about like the examples your shared but since the storage layer is not shared with the FE pod, it is unless.

[catpineapple]

Maybe this document can help you: https://doris.apache.org/docs/admin-manual/auth/fe-certificate/

[linux-wizard]

I think one solution could be to use mountConfigMaps to copy the content of the certificate under /opt/apache-doris/fe/conf/ssl

  - configMapName: ssl-certificate
    mountPath: /opt/apache-doris/fe/conf/ssl
    data:
      my.domain.crt: |
         BASE64 encode certificate

this is completly untested, but i do plan to test thisas I do need also SSL support in a kubernetes deployment