summaryrefslogtreecommitdiffstats
path: root/certService
diff options
context:
space:
mode:
authorawudzins <adam.wudzinski@nokia.com>2020-03-13 16:54:18 +0100
committerawudzins <adam.wudzinski@nokia.com>2020-04-03 11:29:59 +0200
commitb81c681cb6be761a2abb5e2f5af1b923bef1f6b4 (patch)
tree9e0712775bee897d3c0156a8fa6bf9d69846f2ed /certService
parentfa33d3f9cf9b613968bf277284841164d392fc21 (diff)
Switch client and server to communicate over TLS
Issue-ID: AAF-1084 Signed-off-by: Adam WudziƄski <adam.wudzinski@nokia.com> Change-Id: I7f11b27c7dcdf4fc3eba2d5e64b6dc775c80dd74
Diffstat (limited to 'certService')
-rw-r--r--certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jksbin0 -> 4087 bytes
-rw-r--r--certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jksbin0 -> 4126 bytes
-rw-r--r--certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12bin0 -> 4691 bytes
-rw-r--r--certService/helm/aaf-cert-service/resources/root.crt32
-rw-r--r--certService/helm/aaf-cert-service/resources/truststore.jksbin0 -> 1722 bytes
-rw-r--r--certService/helm/aaf-cert-service/templates/deployment.yaml37
-rw-r--r--certService/helm/aaf-cert-service/templates/secret_client_tls.yaml10
-rw-r--r--certService/helm/aaf-cert-service/templates/secret_server_tls.yaml14
-rw-r--r--certService/helm/aaf-cert-service/templates/service.yaml2
-rw-r--r--certService/helm/aaf-cert-service/values.yaml28
-rw-r--r--certService/src/main/resources/application.properties11
-rw-r--r--certService/src/test/resources/application.properties11
12 files changed, 135 insertions, 10 deletions
diff --git a/certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks b/certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks
new file mode 100644
index 00000000..f24908c5
--- /dev/null
+++ b/certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks
Binary files differ
diff --git a/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks
new file mode 100644
index 00000000..89605b6b
--- /dev/null
+++ b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks
Binary files differ
diff --git a/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12 b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12
new file mode 100644
index 00000000..2106c817
--- /dev/null
+++ b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12
Binary files differ
diff --git a/certService/helm/aaf-cert-service/resources/root.crt b/certService/helm/aaf-cert-service/resources/root.crt
new file mode 100644
index 00000000..faeee813
--- /dev/null
+++ b/certService/helm/aaf-cert-service/resources/root.crt
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFlDCCA3ygAwIBAgIETsAy8jANBgkqhkiG9w0BAQwFADByMQswCQYDVQQGEwJQ
+TDEUMBIGA1UECBMLRG9sbnkgU2xhc2sxEDAOBgNVBAcTB1dyb2NsYXcxFTATBgNV
+BAoTDFJvb3QgQ29tcGFueTERMA8GA1UECxMIUm9vdCBPcmcxETAPBgNVBAMTCHJv
+b3QuY29tMB4XDTIwMDQwMzA5MTYxNloXDTMwMDQwMTA5MTYxNlowcjELMAkGA1UE
+BhMCUEwxFDASBgNVBAgTC0RvbG55IFNsYXNrMRAwDgYDVQQHEwdXcm9jbGF3MRUw
+EwYDVQQKEwxSb290IENvbXBhbnkxETAPBgNVBAsTCFJvb3QgT3JnMREwDwYDVQQD
+Ewhyb290LmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAImm68wu
+rtdkVrC5JI2y53+DoVE4al7NxC2yHeVW0PRD3CgW1xba6dlSQoDQQKkDkxtuNhlU
+IQxU1bbKR6syqJgpJXwSDx4sl4J5lQGWN+iuNA72C1IyXATOgowGq6PbOVVTkApy
+3+ZZGBCmweTjhvddAO7k5p8v+ePt17VvBTxSt6rSvrkGMbpCxBGAPfGpL9xykm9Z
+okVSlA42gGhbra499QTT0Yc/WPPFotKkDKFGaDrLW3NYX1Lio11myYNvLOMwfSEV
+Xy9vkwxcdqFJpHjx+EVLLQXwkudZP+D53N4bk8nP3SacbZSQ/A85mZpWNtw+r9QL
+fZGecY1YIR0udLj66CIG3ybl3gSXX7TSRERTIMR6Um1lt+039FSa18mRBpQTCDXV
+tSL58Qs5BHFkCe0sGpY+XiSEypc6oYPf/7YjiTvMT/mHhDffrvFjhK+wP/oCIg8u
+vuPRoPWuyw41bBeFGitJgDn7E8p9B4K/1DCO/ZcjXiYMgn5Hwb3ojablYUeiXs99
+2AAV8gCceUCdgcP8d6wdAydOVljavkgHPG0IMbiVG1WT57oM3HQpejgpujlKDDsI
+bi9/lbcC/U0JoN9yAaJZFr7CXJrxRv8DWeTwzMTo203KHNu9roQiERd38P8Dp6AQ
+ivmqf0+0VZM3IpjWBYKM68tclHJcG+7wyFjvAgMBAAGjMjAwMB0GA1UdDgQWBBSN
+lFyR56zh67mnvYTmmgJQVxEJrjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB
+DAUAA4ICAQBczmFY0kmr1FK50glkT282ur0vukNtwXQNJONof3rYRqP2W98jID6D
+ayma0B4/H1EqCa0d66wRBxFdwW+MqOc4uWD3uUwgazrYD/Bv+V3aumaw8yX6vbyL
+hLNfpd4pViAEGtzYxYfMfFR6uzInF3NMpvt8OXCSGKiQjDMnMs0ekvUZLJm7yxwT
+Qr9aAEFYQYM/GstUC6qFfuUa4MaGvmyKWhZ10JoKXYbGGeFU4wI7Kzifh3VvawTg
+r314ZvQ3zpEwzNJpdvT5ZKuPvyN+drAKFpSPfOTFmmb3uF95FgYq33OFPpo7SR43
+tnw5u5YqKnsHmqCIRMctWiYZc8rBJ3+eBGmke6z/AN6FraG6Ejc8e4WPclrB8STb
