Skip to content

Commit 1c41333

Browse files
ArsolittArsolitt
committed
refactor(rabbitmq): switch CA and leaf private keys to ECDSA P-256
Replace implicit RSA key generation with explicit ECDSA P-256 for both the CA and leaf Certificates. ECDSA P-256 provides equivalent security with smaller keys and faster TLS handshakes. CA privateKey: algorithm ECDSA, size 256, rotationPolicy Never (unchanged). Leaf privateKey: algorithm ECDSA, size 256, rotationPolicy Always. Also migrate tri-state detection in certmanager.yaml from hasKey+ne nil to the canonical kindIs "invalid" pattern. Assisted-By: Claude <[email protected]> Signed-off-by: Arsolitt <[email protected]>
1 parent 064babd commit 1c41333

2 files changed

Lines changed: 72 additions & 4 deletions

File tree

‎packages/apps/rabbitmq/templates/certmanager.yaml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
{{/*
2-
TLS is active when tls.enabled is explicitly set to a non-null boolean, or when
3-
tls.enabled is absent/null (tri-state default) and external is true.
4-
A null tls.enabled is treated as "inherit from external", not as disabled.
2+
Tri-state TLS resolution: explicit non-null tls.enabled wins; when absent or null,
3+
defaults to external. A null tls.enabled is treated as "inherit from external".
4+
kindIs "invalid" detects both the missing-key and explicit-null cases.
55
*/}}
66
{{- $tlsEnabled := .Values.external }}
7-
{{- if and (hasKey .Values.tls "enabled") (ne .Values.tls.enabled nil) }}
7+
{{- if not (kindIs "invalid" .Values.tls.enabled) }}
88
{{- $tlsEnabled = .Values.tls.enabled }}
99
{{- end }}
1010

@@ -35,6 +35,8 @@ spec:
3535
- cert sign
3636
- crl sign
3737
privateKey:
38+
algorithm: ECDSA
39+
size: 256
3840
# Never rotate the CA private key: rotating the CA key invalidates all
3941
# leaf certs signed by the old key and causes a service outage. CA renewal
4042
# (new certificate, same key) is handled automatically by cert-manager
@@ -91,4 +93,8 @@ spec:
9193
- digital signature
9294
- key encipherment
9395
- server auth
96+
privateKey:
97+
algorithm: ECDSA
98+
size: 256
99+
rotationPolicy: Always
94100
{{- end }}

‎packages/apps/rabbitmq/tests/certmanager_test.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -404,3 +404,65 @@ tests:
404404
tls.bogus_key: true
405405
asserts:
406406
- failedTemplate: {}
407+
408+
# -----------------------------------------------------------------------
409+
# ECDSA: CA and leaf certificates use ECDSA P-256 private keys
410+
# -----------------------------------------------------------------------
411+
412+
- it: CA certificate uses ECDSA algorithm with key size 256
413+
release:
414+
name: myrabbitmq
415+
namespace: tenant-test
416+
set:
417+
tls.enabled: true
418+
external: false
419+
documentIndex: 1
420+
asserts:
421+
- equal:
422+
path: spec.privateKey.algorithm
423+
value: ECDSA
424+
- equal:
425+
path: spec.privateKey.size
426+
value: 256
427+
428+
- it: leaf certificate uses ECDSA algorithm with key size 256
429+
release:
430+
name: myrabbitmq
431+
namespace: tenant-test
432+
set:
433+
tls.enabled: true
434+
external: false
435+
documentIndex: 3
436+
asserts:
437+
- equal:
438+
path: spec.privateKey.algorithm
439+
value: ECDSA
440+
- equal:
441+
path: spec.privateKey.size
442+
value: 256
443+
444+
- it: CA certificate rotationPolicy is Never
445+
release:
446+
name: myrabbitmq
447+
namespace: tenant-test
448+
set:
449+
tls.enabled: true
450+
external: false
451+
documentIndex: 1
452+
asserts:
453+
- equal:
454+
path: spec.privateKey.rotationPolicy
455+
value: Never
456+
457+
- it: leaf certificate rotationPolicy is Always
458+
release:
459+
name: myrabbitmq
460+
namespace: tenant-test
461+
set:
462+
tls.enabled: true
463+
external: false
464+
documentIndex: 3
465+
asserts:
466+
- equal:
467+
path: spec.privateKey.rotationPolicy
468+
value: Always

0 commit comments

Comments
 (0)