OVCC: TLS Configuration

This guide covers enabling TLS encryption for inter-cluster cache communication between Cloud Function clients and the Omniverse Content Cache (OVCC) service.

1. Create the TLS Secret

Create a Kubernetes TLS secret with your certificate and key:

kubectl create secret tls tls-secret \
   --cert=tls.crt \
   --key=tls.key \
   --namespace ovcc

Important

The internal service URL MUST be included as a common name on the certificate. For example, if your OVCC installation name is ovcc, the certificate should include ovcc.ovcc.svc.cluster.local.

Self-Signed Certificate (Reference Only)

For testing purposes only, you can create a self-signed certificate using OpenSSL:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
   -keyout tls.key -out tls.crt \
   -subj "/CN=ovcc.ovcc.svc.cluster.local"

Warning

Self-signed certificates should NOT be used in production environments. Use certificates from a trusted Certificate Authority (CA) for production deployments.

2. Enable TLS in values.yaml

After creating the TLS secret, enable TLS in your values.yaml file by adding the TLS configuration under the tls section.

Add the following TLS configuration to your values.yaml:

tls:
  # Enable TLS encryption for inter-cluster communication
  enabled: true
  # Name of the Kubernetes TLS secret created in step 1
  secretName: tls-secret

The enabled: true setting activates TLS encryption for communication between Cloud Function pods and OVCC. The secretName references the Kubernetes secret created in step 1.

Important

This setting controls TLS between Cloud Function pods and OVCC. Upstream TLS is controlled by each backend’s proxyPass; the default cached storage backends use $scheme://$host, and the passthrough backend uses $scheme://$http_host to preserve the incoming scheme and Host port.

3. Complete Example Configuration

Here is a complete example showing TLS configuration within a typical OVCC values.yaml:

replicaCount: 3

image:
  pullSecrets:

    - name: ngc-container-pull

fullnameOverride: ovcc

service:
  cache:
    type: ClusterIP
    port: 14128
    containerPort: 14128
  nucleus:
    type: ClusterIP
    port: 14129
    containerPort: 14129

tls:
  enabled: true
  secretName: ovcontentcache-tls

persistence:
  storageClassName: "gp3"
  volumes:

    - name: az
      path: /proxy_cache_az
      sizeGi: 50
      minFreeSizePercentage: 7

    - name: s3
      path: /proxy_cache_s3
      sizeGi: 50
      minFreeSizePercentage: 7

    - name: nucleus
      path: /proxy_cache_nucleus
      sizeGi: 50
      minFreeSizePercentage: 7

nginx:
  workerConnections: 1024
  proxyCache:
    validity:
      "200": "1d"
      "206": "1d"
    paths:

      - name: az
        path: /proxy_cache_az/data
        maxIdleTime: 1d
        metadataMemorySize: 10m

      - name: s3
        path: /proxy_cache_s3/data
        maxIdleTime: 1d
        metadataMemorySize: 10m

      - name: nucleus
        path: /proxy_cache_nucleus/data
        maxIdleTime: 1d
        metadataMemorySize: 10m
  sharedMemory:
    limits:
      presignedUrlCache: "1024m"
      lockByRequestUriTable: "1024m"
  backends:
    passthrough:
      allowCacheReset: false
      proxyPass: $scheme://$http_host
      allowHttp2Clients: true
    azure:
      include: true
      allowCacheReset: false
      serverName: ~^(?<container_name>[^\.]+)\.blob\.core\.windows\.net$
      proxyCacheName: az
      proxyPass: $scheme://$host
      proxyAuthPass: $scheme://$host
      burstyCache:
        ttlSec: 30
    s3:
      include: true
      allowCacheReset: false
      serverName: ~^[^.]+\.s3\.[^.]+\.amazonaws\.com$
      proxyCacheName: s3
      proxyPass: $scheme://$host
      proxyAuthPass: $scheme://$host
      burstyCache:
        ttlSec: 30
    # If you do not use GCS, keep this disabled.
    gcs:
      include: false
    nucleus:
      allowCacheReset: true
      serverName: _
      proxyCacheName: nucleus
      proxyPass: $scheme://$host
      proxyAuthPass: null

metrics:
  prometheus:
    enabled: true
    port: 9145
    serviceMonitor:
      enabled: false

4. Apply Configuration Changes

After updating your values.yaml file with TLS configuration, apply the changes using Helm:

helm upgrade ovcc omniverse/ovcontentcache \
    --version 4.0.4 \
    --namespace ovcc \
    -f values.yaml

If you are installing OVCC for the first time with TLS enabled:

helm install ovcc omniverse/ovcontentcache \
    --version 4.0.4 \
    --namespace ovcc \
    -f values.yaml

5. Verify TLS Configuration

After applying the configuration, verify that TLS is enabled:

# Check that the TLS secret is mounted in the pod
kubectl describe pod -n ovcc -l app.kubernetes.io/instance=ovcc | grep -A 5 "Mounts:"

# Verify the pod is running successfully
kubectl get pods -n ovcc -l app.kubernetes.io/instance=ovcc

# Check service endpoints
kubectl get svc -n ovcc -l app.kubernetes.io/instance=ovcc

The TLS secret should be mounted in the pod, and the pod should be running without errors. The service should be configured to use HTTPS on port 14128 when TLS is enabled.

Summary

After enabling TLS, ensure that client applications are configured to use TLS when connecting to OVCC.