# Dgraph TLS with the Dgraph helm charts **URL:** \ **Category:** Dgraph\ **Created:** [February 5, 2021, 2:53am UTC](https://discuss.dgraph.io/t/dgraph-tls-with-the-dgraph-helm-charts/12646 "2021-02-05T02:53:13Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![joaquin](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/joaquin/32/2619_2.png) [@joaquin](https://discuss.dgraph.io/u/joaquin)\ **Post date:** [February 5, 2021, 2:53am UTC](https://discuss.dgraph.io/t/dgraph-tls-with-the-dgraph-helm-charts/12646/1 "2021-02-05T02:53:13Z")
> [@On another topic](https://discuss.dgraph.io/t/12610/6): > > Hello joaquin, > > It worked, Thanks for the support. > > Now, I have to pass tls cert to this cluster… > > Can u tell me the procedure in helm @Thulasidhar-Siva There are a variety of different ways to add TLS and some considerations. First some questions: - Do you need TLS terminated on the endpoint (load balancer) to the client? - Do you need TLS on the Dgraph Alpha service itself? Do you need MutualTLS? - Do you need TLS to secure internal traffic as well, i.e. Zeroes and Alphas? ### General TLS prerequisites If you use a public certificate, you will need to have a registered domain or subdomain. In Kubernetes, you can use a Kubernetes add-on like [external-dns](https://github.com/kubernetes-sigs/external-dns) to automatically add DNS records for Dgraph endpoints. This can configure AWS Route53, Google CloudDNS, and many others. Otherwise, you can use a private certificate. ### TLS terminated at the endpoint On Kubernetes, you can use certificate solutions from the cloud provider or use the Kubernetes add-on cert-manager. - [ACM](https://aws.amazon.com/certificate-manager/) ([AWS Certificate Manager](https://aws.amazon.com/certificate-manager/)) - for use with either service type of `LoadBalancer` configured as Layer 7. - Google Cloud Managed SSL - for use with ingress resource using ingress type of `gce`. - [cert-manager](https://cert-manager.io/docs/) (Kubernetes add-on) for use with ingress resource #### EndPoints with Kubernetes For endpoints with Kubernetes, you want to use either _ **service** _ of `LoadBalancer` type or an _ **ingress** _. These can be used when configuring the option in a Dgraph helm chart configuration file, e.g. `my-values.yaml`: ```bash helm install my-release --values my-values.yaml dgraph/dgraph ``` You want to set `alpha.service.type` to `LoadBalancer`, which will provision a load balancer should your cloud provider supports it. This will have to be a Layer 7 load balancer to support certificates. For example with AWS ELB, you can configure the load balancer to be Layer 7 by supplying the proper annotations to **`alpha.service.annotations`**. On Google Cloud, layer 7 load balancers are only supported with an ingress. For ingress examples, there are some examples in: - [charts/charts/dgraph/example\_values at main · dgraph-io/charts · GitHub](https://github.com/dgraph-io/charts/tree/master/charts/dgraph/example_values) When configuring an endpoint, you will want to secure it. I presented some options for AWS (which will be similar to other cloud providers): - [How can I secure Ratel with Community Edition DGraph? - #2 by MichelDiz - Ratel - Discuss Dgraph](http://discuss.hypermode.com/t/how-can-i-secure-ratel-with-community-edition-dgraph/12625/2) ### TLS added directly to Dgraph services For instructions on securing the Dgraph Alpha service and examples, these are in the Helm Chart instructions for MutualTLS: Here are some links for instructions and examples of configuring TLS for Dgraph Alpha service: - **Docs** : [Overview - Dgraph](https://dgraph.io/docs/deploy/tls-configuration/) - **Dgraph helm chart instructions (mutualTLS)**: [dgraph 25.0.0-preview6 · helm/dgraph](https://artifacthub.io/packages/helm/dgraph/dgraph#alpha-tls-example) - **Dgraph helm chart examples** : [charts/charts/dgraph/example\_values at main · dgraph-io/charts · GitHub](https://github.com/dgraph-io/charts/tree/master/charts/dgraph/example_values) #### Securing internal traffic If you need all traffic, including internal traffic between Dgraph Alpha and Zero nodes, you can find instructions here: - **Docs** : [Overview - Dgraph](https://dgraph.io/docs/deploy/tls-configuration/#using-tls-with-internal-and-external-ports-encrypted) - **Dgraph helm chart instructions** : [dgraph 25.0.0-preview6 · helm/dgraph](https://artifacthub.io/packages/helm/dgraph/dgraph#securing-internal-communication-with-mutual-tls) #### More examples with helmfile I put all this together as an example using [helmfile](https://github.com/roboll/helmfile). The [helmfile](https://github.com/roboll/helmfile) tool is useful in automating helm charts with dynamic values. You can find the example and instructions here: - [charts/helmfiles/mutual\_tls at main · dgraph-io/charts · GitHub](https://github.com/dgraph-io/charts/tree/master/helmfiles/mutual_tls) ---
