From 058958bf64d14c00e77fd8c695fec49942be6f70 Mon Sep 17 00:00:00 2001 From: Jack Lucas Date: Fri, 31 May 2019 07:54:47 -0400 Subject: Add TLS server support Change-Id: Ic9efe74e6ede2e503ab5b227f259900b0d04d18a Issue-ID: DCAEGEN2-909 Signed-off-by: Jack Lucas --- cm-container/Dockerfile-template | 11 +-------- cm-container/pom.xml | 2 +- cm-container/scripts/configure-tls.sh | 42 +++++++++++++++++++++++++++++++++++ cm-container/scripts/dcae-cleanup.sh | 2 +- k8s-bootstrap-container/.gitignore | 2 +- 5 files changed, 46 insertions(+), 13 deletions(-) create mode 100644 cm-container/scripts/configure-tls.sh diff --git a/cm-container/Dockerfile-template b/cm-container/Dockerfile-template index fbf6ca8..90835cc 100644 --- a/cm-container/Dockerfile-template +++ b/cm-container/Dockerfile-template @@ -33,24 +33,15 @@ RUN scripts/get-type-files.sh ${TYPE_REPO} ${CCSDK_REPO}\ && curl -Ss https://cloudify.co/spec/cloudify/3.4/types.yaml > /opt/manager/resources/spec/cloudify/3.4/types.yaml\ && chown -R cfyuser:cfyuser /opt/manager/resources/spec/cloudify/3.4\ && chmod +x scripts/*.sh\ + && /scripts/configure-tls.sh\ && echo "/scripts/setup-secret.sh" >> /etc/rc.d/rc.local\ && echo "/scripts/set-resolver-rules.sh" >> /etc/rc.d/rc.local\ && chmod +x /etc/rc.d/rc.local # Create mount point for CM config file RUN mkdir -p /opt/onap && chown cfyuser:cfyuser /opt/onap -# For HEAT environment, install software needed to use Cloudify CLI 4.2 to install plugins & deploy blueprints locally -# Install python development-related packages -RUN yum install -y gcc python-devel python-virtualenv python-pip - # Install jq (used for cleanup--parsing output of CM API call) RUN curl -Ss -L "https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64" > /bin/jq \ && chmod +x /bin/jq -# Set up virtualenv and install Cloudify CLI 4.2 -RUN pip install --upgrade pip==9.0.3 \ - && virtualenv cfy42 \ - && source cfy42/bin/activate \ - && pip install cloudify==4.2 - CMD ["/scripts/start-persistent.sh"] diff --git a/cm-container/pom.xml b/cm-container/pom.xml index 7b4d5e3..0a9100f 100644 --- a/cm-container/pom.xml +++ b/cm-container/pom.xml @@ -27,7 +27,7 @@ limitations under the License. org.onap.dcaegen2.deployments cm-container dcaegen2-deployments-cm-container - 1.6.2 + 2.0.0 http://maven.apache.org UTF-8 diff --git a/cm-container/scripts/configure-tls.sh b/cm-container/scripts/configure-tls.sh new file mode 100644 index 0000000..a4b817b --- /dev/null +++ b/cm-container/scripts/configure-tls.sh @@ -0,0 +1,42 @@ +#!/bin/bash +# ============LICENSE_START======================================================= +# org.onap.dcae +# ================================================================================ +# Copyright (c) 2019 AT&T Intellectual Property. All rights reserved. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# ============LICENSE_END========================================================= +# +# Set up configuration files so that CM uses TLS on its external API + +# Change the nginx configuration -- this is what actually makes it work +SSLCONFPATTERN="^include \"/etc/nginx/conf.d/http-external-rest-server.cloudify\"" +SSLCONFREPLACE="include \"/etc/nginx/conf.d/https-external-rest-server.cloudify\"" +sed -i -e "s#${SSLCONFPATTERN}#${SSLCONFREPLACE}#" /etc/nginx/conf.d/cloudify.conf + +# Set certificate and key locations +sed -i -e "s# ssl_certificate .*;# ssl_certificate /opt/onap/certs/cert.pem;#" /etc/nginx/conf.d/https-external-rest-server.cloudify +sed -i -e "s# ssl_certificate_key .*;# ssl_certificate_key /opt/onap/certs/key.pem;#" /etc/nginx/conf.d/https-external-rest-server.cloudify + +# Change the cloudify config file, just to be safe +# Someone might run cfy_manager configure on the CM container for some reason +# and we don't want them to overwrite the TLS configuration +# (Running cfy_manager configure is a bad idea, though, because it often fails.) +sed -i -e "s#^ ssl_enabled: false# ssl_enabled: true#" /etc/cloudify/config.yaml + +# The Cloudify command line tool ('cfy') needs to be configured for TLS as well +# (The readiness check script uses 'cfy status') +sed -i -e "s#^rest_port: 80#rest_port: 443#" /root/.cloudify/profiles/localhost/context +sed -i -e "s/^rest_protocol: http$/rest_protocol: https/" /root/.cloudify/profiles/localhost/context +sed -i -e "s#^rest_certificate: !!python/unicode '/etc/cloudify/ssl/cloudify_external_cert.pem'#rest_certificate: !!python/unicode '/opt/onap/certs/cacert.pem'#" /root/.cloudify/profiles/localhost/context +sed -i -e "s#^manager_ip: !!python/unicode 'localhost'#manager_ip: !!python/unicode 'dcae-cloudify-manager'#" /root/.cloudify/profiles/localhost/context diff --git a/cm-container/scripts/dcae-cleanup.sh b/cm-container/scripts/dcae-cleanup.sh index a9779be..ce5c56b 100755 --- a/cm-container/scripts/dcae-cleanup.sh +++ b/cm-container/scripts/dcae-cleanup.sh @@ -57,6 +57,6 @@ TYPENAMES=[\\\"dcae.nodes.ContainerizedServiceComponent\\\",\\\"dcae.nodes.Conta # # xargs -I lets us run the cfy executions command once for each deployment id extracted by jq -curl -Ss --user admin:$CMPASS -H "Tenant: default_tenant" "localhost/api/v3.1/deployments?_include=id" \ +curl -k -Ss --user admin:$CMPASS -H "Tenant: default_tenant" "https://dcae-cloudify-manager/api/v3.1/deployments?_include=id" \ | /bin/jq .items[].id \ | xargs -I % sh -c "cfy executions start -d % -p '{'\\\"type_names\\\":${TYPENAMES},\\\"operation\\\":\\\"cloudify.interfaces.lifecycle.stop\\\"'}' execute_operation" diff --git a/k8s-bootstrap-container/.gitignore b/k8s-bootstrap-container/.gitignore index d615c60..cf63a5a 100644 --- a/k8s-bootstrap-container/.gitignore +++ b/k8s-bootstrap-container/.gitignore @@ -1,4 +1,4 @@ .project Dockerfile -.vscode/ +.vscode bootstrap-container.code-workspace -- cgit 1.2.3-korg