[PLATFORM] Generate Cert-Service certs with Cert-Manager

Utilize Cert-Manager to secure communication between
Cert-Service and its clients, adjust templates and
configs.

Issue-ID: OOM-2712
Signed-off-by: Piotr Marcinkiewicz <piotr.marcinkiewicz@nokia.com>
Change-Id: I96426b1a184b4d254575e76d29214d9deda08cce
Signed-off-by: Remigiusz Janeczek <remigiusz.janeczek@nokia.com>

6 files changed, 74 insertions, 62 deletions

diff --git a/kubernetes/common/certManagerCertificate/requirements.yaml b/kubernetes/common/certManagerCertificate/requirements.yaml
index 210a02c65c..83becb0a33 100644
--- a/kubernetes/common/certManagerCertificate/requirements.yaml
+++ b/kubernetes/common/certManagerCertificate/requirements.yaml
@@ -16,3 +16,6 @@ dependencies:
   - name: common
     version: ~8.x-0
     repository: 'file://../common'
+  - name: cmpv2Config
+    version: ~8.x-0
+    repository: 'file://../cmpv2Config'
diff --git a/kubernetes/common/certManagerCertificate/templates/_certificate.tpl b/kubernetes/common/certManagerCertificate/templates/_certificate.tpl
index f820c30ca9..108873b31d 100644
--- a/kubernetes/common/certManagerCertificate/templates/_certificate.tpl
+++ b/kubernetes/common/certManagerCertificate/templates/_certificate.tpl
@@ -18,7 +18,7 @@
 #
 # To request a certificate following steps are to be done:
 #  - create an object 'certificates' in the values.yaml
-#  - create a file templates/certificates.yaml and invoke the function "certManagerCertificate.certificate".
+#  - create a file templates/certificate.yaml and invoke the function "certManagerCertificate.certificate".
 #
 # Here is an example of the certificate request for a component:
 #
@@ -53,6 +53,7 @@
 #        passwordSecretRef:
 #          name: secret-name
 #          key:  secret-key
+#          create: true
 #
 # Fields 'name', 'secretName' and 'commonName' are mandatory and required to be defined.
 # Other mandatory fields for the certificate definition do not have to be defined directly,
@@ -74,7 +75,7 @@
 {{/*# General certifiacate attributes  #*/}}
 {{- $name           := include "common.fullname" $dot                                                             -}}
 {{- $certName       := default (printf "%s-cert-%d"   $name $i) $certificate.name                                 -}}
-{{- $secretName     := default (printf "%s-secret-%d" $name $i) $certificate.secretName                           -}}
+{{- $secretName     := default (printf "%s-secret-%d" $name $i) (tpl (default "" $certificate.secretName) $ )  -}}
 {{- $commonName     := (required "'commonName' for Certificate is required." $certificate.commonName)          -}}
 {{- $renewBefore    := default $subchartGlobal.certificate.default.renewBefore     $certificate.renewBefore    -}}
 {{- $duration       := default $subchartGlobal.certificate.default.duration        $certificate.duration       -}}
@@ -94,10 +95,11 @@
 {{- if $certificate.issuer -}}
 {{-   $issuer        = $certificate.issuer                                               -}}
 {{- end -}}
----
-{{- if $certificate.keystore }}
+{{/*# Secret #*/}}
+{{ if $certificate.keystore -}}
   {{- $passwordSecretRef := $certificate.keystore.passwordSecretRef -}}
-  {{- $password := include "common.createPassword" (dict "dot" $dot "uid" $certName) | quote }}
+  {{- $password := include "common.createPassword" (dict "dot" $dot "uid" $certName) | quote -}}
+  {{- if $passwordSecretRef.create }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -106,7 +108,8 @@ metadata:
 type: Opaque
 stringData:
   {{ $passwordSecretRef.key }}: {{ $password }}
-{{- end }}
+  {{- end }}
+{{ end -}}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -120,6 +123,15 @@ spec:
   {{- if $duration }}
   duration:    {{ $duration }}
   {{- end }}
+  {{- if $certificate.isCA }}
+  isCA: {{ $certificate.isCA }}
+  {{- end }}
+  {{- if $certificate.usages }}
+  usages:
+    {{- range $usage := $certificate.usages }}
+      - {{ $usage }}
+    {{- end }}
+  {{- end }}
   subject:
     organizations:
       - {{ $subject.organization }}
@@ -156,7 +168,9 @@ spec:
     {{- end }}
   {{- end }}
   issuerRef:
+    {{- if not (eq $issuer.kind "Issuer" ) }}
     group: {{ $issuer.group }}
+    {{- end }}
     kind:  {{ $issuer.kind }}
     name:  {{ $issuer.name }}
   {{- if $certificate.keystore }}
@@ -168,7 +182,7 @@ spec:
     {{ $outputType }}:
       create: true
       passwordSecretRef:
-        name: {{ $certificate.keystore.passwordSecretRef.name }}
+        name: {{ tpl (default "" $certificate.keystore.passwordSecretRef.name) $ }}
         key: {{ $certificate.keystore.passwordSecretRef.key }}
     {{- end }}
   {{- end }}
@@ -234,4 +248,4 @@ spec:
     {{- $certsLinkCommand = (printf "ln -s %s %s; %s" $sourcePath $destnationPath $certsLinkCommand) -}}
   {{- end -}}
 {{ $certsLinkCommand }}
-{{- end -}}
+{{- end -}}
\ No newline at end of file
diff --git a/kubernetes/common/cmpv2Certificate/requirements.yaml b/kubernetes/common/cmpv2Certificate/requirements.yaml
index 87509d11bc..b10896d2ce 100644
--- a/kubernetes/common/cmpv2Certificate/requirements.yaml
+++ b/kubernetes/common/cmpv2Certificate/requirements.yaml
@@ -19,3 +19,6 @@ dependencies:
   - name: repositoryGenerator
     version: ~8.x-0
     repository: 'file://../repositoryGenerator'
+  - name: cmpv2Config
+    version: ~8.x-0
+    repository: 'file://../cmpv2Config'
diff --git a/kubernetes/common/cmpv2Certificate/templates/_certServiceClient.tpl b/kubernetes/common/cmpv2Certificate/templates/_certServiceClient.tpl
index 58cc9c7249..f80b06b4d3 100644
--- a/kubernetes/common/cmpv2Certificate/templates/_certServiceClient.tpl
+++ b/kubernetes/common/cmpv2Certificate/templates/_certServiceClient.tpl
@@ -62,7 +62,7 @@ There also need to be some includes used in a target component deployment (inden
 
