TLS Transport Encryption

TLS client connection encryption is enabled by default for all MSSQLInstance and MSSQLAvailabilityGroup resources.

Configuration

spec:
  tls:
    enabled: true          # default true — set to false to disable
    forceEncryption: true  # default true — require all clients to use TLS
    # certificateSecret: my-tls-certs  # omit to auto-generate

Auto-generated certificates

When certificateSecret is not set, the operator automatically:

1. Generates a self-signed CA (ECDSA P-256, ~10-year validity)
2. Issues a server certificate signed by that CA, with SANs covering:
   • *.<cr-name>.<namespace>.svc.cluster.local (all pod DNS names)
   • <cr-name>.<namespace>.svc.cluster.local (headless service)
   • <cr-name>-exposed.<namespace>.svc.cluster.local (exposed service)
   • <cr-name>, <cr-name>-exposed, localhost
3. Stores the result in a Secret named <cr-name>-tls-certs with keys tls.crt, tls.key, ca.crt

Bring your own certificate

Set certificateSecret to the name of a Secret you manage:

spec:
  tls:
    certificateSecret: my-tls-certs

The Secret must contain:

Key	Description
tls.crt	PEM-encoded server certificate
tls.key	PEM-encoded private key
ca.crt	Optional. PEM-encoded CA certificate

When switching from auto-generated to user-provided, the operator deletes the old auto-generated Secret automatically.

How it works

The operator creates a ConfigMap (<cr-name>-mssql-conf) containing a mssql.conf file:

[network]
tlscert = /etc/mssql-tls/tls.crt
tlskey  = /etc/mssql-tls/tls.key
tlsprotocols = 1.2
forceencryption = 1

This ConfigMap is mounted via SubPath into the container at /var/opt/mssql/mssql.conf. The TLS Secret is mounted at /etc/mssql-tls/.

Certificate rotation

The operator tracks a hash of the TLS Secret data in a pod annotation (mssql.solanica.io/tls-cert-hash). When you update the Secret content, the hash changes, the pod template spec differs, and Kubernetes performs a rolling restart — SQL Server loads the new certificate on startup.

Steps to rotate:

1. Update the Secret data with the new tls.crt and tls.key
2. The operator detects the hash change on the next reconcile and performs a rolling restart automatically

No manual steps required for TLS transport cert rotation.

Disabling TLS

For development or testing environments:

spec:
  tls:
    enabled: false

When disabled, the operator removes the auto-generated TLS Secret and ConfigMap, and the StatefulSet is updated without TLS mounts.