**Author:** ![Thulasidhar-Siva](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/thulasidhar-siva/32/5932_2.png) [@Thulasidhar-Siva](https://discuss.dgraph.io/u/Thulasidhar-Siva)\ **Post date:** [February 18, 2021, 12:30pm UTC](https://discuss.dgraph.io/t/dgraph-tls-with-the-dgraph-helm-charts/12646/2 "2021-02-18T12:30:16Z")
Hi joaquin, I followed this for my cert generation using scripts. > **[dgraph 0.3.0 · helm/dgraph](https://artifacthub.io/packages/helm/dgraph/dgraph#alpha-tls-example)** > > Dgraph is a horizontally scalable and distributed graph database, providing ACID transactions, consistent replication and linearizable reads. If in that case, from code side how can i add for .Net Client one more issue, is there any chance to pass our own(godady) certificates ---
**Author:** ![joaquin](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/joaquin/32/2619_2.png) [@joaquin](https://discuss.dgraph.io/u/joaquin)\ **Post date:** [February 18, 2021, 9:46pm UTC](https://discuss.dgraph.io/t/dgraph-tls-with-the-dgraph-helm-charts/12646/3 "2021-02-18T21:46:32Z")
Hello @Thulasidhar-Siva, **DotNet Client** On the topic of dotnet clients, there’s documentation here: - [https://dgraph.io/docs/clients/csharp/](https://dgraph.io/docs/clients/csharp/) - [GitHub - dgraph-io/dgraph.net: Official Dgraph .NET Client](https://github.com/dgraph-io/dgraph.net) Even though this says C# in our docs, because this runs on CLR VM (Common Language Runtime), this should work with any language on dotnet platform. **GoDaddy Cert/Key** As far as using external certificates, i.e. GoDaddy. The easiest approach for HTTPS wold be to add the certificate to the load balancer and terminate TLS there. For HTTPS or GRPC (h2) directly to the Dgraph Alpha service w/o terminating at the load balancer, this is how you might be able to do this. You definitely would have to use **`--tls_use_system_ca`** when starting Dgraph Alpha. If you can supply the **`ca.crt`** and \*\*`ca.key **`, and generate the web server cert/key with GoDaddy and save these as** `node.crt` **and** `node.key`**, then this should work. However, if you do not have the **`ca.crt`** and **`ca.key`** (which is understandable, as GoDaddy wouldn’t give this out if it is a public trusted cert/key), then you need to generate cert/key saved as **`node.crt`** and **`node.key`**. You may have to generate a **`ca.crt`** and **`ca.key`** with **`dgraph cert`** command to put in the tls directory, but with **`--tls_use_system_ca`** , Dgraph Alpha will check the against public CA certs/keys like GoDaddy. Lastly, I wanted to mention that the incoming requests with TLS, the client has to use a FQDN that is specified in the certificate or session will be rejected. Thus you will have to make sure than when the client makes a request to the endpoint, the endpoint matches the configured FQDN in the certificate. This can be done when testing out the solution, such as: - A or CNAME record to the endpoint configured in a DNS server - client configuration, e.g. `/etc/hosts`, with the endpoint and desired FQDN - add `Hosts ` in header when making request - **curl** and adding `--resolve :port https://` command line flag ---
**Author:** ![Thulasidhar-Siva](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/thulasidhar-siva/32/5932_2.png) [@Thulasidhar-Siva](https://discuss.dgraph.io/u/Thulasidhar-Siva)\ **Post date:** [February 18, 2021, 9:54pm UTC](https://discuss.dgraph.io/t/dgraph-tls-with-the-dgraph-helm-charts/12646/4 "2021-02-18T21:54:27Z")
Hello @joaquin, When i followed this method: However, if you do not have the **`ca.crt`** and **`ca.key`** (which is understandable, as GoDaddy wouldn’t give this out if it is a public trusted cert/key), then you need to generate cert/key saved as **`node.crt`** and **`node.key`**. You may have to generate a **`ca.crt`** and **`ca.key`** with **`dgraph cert`** command to put in the tls directory, but with **`--tls_use_system_ca`** , Dgraph Alpha will check the against public CA certs/keys like GoDaddy. After rdeploying the helm chart alpha pod is crashing, ![image](https://canada1.discourse-cdn.com/flex007/uploads/dgraph/original/2X/2/2bbbb3bd71e5a49ca8b82320686fadc9adc3c08d.png) Logs of alpha: ![image](https://canada1.discourse-cdn.com/flex007/uploads/dgraph/original/2X/f/f38ad118755f442218088439d12fc2e8d6fe73d1.png) This is what happening, But the same procedure is working fine standalone baremetal. If we deploy using Helm Chart it is the issue. I feel like while in standalone also faced the same issue first the by using this command “update-ca-certificates” issue resolved. But how we need to pass this cmd through the helm. Thanks ---
**Author:** ![Thulasidhar-Siva](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/thulasidhar-siva/32/5932_2.png) [@Thulasidhar-Siva](https://discuss.dgraph.io/u/Thulasidhar-Siva)\ **Post date:** [February 20, 2021, 6:36am UTC](https://discuss.dgraph.io/t/dgraph-tls-with-the-dgraph-helm-charts/12646/5 "2021-02-20T06:36:46Z")
Any one there? @joaquin @MichelDiz Can U please look in to the above issue