Running Crowd over HTTPS

[Richard Sylvester]

Hi Guys,

I have Crowd running in Kubernetes (installed via Helm). Is anyone able to give me step-by-step instructions on getting it running over HTTPS? I have already got a signed certificate to import. 

Thanks in advance.

[Yevhen]

https://atlassian.github.io/data-center-helm-charts/userguide/CONFIGURATION/#ingress all you need is to create an ingress, ie enable it in your helm values.

[Tomislav Tobijas]

Hi @Richard Sylvester ,

I never actually did this, but I managed to find the following:

Terminate SSL at the Ingress Controller (might be recommended)

• The best practice is to terminate SSL at your Kubernetes Ingress (e.g., NGINX, AWS ALB). This means HTTPS is handled at the edge, and traffic inside the cluster is HTTP.

• Store your signed certificate as a Kubernetes Secret.

• Configure your Ingress resource to use this Secret for TLS termination.

• This approach is simpler and easier to maintain

---

And if you need HTTPS directly in the Crowd Pod...

Option 1: Pre-Built Java Truststore as a Kubernetes Secret (Recommended)

• On your workstation, import your signed certificate into a Java keystore:

  keytool -import -trustcacerts -alias mycert -file /path/to/your.crt -keystore keystore.jks -storepass <password>

• Create a Kubernetes Secret from the keystore:

  kubectl create secret generic crowd-keystore --from-file=keystore.jks=/path/to/keystore.jks -n <namespace>

• In your Helm values, mount the Secret and set JVM arguments:

  volumes:
    - name: crowd-keystore
      secret:
        secretName: crowd-keystore
  volumeMounts:
    - name: crowd-keystore
      mountPath: /var/opt/crowd-keystore
      readOnly: true
  env:
    - name: JVM_SUPPORT_RECOMMENDED_ARGS
      value: "-Djavax.net.ssl.trustStore=/var/opt/crowd-keystore/keystore.jks -Djavax.net.ssl.trustStorePassword=<password>"

• Update Crowd’s configuration (e.g., server.xml) to enable HTTPS and point to your keystore.

Option 2: Dynamic Truststore Generation Using an Init Container

• Store your certificate as a Kubernetes Secret.

• Use an init container to import the certificate into a new keystore at pod startup.

• Mount the generated keystore and set JVM arguments as above.

Option 3: Custom Docker Image

• Build a custom Crowd image with your certificate imported into the Java truststore during the build process.

• Use this image in your Helm deployment.

But I've never actually executed this. Been a while since I've played with server configs and SSLs (can't say I miss it that much) 😅

Hopefully, someone actually did configure it, so maybe they can provide some additional details.

Cheers,
Tobi

[Richard Sylvester]

Thanks for this @Tomislav Tobijas , I should have mentioned I am using Nginx as the ingress controller, so I'll try terminating at the ingress level first and then Option 1 if that doesn't work. Will let you know how I get on.

[Richard Sylvester]

I assume this process would be the same for Jira, Confluence etc?

[Tomislav Tobijas]

@Richard Sylvester yeah, these should also be recommended for Jira, Confluence, and other DC products deployed in Kubernetes.

This might help as well: Load balancer configuration options