Look into OpenShift `routes` support about chainloop HOT 4 CLOSED

I think this article can help (I'm trying to get it working) :
https://www.redhat.com/en/blog/grpc-or-http/2-ingress-connectivity-in-openshift

from chainloop.

Thanks @hanygirgis for the pointer.

It seems that with H/A proxy we'll have the problem we had with AWS ALB or Google Load Balancer, basically for the gRPC endpoint, we are going to need http2 and TLS termination in the pod.

TLS encryption is doable today in the control-plane and CAS pods, you can provide them using these options in the Helm Chart

This will run the gRPC servers with tls enabled, next, I'd set the cert in the route and enable re-encryption

from chainloop.

and secured routes https://docs.openshift.com/container-platform/4.8/networking/routes/secured-routes.html#nw-ingress-creating-a-passthrough-route_secured-routes

from chainloop.

We do support the three kinds of routes, edges, reencrypt and passthrough

The latter two can be enabled with a combination of a) setting server certs for CAS and Controlplane

cas:
  tlsConfig:
    secret:
      name: custom-cert
controlplane:
  tlsConfig:
    secret:
      name: custom-cert
****

and b) adding custom CAs for CP -> CAS communication.

  auth:
    oidc:
      customCAs:
        - |- 
          -----BEGIN CERTIFICATE-----

both of those can be performed via the Helm Chart values.yaml file.

For passthrough, the CLI now supports receiving a custom CA as well to verify the self-signed cert loaded in the pods #1017

from chainloop.