Operator TLS

The Dynamo operator can inject TLS configuration into every DynamoGraphDeployment (DGD) pod automatically, so you don’t have to set the DYN_TCP_TLS_* and NATS_TLS_* environment variables on each component. TLS is configured once at the platform level via InfrastructureConfiguration, and the operator propagates the corresponding env vars to all DGD pods it manages.

For the full list of TLS/mTLS environment variables and CLI flags, and for the per-component configuration method, see the TLS reference.

Frontend HTTP TLS

Operator-level TLS settings inject DYN_TCP_TLS_* and NATS_TLS_* for internal transports. They do not inject the frontend’s DYN_TLS_* HTTP settings.

To enable HTTPS or HTTP mTLS, explicitly set DYN_TLS_CERT_PATH, DYN_TLS_KEY_PATH, and, for mTLS, DYN_TLS_CLIENT_CA_CERT_PATH in the frontend container’s podTemplate environment. Mount the server certificate, private key, and trusted client CA at those paths. See the HTTP TLS reference for the configuration requirements.

Operator-level TLS configuration

Set the values in the operator Helm chart. When installing the operator as part of the platform chart, prefix them with dynamo-operator.:

dynamo-operator:
  tcpTLSCertPath: /etc/certs/server/cert.pem
  tcpTLSKeyPath: /etc/certs/server/key.pem
  tcpTLSCAPath: /etc/certs/ca/ca.pem
  # Override the TLS SNI hostname when dialing by IP to a server whose
  # certificate has a DNS SAN (e.g. a *.svc.cluster.local cert).
  tcpTLSServerName: dynamo-worker.dynamo-system.svc.cluster.local
  natsTLSCAPath: /etc/certs/ca/ca.pem
  # NATS TLS requires a tls:// server address — see the note below.
  natsAddr: "tls://dynamo-platform-nats.dynamo-system.svc.cluster.local:4222"

Or pass them via --set during helm install/helm upgrade (platform chart shown; drop the dynamo-operator. prefix if installing the subchart directly):

helm upgrade dynamo-platform ... \
  --set dynamo-operator.tcpTLSCertPath=/etc/certs/server/cert.pem \
  --set dynamo-operator.tcpTLSKeyPath=/etc/certs/server/key.pem \
  --set dynamo-operator.tcpTLSCAPath=/etc/certs/ca/ca.pem \
  --set dynamo-operator.tcpTLSServerName=dynamo-worker.dynamo-system.svc.cluster.local \
  --set dynamo-operator.natsTLSCAPath=/etc/certs/ca/ca.pem \
  --set dynamo-operator.natsAddr=tls://dynamo-platform-nats.dynamo-system.svc.cluster.local:4222

Per-component env vars in podTemplate take precedence over operator-level values when both are set.

Operator-level mTLS configuration

mTLS certificate paths can also be configured at the operator level:

dynamo-operator:
  tcpTLSClientCertPath: /etc/certs/client/cert.pem
  tcpTLSClientKeyPath: /etc/certs/client/key.pem
  tcpTLSClientCAPath: /etc/certs/client-ca/ca.pem
  natsTLSClientCertPath: /etc/certs/client/cert.pem
  natsTLSClientKeyPath: /etc/certs/client/key.pem

The certificates themselves are typically delivered by a certificate management system (such as cert-manager) and mounted into the pods at the paths referenced above. The operator injects the paths (via env vars), not the volumes — the cert files must exist at those paths in every DGD pod.

A common setup is to issue a Certificate with cert-manager, store it in a Kubernetes Secret, and mount that Secret as a volume in the pod template:

spec:
  components:
  - name: Frontend
    podTemplate:
      spec:
        containers:
        - name: main
          volumeMounts:
          - name: tls-server-certs
            mountPath: /etc/certs/server
            readOnly: true
          - name: tls-ca-cert
            mountPath: /etc/certs/ca
            readOnly: true
        volumes:
        - name: tls-server-certs
          secret:
            secretName: dynamo-tls-server
            # cert-manager Secrets use tls.crt / tls.key; map them to the
            # filenames the operator's tcpTLSCertPath / tcpTLSKeyPath point at.
            items:
            - key: tls.crt
              path: cert.pem
            - key: tls.key
              path: key.pem
        - name: tls-ca-cert
          secret:
            secretName: dynamo-tls-ca
            # Mount the CA certificate at the path tcpTLSCAPath / natsTLSCAPath
            # point at (e.g. /etc/certs/ca/ca.pem).
            items:
            - key: ca.crt
              path: ca.pem

This example shows a single component (Frontend); every component that receives the TLS env vars needs the same volume mounts. If you are using the operator’s auto-injection, apply these mounts in each component’s podTemplate.