summaryrefslogtreecommitdiffstats
path: root/cm-container
diff options
context:
space:
mode:
authorJack Lucas <jflucas@research.att.com>2019-05-31 07:54:47 -0400
committerJack Lucas <jflucas@research.att.com>2019-05-31 17:09:35 -0400
commit058958bf64d14c00e77fd8c695fec49942be6f70 (patch)
treeeab7e6a2d62eb69066ca7541d042e152c2ae3bad /cm-container
parentdab0be7327dffdbfe220c96e265706dc919f6374 (diff)
Add TLS server support
Change-Id: Ic9efe74e6ede2e503ab5b227f259900b0d04d18a Issue-ID: DCAEGEN2-909 Signed-off-by: Jack Lucas <jflucas@research.att.com>
Diffstat (limited to 'cm-container')
-rw-r--r--cm-container/Dockerfile-template11
-rw-r--r--cm-container/pom.xml2
-rw-r--r--cm-container/scripts/configure-tls.sh42
-rwxr-xr-xcm-container/scripts/dcae-cleanup.sh2
4 files changed, 45 insertions, 12 deletions
diff --git a/cm-container/Dockerfile-template b/cm-container/Dockerfile-template
index fbf6ca8..90835cc 100644
--- a/cm-container/Dockerfile-template
+++ b/cm-container/Dockerfile-template
@@ -33,24 +33,15 @@ RUN scripts/get-type-files.sh ${TYPE_REPO} ${CCSDK_REPO}\
&& curl -Ss https://cloudify.co/spec/cloudify/3.4/types.yaml > /opt/manager/resources/spec/cloudify/3.4/types.yaml\
&& chown -R cfyuser:cfyuser /opt/manager/resources/spec/cloudify/3.4\
&& chmod +x scripts/*.sh\
+ && /scripts/configure-tls.sh\
&& echo "/scripts/setup-secret.sh" >> /etc/rc.d/rc.local\
&& echo "/scripts/set-resolver-rules.sh" >> /etc/rc.d/rc.local\
&& chmod +x /etc/rc.d/rc.local
# Create mount point for CM config file
RUN mkdir -p /opt/onap && chown cfyuser:cfyuser /opt/onap
-# For HEAT environment, install software needed to use Cloudify CLI 4.2 to install plugins & deploy blueprints locally
-# Install python development-related packages
-RUN yum install -y gcc python-devel python-virtualenv python-pip
-
# Install jq (used for cleanup--parsing output of CM API call)
RUN curl -Ss -L "https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64" > /bin/jq \
&& chmod +x /bin/jq
-# Set up virtualenv and install Cloudify CLI 4.2
-RUN pip install --upgrade pip==9.0.3 \
- && virtualenv cfy42 \
- && source cfy42/bin/activate \
- && pip install cloudify==4.2
-
CMD ["/scripts/start-persistent.sh"]
diff --git a/cm-container/pom.xml b/cm-container/pom.xml
index 7b4d5e3..0a9100f 100644
--- a/cm-container/pom.xml
+++ b/cm-container/pom.xml
@@ -27,7 +27,7 @@ limitations under the License.
<groupId>org.onap.dcaegen2.deployments</groupId>
<artifactId>cm-container</artifactId>
<name>dcaegen2-deployments-cm-container</name>
- <version>1.6.2</version>
+ <version>2.0.0</version>
<url>http://maven.apache.org</url>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
diff --git a/cm-container/scripts/configure-tls.sh b/cm-container/scripts/configure-tls.sh
new file mode 100644
index 0000000..a4b817b
--- /dev/null
+++ b/cm-container/scripts/configure-tls.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# ============LICENSE_START=======================================================
+# org.onap.dcae
+# ================================================================================
+# Copyright (c) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============LICENSE_END=========================================================
+#
+# Set up configuration files so that CM uses TLS on its external API
+
+# Change the nginx configuration -- this is what actually makes it work
+SSLCONFPATTERN="^include \"/etc/nginx/conf.d/http-external-rest-server.cloudify\""
+SSLCONFREPLACE="include \"/etc/nginx/conf.d/https-external-rest-server.cloudify\""
+sed -i -e "s#${SSLCONFPATTERN}#${SSLCONFREPLACE}#" /etc/nginx/conf.d/cloudify.conf
+
+# Set certificate and key locations
+sed -i -e "s# ssl_certificate .*;# ssl_certificate /opt/onap/certs/cert.pem;#" /etc/nginx/conf.d/https-external-rest-server.cloudify
+sed -i -e "s# ssl_certificate_key .*;# ssl_certificate_key /opt/onap/certs/key.pem;#" /etc/nginx/conf.d/https-external-rest-server.cloudify
+
+# Change the cloudify config file, just to be safe
+# Someone might run cfy_manager configure on the CM container for some reason
+# and we don't want them to overwrite the TLS configuration
+# (Running cfy_manager configure is a bad idea, though, because it often fails.)
+sed -i -e "s#^ ssl_enabled: false# ssl_enabled: true#" /etc/cloudify/config.yaml
+
+# The Cloudify command line tool ('cfy') needs to be configured for TLS as well
+# (The readiness check script uses 'cfy status')
+sed -i -e "s#^rest_port: 80#rest_port: 443#" /root/.cloudify/profiles/localhost/context
+sed -i -e "s/^rest_protocol: http$/rest_protocol: https/" /root/.cloudify/profiles/localhost/context
+sed -i -e "s#^rest_certificate: !!python/unicode '/etc/cloudify/ssl/cloudify_external_cert.pem'#rest_certificate: !!python/unicode '/opt/onap/certs/cacert.pem'#" /root/.cloudify/profiles/localhost/context
+sed -i -e "s#^manager_ip: !!python/unicode 'localhost'#manager_ip: !!python/unicode 'dcae-cloudify-manager'#" /root/.cloudify/profiles/localhost/context
diff --git a/cm-container/scripts/dcae-cleanup.sh b/cm-container/scripts/dcae-cleanup.sh
index a9779be..ce5c56b 100755
--- a/cm-container/scripts/dcae-cleanup.sh
+++ b/cm-container/scripts/dcae-cleanup.sh
@@ -57,6 +57,6 @@ TYPENAMES=[\\\"dcae.nodes.ContainerizedServiceComponent\\\",\\\"dcae.nodes.Conta
#
# xargs -I lets us run the cfy executions command once for each deployment id extracted by jq
-curl -Ss --user admin:$CMPASS -H "Tenant: default_tenant" "localhost/api/v3.1/deployments?_include=id" \
+curl -k -Ss --user admin:$CMPASS -H "Tenant: default_tenant" "https://dcae-cloudify-manager/api/v3.1/deployments?_include=id" \
| /bin/jq .items[].id \
| xargs -I % sh -c "cfy executions start -d % -p '{'\\\"type_names\\\":${TYPENAMES},\\\"operation\\\":\\\"cloudify.interfaces.lifecycle.stop\\\"'}' execute_operation"