---
title: Charmhub | Deploy Canonical Observability Stack Lite using Charmhub - The Open
  Operator Collection
description: Deploy the latest version of Canonical Observability Stack Lite on any
  cloud.
url: https://charmhub.io/cos-lite/docs/explanation/tls
---

##### We've discontinued the registration of new Bundles

New Bundle registrations are no longer accepted. Existing bundles remain functional. We recommend using the Juju Terraform Provider for new deployments.

[Learn more](https://discourse.charmhub.io/t/discontinuing-new-charmhub-bundle-registrations/15344)

# Canonical Observability Stack Lite

[Canonical Observability](https://charmhub.io/publisher/observability "View all packages from Canonical Observability")
| bundle

* [Canonical Observability](https://charmhub.io/publisher/observability "View all packages from Canonical Observability")
  | bundle

Platform:

stable 26

```
juju deploy cos-lite
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://github.com/canonical/cos-lite-bundle)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/cos-lite-bundle/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

---

[Add docs to a charm](https://juju.is/docs/sdk/add-docs-to-your-charmhub-page)

## [TLS](https://charmhub.io/cos-lite/docs/explanation/tls#p-27939-tls)

COS Lite can be deployed unencrypted, with TLS termination only, or end-to-end encrypted.

### [Unencrypted COS Lite](https://charmhub.io/cos-lite/docs/explanation/tls#p-27939-unencrypted-cos-lite)

The [cos-lite bundle](https://charmhub.io/cos-lite) deploys COS with workloads communicating using plain HTTP (unencrypted).

### [TLS-terminated COS Lite](https://charmhub.io/cos-lite/docs/explanation/tls#p-27939-tls-terminated-cos-lite)

The traefik charm can function as a TLS termination point by relating it to an external CA (integrator) charm. Within the COS model, charms would still communicate using plain HTTP (unencrypted).

### [COS Lite with end-to-end TLS](https://charmhub.io/cos-lite/docs/explanation/tls#p-27939-cos-lite-with-end-to-end-tls)

The cos-lite bundle together with the TLS overlay deploy an end-to-end encrypted COS.

* COS charms generate CSRs with the k8s fqdn as the SAN DNS and the internal CA signs.
* All COS charms trust the internal CA by installing the CA certificate in the charm and workload containers, using the `update-ca-certificates` tool.
* The external CA provides a certificate for traefik’s external URL.
* Within the COS model, workloads communicate via k8s fqdn URLs.
* Requests coming from outside of the model, use the ingress URLs.
* Traefik is able to establish a secure connection with its proxied apps thanks to trusting the local CA.

Note: currently there is a [known issue](https://github.com/canonical/operator/issues/970) due to which some COS relations are limited to in-cluster relations only.

The end-to-end COS TLS design is described in the diagram below. The diagram is limited to prometheus and alertmanager for brevity and clarity.

As with any TLS configuration, keep in mind best practices such as frequent certificate rotation. See [this guide](https://charmhub.io/blackbox-exporter-k8s/docs/monitor-ssl-certificates) for an example of monitoring certificates.

---