[COMMON] Enable importing custom certificates to truststore using certInitializer

ONAP deployments may require the use of custom certificates. Instead of
manually adding certificates to the truststore file, users can now add
their .pem certificates under certInitializer/resources and have them
imported automatically by an init container. The updated truststore can
then be mounted to a component by providing a truststoreMountpath.

Issue-ID: OOM-2509
Signed-off-by: Jozsef Csongvai <jozsef.csongvai@bell.ca>
Change-Id: I896c729143346738e91fa57f895ba48043b253c1

1 files changed, 72 insertions, 2 deletions

diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
index 1250c1225e..c453f11c85 100644
--- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml
+++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
@@ -1,5 +1,5 @@
 {{/*
-# Copyright © 2020 Samsung Electronics
+# Copyright © 2020 Bell Canada, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -96,6 +96,51 @@
       value: "{{ $initRoot.public_fqdn | default "" }}"
 {{- end -}}
 
+{{/*
+  This init container will import custom .pem certificates to truststoreONAPall.jks
+  Custom certificates must be placed in common/certInitializer/resources directory.
+
+  The feature is enabled by setting Values.global.importCustomCertsEnabled = true
+  It can be used independently of aafEnabled, however it requires the same includes
+  as describe above for _initContainer.
+
+  When AAF is enabled the truststoreONAPAll.jks (which contains AAF CA) will be used
+  to import custom certificates, otherwise the default java keystore will be used.
+
+  The updated truststore file will be placed in /updatedTruststore and can be mounted per component
+  to a specific path by defining Values.certInitializer.truststoreMountpath (see _trustStoreVolumeMount)
+  The truststore file will be available to mount even if no custom certificates were imported.
+*/}}
+{{- define "common.certInitializer._initImportCustomCertsContainer" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
+{{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
+- name: {{ include "common.name" $dot }}-import-custom-certs
+  image: {{ $subchartDot.Values.global.jreImage }}
+  imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
+  securityContext:
+    runAsUser: 0
+  command:
+    - /bin/bash
+    - -c
+    - /root/import-custom-certs.sh
+  env:
+    - name: AAF_ENABLED
+      value: "{{  $subchartDot.Values.global.aafEnabled }}"
+    - name: TRUSTSTORE_OUTPUT_FILENAME
+      value: "{{ $initRoot.truststoreOutputFileName }}"
+    - name: TRUSTSTORE_PASSWORD
+    {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "truststore-creds" "key" "password") | indent 6 }}
+  volumeMounts:
+    - mountPath: /certs
+      name: aaf-agent-certs
+    - mountPath: /root/import-custom-certs.sh
+      name: aaf-agent-certs
+      subPath: import-custom-certs.sh
+    - mountPath: /updatedTruststore
+      name: updated-truststore
+{{- end -}}
+
 {{- define "common.certInitializer._volumeMount" -}}
 {{-   $dot := default . .dot -}}
 {{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
@@ -103,6 +148,21 @@
   name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
 {{- end -}}
 
+{{/*
+  This is used together with _initImportCustomCertsContainer
+  It mounts the updated truststore (with imported custom certificates) to the
+  truststoreMountpath defined in the values file for the component.
+*/}}
+{{- define "common.certInitializer._trustStoreVolumeMount" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
+{{- if gt (len $initRoot.truststoreMountpath) 0 }}
+- mountPath: {{ $initRoot.truststoreMountpath }}/{{ $initRoot.truststoreOutputFileName }}
+  name: updated-truststore
+  subPath: {{ $initRoot.truststoreOutputFileName }}
+{{- end -}}
+{{- end -}}
+
 {{- define "common.certInitializer._volumes" -}}
 {{-   $dot := default . .dot -}}
 {{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
@@ -121,10 +181,17 @@
     name: {{ include "common.fullname" $subchartDot }}-add-config
     defaultMode: 0700
 {{-     end -}}
+{{-     if $dot.Values.global.importCustomCertsEnabled }}
+- name: updated-truststore
+  emptyDir: {}
+{{-     end -}}
 {{- end -}}
 
 {{- define "common.certInitializer.initContainer" -}}
 {{-   $dot := default . .dot -}}
+  {{- if $dot.Values.global.importCustomCertsEnabled }}
+    {{ include "common.certInitializer._initImportCustomCertsContainer" . }}
+  {{- end -}}
   {{- if $dot.Values.global.aafEnabled }}
     {{ include "common.certInitializer._initContainer" . }}
   {{- end -}}
@@ -135,11 +202,14 @@
   {{- if $dot.Values.global.aafEnabled }}
     {{- include "common.certInitializer._volumeMount" . }}
   {{- end -}}
+  {{- if $dot.Values.global.importCustomCertsEnabled }}
+    {{- include "common.certInitializer._trustStoreVolumeMount" . }}
+  {{- end -}}
 {{- end -}}
 
 {{- define "common.certInitializer.volumes" -}}
 {{-   $dot := default . .dot -}}
-  {{- if $dot.Values.global.aafEnabled }}
+  {{- if or ($dot.Values.global.aafEnabled ) ($dot.Values.global.importCustomCertsEnabled) }}
     {{- include "common.certInitializer._volumes" . }}
   {{- end -}}
 {{- end -}}