validator_operator/validator_helm

[giscus[bot]]

validator_operator/validator_helm

https://docs.sync.global/validator_operator/validator_helm.html

[tomastauber-da]

The current (0.5.8) Helm charts have plaintext networking among pods within a Kubernetes cluster. One can enable mTLS among pods by using the Istio's PeerAuthentication resource:

1. automatically inject the Istio sidecar proxy into any pod created in the validator namespace: kubectl label namespace validator istio-injection=enabled --overwrite (and restart the deployments: kubectl rollout restart deployment -n validator / kubectl rollout restart statefulset -n validator -- after that, there should be more containers per pod).
2. apply a PeerAuthentication policy, e.g.:

cat <<EOF | kubectl apply -f -
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: validator
spec:
  mtls:
    mode: STRICT
EOF