From 1e99719c0224863cf26c5362243a4fa1b955c362 Mon Sep 17 00:00:00 2001
From: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Date: Sun, 28 Feb 2021 14:59:22 +0100
Subject: [AAI][BABEL] Remove Hardcoded certificates

Use Certinitializer in order to retrieve needed certificates.
Change ModelLoader also as it needs valid certificate to communicate
with Babel.

Issue-ID: OOM-2693
Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Change-Id: I64b8ede24643f942dc99956030c202c50d41ad1e
---
 .../components/aai-babel/templates/deployment.yaml | 52 ++++++++++------------
 .../components/aai-babel/templates/secrets.yaml    | 15 -------
 2 files changed, 24 insertions(+), 43 deletions(-)

(limited to 'kubernetes/aai/components/aai-babel/templates')

diff --git a/kubernetes/aai/components/aai-babel/templates/deployment.yaml b/kubernetes/aai/components/aai-babel/templates/deployment.yaml
index e12a234b8e..bd6b8c728c 100644
--- a/kubernetes/aai/components/aai-babel/templates/deployment.yaml
+++ b/kubernetes/aai/components/aai-babel/templates/deployment.yaml
@@ -37,10 +37,22 @@ spec:
         app: {{ include "common.name" . }}
         release: {{ include "common.release" . }}
     spec:
+      initContainers:  {{ include "common.certInitializer.initContainer" . | nindent 6 }}
       containers:
         - name: {{ include "common.name" . }}
           image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          {{- if .Values.global.aafEnabled }}
+          command:
+          - sh
+          args:
+          - -c
+          - |
+            echo "*** retrieve Truststore and Keystore password"
+            export $(cat {{ .Values.certInitializer.credsPath }}/mycreds.prop | xargs -0)
+            echo "*** actual launch of AAI Babel"
+            /bin/bash /opt/app/babel/bin/start.sh
+          {{- end }}
           ports:
           - containerPort: {{ .Values.service.internalPort }}
           # disable liveness probe when breakpoints set in debugger
@@ -60,35 +72,28 @@ spec:
           env:
             - name: CONFIG_HOME
               value: /opt/app/babel/config
-            - name: KEY_STORE_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ template "common.fullname" . }}-pass
-                  key: KEY_STORE_PASSWORD
-            - name: KEY_MANAGER_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ template "common.fullname" . }}-pass
-                  key: KEY_MANAGER_PASSWORD
-          volumeMounts:
+          volumeMounts:  {{ include "common.certInitializer.volumeMount" . | nindent 10 }}
           - mountPath: /etc/localtime
             name: localtime
             readOnly: true
+          - mountPath: /opt/app/babel/config/application.properties
+            name: config
+            subPath: application.properties
           - mountPath: /opt/app/babel/config/artifact-generator.properties
-            name: {{ include "common.fullname" . }}-config
+            name: config
             subPath: artifact-generator.properties
           - mountPath: /opt/app/babel/config/tosca-mappings.json
-            name: {{ include "common.fullname" . }}-config
+            name: config
             subPath: tosca-mappings.json
           - mountPath: /opt/app/babel/config/babel-auth.properties
-            name: {{ include "common.fullname" . }}-config
+            name: config
             subPath: babel-auth.properties
           - mountPath: /opt/app/babel/config/auth
-            name: {{ include "common.fullname" . }}-secrets
+            name: secrets
           - mountPath: {{ .Values.log.path }}
             name: logs
           - mountPath: /opt/app/babel/config/logback.xml
-            name: {{ include "common.fullname" . }}-config
+            name: config
             subPath: logback.xml
           resources:
 {{ include "common.resources" . }}
@@ -104,23 +109,14 @@ spec:
         # side car containers
       {{ include "common.log.sidecar" . | nindent 8 }}
       serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}}
-      volumes:
+      volumes: {{ include "common.certInitializer.volumes" . | nindent 8 }}
         - name: localtime
           hostPath:
             path: /etc/localtime
-        - name: {{ include "common.fullname" . }}-config
+        - name: config
           configMap:
             name: {{ include "common.fullname" . }}-configmap
-            items:
-            - key: artifact-generator.properties
-              path: artifact-generator.properties
-            - key: tosca-mappings.json
-              path: tosca-mappings.json
-            - key: babel-auth.properties
-              path: babel-auth.properties
-            - key: logback.xml
-              path: logback.xml
-        - name: {{ include "common.fullname" . }}-secrets
+        - name: secrets
           secret:
             secretName: {{ include "common.fullname" . }}-babel-secrets
         - name: logs
diff --git a/kubernetes/aai/components/aai-babel/templates/secrets.yaml b/kubernetes/aai/components/aai-babel/templates/secrets.yaml
index b81ffa05b9..9d7d2c5a80 100644
--- a/kubernetes/aai/components/aai-babel/templates/secrets.yaml
+++ b/kubernetes/aai/components/aai-babel/templates/secrets.yaml
@@ -29,18 +29,3 @@ metadata:
 type: Opaque
 data:
 {{ tpl (.Files.Glob "resources/config/auth/*").AsSecrets . | indent 2 }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "common.fullname" . }}-pass
-  namespace: {{ include "common.namespace" . }}
-  labels:
-    app: {{ include "common.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" . }}
-    heritage: {{ .Release.Service }}
-type: Opaque
-data:
-  KEY_STORE_PASSWORD: {{ .Values.config.keyStorePassword | b64enc | quote }}
-  KEY_MANAGER_PASSWORD: {{ .Values.config.keyManagerPassword | b64enc | quote }}
-- 
cgit 1.2.3-korg