 {{- define "common.certServiceClient.initContainer" -}}
 {{- $dot := default . .dot -}}
-{{- $initRoot := default $dot.Values.cmpv2Certificate .initRoot -}}
+{{- $initRoot := default $dot.Values.cmpv2Certificate.cmpv2Config .initRoot -}}
 {{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
 {{- if and $subchartGlobal.cmpv2Enabled (not $subchartGlobal.CMPv2CertManagerIntegration) -}}
 {{- range $index, $certificate := $dot.Values.certificates -}}
@@ -97,11 +97,14 @@ There also need to be some includes used in a target component deployment (inden
 {{- $requestUrl := $subchartGlobal.platform.certServiceClient.envVariables.requestURL -}}
 {{- $certPath := $subchartGlobal.platform.certServiceClient.envVariables.certPath -}}
 {{- $requestTimeout := $subchartGlobal.platform.certServiceClient.envVariables.requestTimeout -}}
-{{- $certificatesSecretMountPath := $subchartGlobal.platform.certServiceClient.secret.mountPath -}}
-{{- $keystorePath := $subchartGlobal.platform.certServiceClient.envVariables.keystorePath -}}
-{{- $keystorePassword := $subchartGlobal.platform.certServiceClient.envVariables.keystorePassword -}}
-{{- $truststorePath := $subchartGlobal.platform.certServiceClient.envVariables.truststorePath -}}
-{{- $truststorePassword := $subchartGlobal.platform.certServiceClient.envVariables.truststorePassword -}}
+{{- $certificatesSecret:= $subchartGlobal.platform.certServiceClient.clientSecretName -}}
+{{- $certificatesSecretMountPath := $subchartGlobal.platform.certServiceClient.certificatesSecretMountPath -}}
+{{- $keystorePath := (printf "%s%s" $subchartGlobal.platform.certServiceClient.certificatesSecretMountPath $subchartGlobal.platform.certificates.keystoreKeyRef ) -}}
+{{- $keystorePasswordSecret := $subchartGlobal.platform.certificates.keystorePasswordSecretName -}}
+{{- $keystorePasswordSecretKey := $subchartGlobal.platform.certificates.keystorePasswordSecretKey -}}
+{{- $truststorePath := (printf "%s%s" $subchartGlobal.platform.certServiceClient.certificatesSecretMountPath $subchartGlobal.platform.certificates.truststoreKeyRef ) -}}
+{{- $truststorePasswordSecret := $subchartGlobal.platform.certificates.truststorePasswordSecretName -}}
+{{- $truststorePasswordSecretKey := $subchartGlobal.platform.certificates.truststorePasswordSecretKey -}}
 - name: certs-init-{{ $index }}
   image: {{ include "repositoryGenerator.image.certserviceclient" $dot }}
   imagePullPolicy: {{ $dot.Values.global.pullPolicy | default $dot.Values.pullPolicy }}
@@ -133,11 +136,17 @@ There also need to be some includes used in a target component deployment (inden
     - name: KEYSTORE_PATH
       value: {{ $keystorePath | quote }}
     - name: KEYSTORE_PASSWORD
-      value: {{ $keystorePassword | quote }}
+      valueFrom:
+        secretKeyRef:
+          name: {{ $keystorePasswordSecret | quote}}
+          key: {{ $keystorePasswordSecretKey | quote}}
     - name: TRUSTSTORE_PATH
       value: {{ $truststorePath | quote }}
     - name: TRUSTSTORE_PASSWORD
-      value: {{ $truststorePassword | quote }}
+      valueFrom:
+        secretKeyRef:
+          name: {{ $truststorePasswordSecret | quote}}
+          key: {{ $truststorePasswordSecretKey | quote}}
   terminationMessagePath: /dev/termination-log
   terminationMessagePolicy: File
   volumeMounts:
@@ -151,10 +160,10 @@ There also need to be some includes used in a target component deployment (inden
 
