Issue with Enabling TLS on weaviate cluster deployed in k8s

Support
1

Description

We have installed weaviate 1.24.3 version on K8s openshift cluster with replicas=3 and and http configuration.

command: ["/bin/weaviate"]
args:
  - '--host'
  - '0.0.0.0'
  - '--port'
  - '8080'
  - '--scheme'
  - 'http'
  - '--config-file'
  - '/weaviate-config/conf.yaml'
  - --read-timeout=60s 
  - --write-timeout=60s

Exposed the service 8080 using istio virtualservice for connect from outside the k8s cluster.

virtualservice name : vectordb-poc.com

Created the TLS certificated signed by our internal CA with CN/SAN names as “vectordb-poc.com”
Copied these private keys and tls certs to all the 3 persistent volumes.

Now tried to enable the TLS configuration as shown below

command: ["/bin/weaviate"]
args:
  - '--tls-host'
  - '0.0.0.0'
  - '--tls-port'
  - '8080'
  - '--scheme'
  - 'https'
  - '--tls-certificate'
  - '/var/lib/weaviate/ssl/tls.pem'
  - '--tls-key'
  - '/var/lib/weaviate/ssl/tls.key'
  - '--config-file'
  - '/weaviate-config/conf.yaml'
  - --read-timeout=60s 
  - --write-timeout=60s

Tried restart of pods but all the pods are failing with below errors

{"action":"config_load","config_file_path":"/weaviate-config/conf.yaml","level":"info","msg":"Usage of the weaviate.conf.json file is deprecated and will be removed in the future. Please use environment variables.","time":"2024-04-29T21:04:57Z"}
{"deprecation":{"apiType":"Configuration","id":"config-files","locations":["--config-file=\"\""],"mitigation":"Configure Weaviate using environment variables.","msg":"use of deprecated command line argument --config-file","sinceTime":"2020-09-08T09:46:00.000Z","sinceVersion":"0.22.16","status":"deprecated"},"level":"warning","msg":"use of deprecated command line argument --config-file","time":"2024-04-29T21:04:57Z"}
{"action":"startup","default_vectorizer_module":"none","level":"info","msg":"the default vectorizer modules is set to \"none\", as a result all new schema classes without an explicit vectorizer setting, will use this vectorizer","time":"2024-04-29T21:04:57Z"}
{"action":"startup","auto_schema_enabled":true,"level":"info","msg":"auto schema enabled setting is set to \"true\"","time":"2024-04-29T21:04:57Z"}
{"action":"cluster_attempt_join","error":"lookup weaviate-headless.vector.svc.cluster.local.: no such host","level":"warning","msg":"specified hostname to join cluster cannot be resolved. This is fineif this is the first node of a new cluster, but problematic otherwise.","remote_hostname":"weaviate-headless.vector.svc.cluster.local.","time":"2024-04-29T21:04:57Z"}
{"level":"info","msg":"No resource limits set, weaviate will use all available memory and CPU. To limit resources, set LIMIT_RESOURCES=true","time":"2024-04-29T21:04:57Z"}
{"action":"startup_check_contextionary","contextionaryVersion":"en0.16.0-v1.2.1","level":"info","msg":"found a valid contextionary version","requiredMinimumContextionaryVersion":"1.0.0","time":"2024-04-29T21:04:58Z"}
{"action":"grpc_startup","level":"info","msg":"grpc server listening at [::]:50051","time":"2024-04-29T21:04:58Z"}
{"action":"restapi_management","level":"info","msg":"Serving weaviate at https://[::]:8080","time":"2024-04-29T21:04:59Z"}
{"action":"telemetry_push","level":"info","msg":"telemetry started","payload":"\u0026{MachineID:207c83d1-f905-45be-b1fe-42f24abfbf58 Type:INIT Version:1.24.3 Modules:backup-s3,text2vec-contextionary NumObjects:0 OS:linux Arch:amd64}","time":"2024-04-29T21:04:59Z"}

@DudaNogueira Any suggestions to fix the above issue.

Thank you very much

~Adithya

2

Hi!

I believe the best approach is to set up an ingress in your k8s and let it to the TLS termination for you :thinking: