[AAF] Add CMPv2 Cert Service

This new micro service allow retrieval of certificates using CMPv2
protocol and relay the requests to CA server (such as EJBCA provided in
contrib folder).

Issue-ID: AAF-1083
Change-Id: Ib3acba3d071533ad933d043f067147e8406d8fa8
Signed-off-by: EmmettCox <emmett.cox@est.tech>
Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
(cherry picked from commit bca68e048a74ac3754e76ed738090402f7cbfd13)

3 files changed, 196 insertions, 0 deletions

diff --git a/kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml b/kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml
new file mode 100644
index 0000000000..76e610f169
--- /dev/null
+++ b/kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml
@@ -0,0 +1,123 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if .Values.global.cmpv2Enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata: {{- include "common.resourceMetadata" . | nindent 2 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector: {{- include "common.selectors" . | nindent 4 }}
+  template:
+    metadata: {{- include "common.templateMetadata" . | nindent 6 }}
+    spec:
+      volumes:
+{{- if .Values.global.addTestingComponents }}
+        - name: cmp-servers-template-volume
+          secret:
+            secretName: {{ .Values.cmpServers.secret.name }}
+        - name: {{ .Values.cmpServers.volume.name }}
+          emptyDir:
+            medium: Memory
+{{- else }}
+        - name: {{ .Values.cmpServers.volume.name }}
+          secret:
+            secretName: {{ .Values.cmpServers.secret.name }}
+{{- end }}
+        - name: {{ .Values.tls.server.volume.name }}
+          secret:
+            secretName: {{ .Values.tls.server.secret.name }}
+{{- if .Values.global.addTestingComponents }}
+      initContainers:
+        - name: wait-for-ejbca
+          command:
+          - /root/ready.py
+          args:
+          - --container-name
+          - ejbca-ejbca
+          env:
+          - name: NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        - name: subsitute-envs
+          image: "{{ .Values.global.envsubstImage }}"
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          command: ['sh', '-c', "cd /config-input &&  envsubst < cmpServers.json > {{ .Values.cmpServers.volume.mountPath }}/cmpServers.json"]
+          volumeMounts:
+            - name: cmp-servers-template-volume
+              mountPath: /config-input
+              readOnly: true
+            - name: {{ .Values.cmpServers.volume.name }}
+              mountPath: {{ .Values.cmpServers.volume.mountPath }}
+              readOnly: false
+          env:
+            - name: CLIENT_IAK
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ejbca-server-client-iak" "key" "password") | indent 14 }}
+            - name: CLIENT_RV
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cmp-config-client-rv" "key" "password") | indent 14 }}
+            - name: RA_IAK
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ejbca-server-ra-iak" "key" "password") | indent 14 }}
+            - name: RA_RV
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cmp-config-ra-rv" "key" "password") | indent 14 }}
+{{- end }}
+      containers:
+        - name: {{ include "common.name" . }}
+          image: {{ .Values.repository }}/{{ .Values.image }}
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          ports: {{ include "common.containerPorts" . | nindent 10 }}
+          env:
+            - name: HTTPS_PORT
+              value: "{{ .Values.envs.httpsPort }}"
+            - name: KEYSTORE_PATH
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.jksName }}"
+            - name: KEYSTORE_P12_PATH
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.p12Name }}"
+            - name: TRUSTSTORE_PATH
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.jksName }}"
+            - name: ROOT_CERT
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.crtName }}"
+            - name: KEYSTORE_PASSWORD
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keystore-password" "key" "password") | indent 14 }}
+            - name: TRUSTSTORE_PASSWORD
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "truststore-password" "key" "password") | indent 14 }}
+          livenessProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -c
+                - {{ .Values.liveness.command }}
+            initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.liveness.periodSeconds }}
+          readinessProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -c
+                - {{ .Values.readiness.command }}
+            initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readiness.periodSeconds }}
+          volumeMounts:
+            - name: {{ .Values.cmpServers.volume.name }}
+              mountPath: {{ .Values.cmpServers.volume.mountPath }}
+              readOnly: false
+            - name: {{ .Values.tls.server.volume.name }}
+              mountPath: {{ .Values.tls.server.volume.mountPath }}
+              readOnly: true
+          resources: {{ include "common.resources" . | nindent 12 }}
+{{ end -}}
diff --git a/kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml b/kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml
new file mode 100644
index 0000000000..ac92f56487
--- /dev/null
+++ b/kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml
@@ -0,0 +1,56 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if .Values.global.cmpv2Enabled }}
+{{ include "common.secretFast" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.cmpServers.secret.name }}
+type: Opaque
+data:
+{{ if .Values.global.addTestingComponents }}
+  {{ (.Files.Glob "resources/test/cmpServers.json").AsSecrets }}
+{{ else }}
+  {{ (.Files.Glob "resources/default/cmpServers.json").AsSecrets }}
+{{ end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.global.aaf.certServiceClient.secret.name | default .Values.tls.client.secret.defaultName }}
+type: Opaque
+data:
+  certServiceClient-keystore.jks:
+  {{ (.Files.Glob "resources/certServiceClient-keystore.jks").AsSecrets }}
+  truststore.jks:
+  {{ (.Files.Glob "resources/truststore.jks").AsSecrets }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.tls.server.secret.name }}
+type: Opaque
+data:
+  certServiceServer-keystore.jks:
+  {{ (.Files.Glob "resources/certServiceServer-keystore.jks").AsSecrets }}
+  certServiceServer-keystore.p12:
+  {{ (.Files.Glob "resources/certServiceServer-keystore.p12").AsSecrets }}
+  truststore.jks:
+  {{ (.Files.Glob "resources/truststore.jks").AsSecrets }}
+  root.crt:
+  {{ (.Files.Glob "resources/root.crt").AsSecrets }}
+{{ end -}}
\ No newline at end of file
diff --git a/kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml b/kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml
new file mode 100644
index 0000000000..60e2afa41d
--- /dev/null
+++ b/kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml
@@ -0,0 +1,17 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+{{- if .Values.global.cmpv2Enabled }}
+  {{ include "common.service" . }}
+{{ end -}}
\ No newline at end of file