The installation example Installation of CloudBees Previews with TLS enabled uses a single domain and TLS secret. In the example, the CloudBees Previews webhook component uses the hostname webhook.previews.acme.com. The wildcard certificate copied to the environment namespace covers *.previews.acme.com. This can create a conflict with the user’s Kubernetes resources and gives the created preview environment access to the single global TLS secret creating a potential security risk.
A more secure configuration is to use independent domains and TLS secrets for the CloudBees system components and preview environments.
Installation of CloudBees Previews with TLS and separated domains
export system_ingress_host=previews.acme.com export system_tls_secret_name=preview-system-cert-secret export system_ingress_class=nginx export environment_ingress_host=environment.${system_ingress_host} export environment_tls_secret_name=acme-wildcard-cert-secret export environment_ingress_class=nginx kubectl create namespace previews kubectl create secret generic --namespace previews license \ --from-file=cert=cloudbees-ci-license.cert \ --from-file=key=cloudbees-ci-license.key kubectl create secret tls --namespace previews ${system_tls_secret_name} \ --cert=system-tls.cert --key=system-tls.key kubectl create secret tls --namespace previews ${environment_tls_secret_name} \ --cert=environment-tls.cert --key=environment-tls.key helm install --namespace previews previews cloudbees/cloudbees-previews -f - <<EOF global: license: secret: license analytics: enabled: true ingress: class: ${system_ingress_class} (1) tlsSecret: ${system_tls_secret_name} (2) webhook: ingress: host: webhook.${system_ingress_host} (3) apiserver: ingress: host: api.${system_ingress_host} (4) environments: ingress: class: ${environment_ingress_class} (5) host: ${environment_ingress_host} (6) tlsSecret: ${environment_tls_secret_name} (7) EOF
| 1 | Specifies the IngressController class used for all Ingresses, by default. |
| 2 | Specifies the name of a Secret containing the TLS certificate and private key for webhook.previews.acme.com and api.previews.acme.com. |
| 3 | Specifies the SCM webhook component’s hostname. |
| 4 | Specifies the API server component’s hostname. |
| 5 | Specifies the IngressController class, in case it differs from the global IngressController. |
| 6 | Specifies the domain used for environment ingresses. |
| 7 | Specifies the name of a Secret containing the wildcard TLS certificate and private key for *.environment.previews.acme.com. |