Install Typha

    We will use mutually authenticated TLS to ensure that calico/node and Typha communicate securely. In this section, we generate a certificate authority (CA) and use it to sign a certificate for Typha.

    Create the CA certificate and key

    Store the CA certificate in a ConfigMap that Typha & calico/node will access.

    1. kubectl create configmap -n kube-system calico-typha-ca --from-file=typhaca.crt

    Create the Typha key and certificate signing request (CSR)

    1. openssl req -newkey rsa:4096 \
    2.            -keyout typha.key \
    3.            -nodes \
    4.            -out typha.csr \
    5.            -subj "/CN=calico-typha"

    The certificate presents the Common Name (CN) as calico-typha. calico/node will be configured to verify this name.

    1. openssl x509 -req -in typha.csr \
    2.                   -CA typhaca.crt \
    3.                   -CAkey typhaca.key \
    4.                   -CAcreateserial \
    5.                   -out typha.crt \
    6.                   -days 365

    Store the Typha key and certificate in a secret that Typha will access

    Create a ServiceAccount that will be used to run Typha.

    1. kubectl create serviceaccount -n kube-system calico-typha

    Define a cluster role for Typha with permission to watch Calico datastore objects.

    1. kubectl apply -f - <<EOF
    2. kind: ClusterRole
    3. apiVersion: rbac.authorization.k8s.io/v1
    4. metadata:
    5.   name: calico-typha
    6. rules:
    7.   - apiGroups: [""]
    8.     resources:
    9.       - pods
    10.       - namespaces
    11.       - serviceaccounts
    12.       - endpoints
    13.       - services
    14.       - nodes
    15.     verbs:
    16.       # Used to discover service IPs for advertisement.
    17.       - watch
    18.       - list
    19.   - apiGroups: ["networking.k8s.io"]
    20.     resources:
    21.       - networkpolicies
    22.       - watch
    23.       - list
    25.     resources:
    26.       - globalfelixconfigs
    27.       - felixconfigurations
    28.       - bgppeers
    29.       - globalbgpconfigs
    30.       - bgpconfigurations
    31.       - ippools
    32.       - ipamblocks
    33.       - globalnetworkpolicies
    34.       - globalnetworksets
    35.       - networkpolicies
    36.       - clusterinformations
    37.       - hostendpoints
    38.       - blockaffinities
    39.       - networksets
    40.     verbs:
    41.       - get
    42.       - list
    43.       - watch
    44.   - apiGroups: ["crd.projectcalico.org"]
    45.     resources:
    46.       #- ippools
    47.       #- felixconfigurations
    48.       - clusterinformations
    49.     verbs:
    50.       - get
    51.       - create
    52.       - update
    53. EOF

    Bind the cluster role to the calico-typha ServiceAccount.

    1. kubectl create clusterrolebinding calico-typha --clusterrole=calico-typha --serviceaccount=kube-system:calico-typha

    Since Typha is required by calico/node, and calico/node establishes the pod network, we run Typha as a host networked pod to avoid a chicken-and-egg problem. We run 3 replicas of Typha so that even during a rolling update, a single failure does not make Typha unavailable.

    Verify Typha is up an running with three instances

    1. kubectl get pods -l k8s-app=calico-typha -n kube-system

    Result:

    1. NAME                            READY   STATUS    RESTARTS   AGE
    2. calico-typha-66498ddfbd-2pzsr   1/1     Running   0          69s
    3. calico-typha-66498ddfbd-lrtzw   1/1     Running   0          50s
    4. calico-typha-66498ddfbd-scckd   1/1     Running   0          62s

    uses a Kubernetes Service to get load-balanced access to Typha.

    1. kubectl apply -f - <<EOF
    2. kind: Service
    3. metadata:
    4.   name: calico-typha
    5.   namespace: kube-system
    6.   labels:
    7.     k8s-app: calico-typha
    8. spec:
    9.   ports:
    10.     - port: 5473
    11.       protocol: TCP
    12.       targetPort: calico-typha
    13.       name: calico-typha
    14.   selector:
    15.     k8s-app: calico-typha
    16. EOF

    Validate that Typha is using TLS.

    Result

    1. * Rebuilt URL to: https://10.103.120.116:5473/
    2. *   Trying 10.103.120.116...
    3. * TCP_NODELAY set
    4. * Connected to 10.103.120.116 (10.103.120.116) port 5473 (#0)
    5. * ALPN, offering h2
    6. * ALPN, offering http/1.1
    7. * successfully set certificate verify locations:
    8. *   CAfile: typhaca.crt
    9.   CApath: /etc/ssl/certs
    10. * (304) (OUT), TLS handshake, Client hello (1):
    11. * (304) (IN), TLS handshake, Server hello (2):
    12. * TLSv1.2 (IN), TLS handshake, Certificate (11):
    13. * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
    14. * TLSv1.2 (IN), TLS handshake, Request CERT (13):
    15. * TLSv1.2 (IN), TLS handshake, Server finished (14):
    16. * TLSv1.2 (OUT), TLS handshake, Certificate (11):
    17. * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
    18. * TLSv1.2 (OUT), TLS change cipher, Client hello (1):
    19. * TLSv1.2 (OUT), TLS handshake, Finished (20):
    20. * TLSv1.2 (IN), TLS alert, Server hello (2):
    21. * error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
    22. * stopped the pause stream!
    23. * Closing connection 0
    24. curl: (35) error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate