Security Considerations

By default all connections between every provided node are secured via TLS by easyrsa, including the etcd cluster.

This page explains the security considerations of a deployed cluster and production recommendations.

Before you begin
Implementation
Limiting ssh access

Before you begin

This page assumes you have a working Juju deployed cluster.

Implementation

The TLS and easyrsa implementations use the following layers.

layer-tls-client layer-easyrsa

Limiting ssh access

By default the administrator can ssh to any deployed node in a cluster. You can mass disable ssh access to the cluster nodes by issuing the following command.

juju model-config proxy-ssh=true

Note: The Juju controller node will still have open ssh access in your cloud, and will be used as a jump host in this case.

Refer to the model management page in the Juju documentation for instructions on how to manage ssh keys.