Appendix: Advanced Configuration of KubeSphere Core

Helm Chart Options

Common Options

Advanced Options

TLS Configuration

1. Select SSL Configuration

   KubeSphere security configuration includes Ingress SSL Configuration and Internal SSL Configuration. The Ingress SSL Configuration supports three modes by default to enable SSL/TLS for secure access.

   1. Ingress SSL Configuration

      Configuration	Helm Chart Option	Cert-manager Required
      KubeSphere Generated TLS Certificates	ingress.tls.source=generation	No
      Let’s Encrypt	ingress.tls.source=letsEncrypt	Yes
      Import Existing Certificates	ingress.tls.source=importation	No

      • KubeSphere Generated TLS Certificates: Supports both cert-manager and Helm methods.

        • If cert-manager is already installed in the Kubernetes cluster, it is preferred to use cert-manager to generate certificates. KubeSphere uses cert-manager to issue and maintain certificates. KubeSphere generates its CA certificate, signs a certificate using that CA, and then manages the certificate with cert-manager.

        • If cert-manager is not installed, Helm is used to generate certificates. During the installation process with Helm, KubeSphere generates CA and TLS certificates based on the configured hostname. In this option, certificates do not support automatic expiration rotation.

      • Let’s Encrypt

        When using the Let’s Encrypt option, cert-manager must be utilized. In this scenario, cert-manager combines with a special issuer for Let’s Encrypt that performs all actions (including request and validation) necessary for getting a Let’s Encrypt issued cert. This configuration uses HTTP validation (HTTP-01), so the load balancer must have a public DNS record and be accessible from the internet.

      • Import Existing Certificates

        This option allows you to bring your own public- or private-CA signed certificate. KubeSphere will use that certificate to secure websocket and HTTPS traffic. In this case, you must upload this certificate (and associated key) as PEM-encoded files with the name tls.crt and tls.key. If you are using a private CA, you must also upload that certificate. This is due to the fact that this private CA may not be trusted by your nodes.

   2. Internal SSL Configuration

      After enabling internal SSL configuration, both Console UI and Apiserver in KubeSphere will use HTTPS. This configuration inherently supports cert-manager and helm generated certificates. When cert-manager is already installed in the Kubernetes cluster, it is preferred to use cert-manager to generate/manage certificates, and the DNS for certificates defaults to Console UI and Apiserver’s Service DNS within the Kubernetes cluster.

      Configuration	Helm Chart Option	Cert-manager Required
      Enable Internal SSL	internalTLS=true	No

2. Install cert-manager

   If you are using your own certificate files (ingress.tls.source=importation), you can skip this step.

   Only when using KubeSphere-generated certificates (ingress.tls.source=generation) or Let’s Encrypt issued certificates (ingress.tls.source=letsEncrypt), you need to install cert-manager.

   # Add Jetstack Helm repository
   helm repo add jetstack https://charts.jetstack.io
   # Update local Helm Chart repository cache
   helm repo update
   # Install cert-manager Helm Chart
   helm install cert-manager jetstack/cert-manager -n cert-manager --create-namespace --set prometheus.enabled=false
   # Or
   kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/<VERSION>/cert-manager.yaml

   After installing cert-manager, check the running pods in the cert-manager namespace to verify that it has been deployed correctly:

   kubectl get pods --namespace cert-manager

3. Based on your selected certificate option, enable SSL configuration for KubeSphere using Helm.

   1. Enable Ingress SSL Configuration

      • KubeSphere Generated Certificates

        helm upgrade --install -n kubesphere-system --create-namespace ks-core $chart --version $version \
        --set ingress.enabled=true \
        --set hostname=kubesphere.my.org

      • Let’s Encrypt

        This option uses cert-manager to automatically request and renew Let’s Encrypt certificates. Let’s Encrypt is free and a trusted CA, so it can provide valid certificates.

        helm upgrade --install -n kubesphere-system --create-namespace ks-core $chart --version $version \
        --set hostname=kubesphere.my.org \
        --set ingress.enabled=true \
        --set ingress.tls.source=letsEncrypt \
        --set letsEncrypt.email=me@example.org

      • Import External Certificates

        # Import external certificates
        kubectl create secret tls tls-ks-core-ingress --cert=tls.crt --key=tls.key -n kubesphere-system
        # Install KubeSphere
        helm upgrade --install -n kubesphere-system --create-namespace ks-core
        $chart --version $version \
        --set ingress.enabled=true \
        --set hostname=kubesphere.my.org \
        --set ingress.tls.source=importation

   2. Enable Internal SSL Configuration.

      helm upgrade --install -n kubesphere-system --create-namespace ks-core
      $chart --version $version \
      --set internalTLS=true

Configure the ratelimit Limiter

Once the limiter is enabled, it will independently limit requests for all users in KubeSphere, primarily supporting the following two methods:

• Setting a rate limit for all users in KubeSphere, without support for setting individual rate limits for each user at the moment;

• Setting a rate limit independently for each ServiceAccount in KubeSphere.

Enable the Limiter

Enabling the limiter means setting a rate limit for all users in KubeSphere.

1. Modify the kubesphere-system configmap.

   kubectl -n kubesphere-system edit cm kubesphere-system

   Add the following content:

   rateLimit:
     enable: true   # Enable the limiter
     driver: memory # Memory mode
     QPS: 40.0      # Token recovery rate
     burst: 80      # Token bucket capacity

2. Restart the ks-apiserver.

   kubectl -n kubesphere-system rollout restart deploy ks-apiserver

Set the ServiceAccount Limiter

Before setting, you need to enable the limiter as in the previous step. Then execute the following command to set the rate limit for ServiceAccount.

kubectl -n <Namespace> patch serviceaccounts.kubesphere.io <ServiceAccount> --type merge -p '{"metadata": {"annotations": {"kubesphere.io/ratelimiter-qps": "20.0", "kubesphere.io/ratelimiter-burst": "40"}}}'

Parameter Description