Canonical Observability Stack Lite
- By Canonical Observability | bundle
Channel | Revision | Published |
---|---|---|
latest/stable | 11 | 21 Oct 2022 |
latest/candidate | 10 | 21 Oct 2022 |
latest/beta | 9 | 21 Oct 2022 |
latest/edge | 18 | 20 Jun 2023 |
1.0/stable | 16 | 21 Oct 2022 |
1.0/candidate | 14 | 21 Oct 2022 |
1.0/beta | 13 | 21 Oct 2022 |
1.0/edge | 12 | 21 Oct 2022 |
juju deploy cos-lite --channel edge
Deploy Kubernetes operators easily with Juju, the Universal Operator Lifecycle Manager. Need a Kubernetes cluster? Install MicroK8s to create a full CNCF-certified Kubernetes system in under 60 seconds.
Platform:
This document provides cryptographic documentation for the COS-Lite bundle. Its purpose is to track the exposure of charm code to cryptographic attack vectors.
What is not included in this document and regarded as out of scope:
- Workload code (refer to the workloads’ cryptographic documentation)
- Data at rest encryption
The COS-Lite charms have a very similar exposure. Unless specified otherwise in the charm’s own documentation, this cryptographic documentation applies to all.
Usage of cryptographic technology
COS-Lite charm code uses cryptographic technology for mainly two purposes:
- enabling TLS communication between their workloads
- securing admin login to their workloads
Cryptographic use internal to cos-lite
COS-Lite charm code can use cryptographic technology to generate a private key to sign their TLS certificate requests. They do so via the tls-certificates-interface which in turn uses the cryptography python library and Juju secrets to exchange data with the CA.
Also, charms that deal with large configuration files use sha256 to efficiently detect diffs in them.
Cryptographic use in how cos-lite communicates externally
COS-Lite charm users use passwords generated by charm code that depends on python’s secrets
module. No configuration is exposed to the user.
These passwords secure admin login to the user-facing server provided by the workload. For example, in grafana-k8s.
Additionally, charms supporting BasicAuth such as traefik accept a <username>:<hashed-password>
config option by which the user can configure basic authentication. The supported hashing algorithm are MD5, SHA1, or BCrypt, as per official documentation. Also following the official guidelines, we recommend cloud admins to use htpasswd
for hashing the password and formatting the configuration string.
List of packages and cryptographic tech used
- to generate private keys for setting up TLS communication: the
rsa.generate_private_key
function from thersa
package. They use the following parameters (hardcoded, not user-configurable):key_size = 2048
public_exponent = 65537
- to generate admin passwords for user admin login: the
secrets
module from the python standard library. See for example: usage in grafana.