1 files changed, 74 insertions, 4 deletions
diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
index 1250c1225e..800364f1a2 100644
--- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml
+++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
@@ -1,5 +1,5 @@
 {{/*
-# Copyright © 2020 Samsung Electronics
+# Copyright © 2020 Bell Canada, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -96,13 +96,73 @@
       value: "{{ $initRoot.public_fqdn | default "" }}"
 {{- end -}}
 
+{{/*
+  This init container will import custom .pem certificates to truststoreONAPall.jks
+  Custom certificates must be placed in common/certInitializer/resources directory.
+
+  The feature is enabled by setting Values.global.importCustomCertsEnabled = true
+  It can be used independently of aafEnabled, however it requires the same includes
+  as describe above for _initContainer.
+
+  When AAF is enabled the truststoreONAPAll.jks (which contains AAF CA) will be used
+  to import custom certificates, otherwise the default java keystore will be used.
+
+  The updated truststore file will be placed in /updatedTruststore and can be mounted per component
+  to a specific path by defining Values.certInitializer.truststoreMountpath (see _trustStoreVolumeMount)
+  The truststore file will be available to mount even if no custom certificates were imported.
+*/}}
+{{- define "common.certInitializer._initImportCustomCertsContainer" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
+{{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
+- name: {{ include "common.name" $dot }}-import-custom-certs
+  image: {{ $subchartDot.Values.global.jreImage }}
+  imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
+  securityContext:
+    runAsUser: 0
+  command:
+    - /bin/bash
+    - -c
+    - /root/import-custom-certs.sh
+  env:
+    - name: AAF_ENABLED
+      value: "{{  $subchartDot.Values.global.aafEnabled }}"
+    - name: TRUSTSTORE_OUTPUT_FILENAME
+      value: "{{ $initRoot.truststoreOutputFileName }}"
+    - name: TRUSTSTORE_PASSWORD
+    {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "truststore-creds" "key" "password") | indent 6 }}
+  volumeMounts:
+    - mountPath: /certs
+      name: aaf-agent-certs
+    - mountPath: /root/import-custom-certs.sh
+      name: aaf-agent-certs
+      subPath: import-custom-certs.sh
+    - mountPath: /updatedTruststore
+      name: updated-truststore
+{{- end -}}
+
 {{- define "common.certInitializer._volumeMount" -}}
 {{-   $dot := default . .dot -}}
 {{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
-- mountPath: {{ $initRoot.mountPath }}
+- mountPath: {{ $initRoot.appMountPath }}
   name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
 {{- end -}}
 
+{{/*
+  This is used together with _initImportCustomCertsContainer
+  It mounts the updated truststore (with imported custom certificates) to the
+  truststoreMountpath defined in the values file for the component.
+*/}}
+{{- define "common.certInitializer._trustStoreVolumeMount" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
+{{- if gt (len $initRoot.truststoreMountpath) 0 }}
+- mountPath: {{ $initRoot.truststoreMountpath }}/{{ $initRoot.truststoreOutputFileName }}
+  name: updated-truststore
+  subPath: {{ $initRoot.truststoreOutputFileName }}
+{{- end -}}
+{{- end -}}
+
 {{- define "common.certInitializer._volumes" -}}
 {{-   $dot := default . .dot -}}
 {{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
@@ -112,7 +172,7 @@
     medium: Memory
 - name: aaf-agent-certs
   configMap:
-    name: {{ include "common.fullname" $subchartDot }}-certs
+    name: {{ tpl $subchartDot.Values.certsCMName $subchartDot }}
     defaultMode: 0700
 
 {{-     if $initRoot.aaf_add_config }}
@@ -121,10 +181,17 @@
     name: {{ include "common.fullname" $subchartDot }}-add-config
     defaultMode: 0700
 {{-     end -}}
+{{-     if $dot.Values.global.importCustomCertsEnabled }}
+- name: updated-truststore
+  emptyDir: {}
+{{-     end -}}
 {{- end -}}
 
 {{- define "common.certInitializer.initContainer" -}}
 {{-   $dot := default . .dot -}}
+  {{- if $dot.Values.global.importCustomCertsEnabled }}
+    {{ include "common.certInitializer._initImportCustomCertsContainer" . }}
+  {{- end -}}
   {{- if $dot.Values.global.aafEnabled }}
     {{ include "common.certInitializer._initContainer" . }}
   {{- end -}}
@@ -135,11 +202,14 @@
   {{- if $dot.Values.global.aafEnabled }}
     {{- include "common.certInitializer._volumeMount" . }}
   {{- end -}}
+  {{- if $dot.Values.global.importCustomCertsEnabled }}
+    {{- include "common.certInitializer._trustStoreVolumeMount" . }}
+  {{- end -}}
 {{- end -}}
 
 {{- define "common.certInitializer.volumes" -}}
 {{-   $dot := default . .dot -}}
-  {{- if $dot.Values.global.aafEnabled }}
+  {{- if or ($dot.Values.global.aafEnabled ) ($dot.Values.global.importCustomCertsEnabled) }}
     {{- include "common.certInitializer._volumes" . }}
   {{- end -}}
 {{- end -}}