Following on from struggles with setting up TLS https://discord.com/channels/844600078504951838/1147211541800812609/1147300391285964840 We're using LetsEncrypt to generate our certs, via a k8s cert manager. LetsEncrypt shares some of their certs, but not their keys. https://letsencrypt.org/certificates/ I've tried including their pem keys in a secret under the

tls.crt

key, but I'm either including the wrong data or its failing as I'm not providing a key. Can I continue to use LetsEncrypt whilst enabling TLS for dispatch? What parts of the available info from them should I put where to get Dispatch working with TLS? Thanks for any advice anyone has the time to offer!

you won't be able to use letsencrypt for dispatch without also getting certs signed for the internal dns names - this is probably more headache than it's worth since you're already using cert manager you can create an internal CA that you use for dispatch traffic:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: dispatch-selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: dispatch-ca
  namespace: spicedb
spec:
  isCA: true
  commonName: dev.spicedb   # Change this: the word before the dot is the name of the cluster defined in the SpiceDBCluster object
  dnsNames:
  - dev.spicedb             # Change this
  secretName: dispatch-root-secret
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: dispatch-selfsigned-issuer
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: my-ca-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: dispatch-root-secret

And then you can use it for dispatch:

apiVersion: authzed.com/v1alpha1
kind: SpiceDBCluster
metadata:
  name: dev    
spec:
  config:
    datastoreEngine: postgres    
    replicas:  2    
    tlsSecretName: spicedb-le-tls-demo
    dispatchUpstreamCASecretName: dispatch-root-secret
    dispatchClusterTLSCertPath: "/etc/dispatch/tls.crt"
    dispatchClusterTLSKeyPath: "/etc/dispatch/tls.key"
  secretName: dev-spicedb-config
  patches:
  - kind: Deployment
     patch:  
       spec:
         template:
           spec:
             containers:
             - name: spicedb
               volumeMounts:
               - name: custom-dispatch-tls
                 readOnly: true
                 mountPath: "/etc/dispatch"
             volumes:
             - name: custom-dispatch-tls
               secret:
                 secretName: dispatch-root-secret

awesome, thanks again for your help and thorough answer.

np! yeah that's what the operator assumes by default

when we're all up and running, and I have some time, I'll submit this as an example to the Operator repo. Are there depeer docs for this somewhere I could make some contributions to?

@EvanCorkrean is currently working on some docs for this but they're not yet public

... I'm sorry, I am an idiot. I was following a combination of two examples, and didn't think through what I was setting properly. We want the TLS to terminate at the cluster ingress. The authzed cluster doesn't need the certs. It's still helpful to know how to turn on TLS for dispatch, if we decide to. Thanks for your help and advice, sorry I didn't pick up that I was doing something janky.