 {{- define "common.certServiceClient.volumes" -}}
 {{- $dot := default . .dot -}}
-{{- $initRoot := default $dot.Values.cmpv2Certificate .initRoot -}}
+{{- $initRoot := default $dot.Values.cmpv2Certificate.cmpv2Config .initRoot -}}
 {{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
 {{- if and $subchartGlobal.cmpv2Enabled (not $subchartGlobal.CMPv2CertManagerIntegration) -}}
-{{- $certificatesSecretName := $subchartGlobal.platform.certServiceClient.secret.name -}}
+{{- $certificatesSecretName := $subchartGlobal.platform.certificates.clientSecretName -}}
 - name: certservice-tls-volume
   secret:
     secretName: {{ $certificatesSecretName }}
@@ -168,7 +177,7 @@ There also need to be some includes used in a target component deployment (inden
 
 {{- define "common.certServiceClient.volumeMounts" -}}
 {{- $dot := default . .dot -}}
-{{- $initRoot := default $dot.Values.cmpv2Certificate .initRoot -}}
+{{- $initRoot := default $dot.Values.cmpv2Certificate.cmpv2Config .initRoot -}}
 {{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
 {{- if and $subchartGlobal.cmpv2Enabled (not $subchartGlobal.CMPv2CertManagerIntegration) -}}
 {{- range $index, $certificate := $dot.Values.certificates -}}
diff --git a/kubernetes/common/cmpv2Certificate/values.yaml b/kubernetes/common/cmpv2Certificate/values.yaml
index b7531431c4..504947525d 100644
--- a/kubernetes/common/cmpv2Certificate/values.yaml
+++ b/kubernetes/common/cmpv2Certificate/values.yaml
@@ -11,38 +11,3 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-#################################################################
-# Global configuration default values that can be inherited by
-# all subcharts.
-#################################################################
-global:
-  # Enabling CMPv2
-  cmpv2Enabled: true
-  CMPv2CertManagerIntegration: false
-
-  certificate:
-    default:
-      subject:
-        organization: "Linux-Foundation"
-        country: "US"
-        locality: "San-Francisco"
-        province: "California"
-        organizationalUnit: "ONAP"
-
-  platform:
-    certServiceClient:
-      secret:
-        name: oom-cert-service-client-tls-secret
-        mountPath: /etc/onap/oom/certservice/certs/
-      envVariables:
-        certPath: "/var/custom-certs"
-        # Client configuration related
-        caName: "RA"
-        requestURL: "https://oom-cert-service:8443/v1/certificate/"
-        requestTimeout: "30000"
-        keystorePath: "/etc/onap/oom/certservice/certs/certServiceClient-keystore.jks"
-        outputType: "P12"
-        keystorePassword: "secret"
-        truststorePath: "/etc/onap/oom/certservice/certs/truststore.jks"
-        truststorePassword: "secret"
diff --git a/kubernetes/common/cmpv2Config/values.yaml b/kubernetes/common/cmpv2Config/values.yaml
index b6ee064302..695e40616c 100644
--- a/kubernetes/common/cmpv2Config/values.yaml
+++ b/kubernetes/common/cmpv2Config/values.yaml
@@ -12,22 +12,40 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 global:
+
+  # Enabling CMPv2
+  cmpv2Enabled: true
+  CMPv2CertManagerIntegration: false
+
+  certificate:
+    default:
+      subject:
+        organization: "Linux-Foundation"
+        country: "US"
+        locality: "San-Francisco"
+        province: "California"
+        organizationalUnit: "ONAP"
+
   platform:
+    certificates:
+      clientSecretName: oom-cert-service-client-tls-secret
+      keystoreKeyRef: keystore.jks
+      truststoreKeyRef: truststore.jks
+      keystorePasswordSecretName: oom-cert-service-keystore-password
+      keystorePasswordSecretKey: password
+      truststorePasswordSecretName: oom-cert-service-truststore-password
+      truststorePasswordSecretKey: password
     certServiceClient:
       image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.3
-      secretName: oom-cert-service-client-tls-secret
+      certificatesSecretMountPath: /etc/onap/oom/certservice/certs/
       envVariables:
+        certPath: "/var/custom-certs"
         # Certificate related
-        cmpv2Organization: "Linux-Foundation"
-        cmpv2OrganizationalUnit: "ONAP"
-        cmpv2Location: "San-Francisco"
-        cmpv2State: "California"
-        cmpv2Country: "US"
+        caName: "RA"
         # Client configuration related
         requestURL: "https://oom-cert-service:8443/v1/certificate/"
         requestTimeout: "30000"
-        keystorePassword: "secret"
-        truststorePassword: "secret"
+        outputType: "P12"
     certPostProcessor:
       image: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.3.3