++oB3a4Cvri1VHyodkm50Sb/d1FAMDXvzEPBfu2D0dVvOwOcISSN/MQUom8NN4YeI
+aEATdAPNkokgehOzZ1OPRv47FKYEVPCXjaZEWAC7NNmNiRn4RQOti0DlNrLL7Nx9
+vK09G0EnW01MO2ARRkZ3dog+Ph7orJQV3sd7TO4EEortqWtbegSH75ylyYw6rt/j
+uBzYtMOnEtnQKhxj4Wj7PO+StCgspoOByn0d+iSgDd2TlpWm4naP2pfFZT0R+TOH
+wzSH0F47TSfRd0++uEz/QhViybrvQK7yMt1G1YwZp2im+imuWwUC8Q==
+-----END CERTIFICATE-----
diff --git a/certService/helm/aaf-cert-service/resources/truststore.jks b/certService/helm/aaf-cert-service/resources/truststore.jks
new file mode 100644
index 00000000..c32d37fd
--- /dev/null
+++ b/certService/helm/aaf-cert-service/resources/truststore.jks
Binary files differ
diff --git a/certService/helm/aaf-cert-service/templates/deployment.yaml b/certService/helm/aaf-cert-service/templates/deployment.yaml
index f8b2d43f..f4a28f46 100644
--- a/certService/helm/aaf-cert-service/templates/deployment.yaml
+++ b/certService/helm/aaf-cert-service/templates/deployment.yaml
@@ -16,27 +16,52 @@ spec:
- name: {{ .Values.volume.name }}
secret:
secretName: {{ .Values.secret.name }}
+ - name: {{ .Values.tls.server.volume.name }}
+ secret:
+ secretName: {{ .Values.tls.server.secret.name }}
containers:
- name: aaf-cert-service
image: {{ .Values.repository }}/{{ .Values.image }}
imagePullPolicy: {{ .Values.pullPolicy }}
ports:
- containerPort: {{ .Values.containerPort }}
+ env:
+ - name: HTTPS_PORT
+ value: "{{ .Values.containerPort }}"
+ - name: KEYSTORE_PATH
+ value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.jksName }}"
+ - name: KEYSTORE_P12_PATH
+ value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.p12Name }}"
+ - name: TRUSTSTORE_PATH
+ value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.jksName }}"
+ - name: ROOT_CERT
+ value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.crtName }}"
+ - name: KEYSTORE_PASSWORD
+ value: "{{ .Values.envs.keystore.password }}"
+ - name: TRUSTSTORE_PASSWORD
+ value: "{{ .Values.envs.truststore.password }}"
livenessProbe:
- httpGet:
- port: {{ .Values.containerPort }}
- path: {{ .Values.liveness.path }}
+ exec:
+ command:
+ - /bin/bash
+ - -c
+ - {{ .Values.liveness.command }}
initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.liveness.periodSeconds }}
readinessProbe:
- httpGet:
- port: {{ .Values.containerPort }}
- path: {{ .Values.readiness.path }}
+ exec:
+ command:
+ - /bin/bash
+ - -c
+ - {{ .Values.readiness.command }}
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.readiness.periodSeconds }}
volumeMounts:
- name: {{ .Values.volume.name }}
mountPath: {{ .Values.volume.mountPath }}
readOnly: true
+ - name: {{ .Values.tls.server.volume.name }}
+ mountPath: {{ .Values.tls.server.volume.mountPath }}
+ readOnly: true
resources:
{{ toYaml .Values.resources }}
diff --git a/certService/helm/aaf-cert-service/templates/secret_client_tls.yaml b/certService/helm/aaf-cert-service/templates/secret_client_tls.yaml
new file mode 100644
index 00000000..b80a4af4
--- /dev/null
+++ b/certService/helm/aaf-cert-service/templates/secret_client_tls.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .Values.tls.client.secret.name }}
+type: Opaque
+data:
+ certServiceClient-keystore.jks:
+ {{ (.Files.Glob "resources/certServiceClient-keystore.jks").AsSecrets }}
+ truststore.jks:
+ {{ (.Files.Glob "resources/truststore.jks").AsSecrets }}
diff --git a/certService/helm/aaf-cert-service/templates/secret_server_tls.yaml b/certService/helm/aaf-cert-service/templates/secret_server_tls.yaml
new file mode 100644
index 00000000..535e3dbd
--- /dev/null
+++ b/certService/helm/aaf-cert-service/templates/secret_server_tls.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .Values.tls.server.secret.name }}
+type: Opaque
+data:
+ certServiceServer-keystore.jks:
+ {{ (.Files.Glob "resources/certServiceServer-keystore.jks").AsSecrets }}
+ certServiceServer-keystore.p12:
+ {{ (.Files.Glob "resources/certServiceServer-keystore.p12").AsSecrets }}
+ truststore.jks:
+ {{ (.Files.Glob "resources/truststore.jks").AsSecrets }}
+ root.crt:
+ {{ (.Files.Glob "resources/root.crt").AsSecrets }} \ No newline at end of file
diff --git a/certService/helm/aaf-cert-service/templates/service.yaml b/certService/helm/aaf-cert-service/templates/service.yaml
index fba7e5fa..f3c0ee0c 100644
--- a/certService/helm/aaf-cert-service/templates/service.yaml
+++ b/certService/helm/aaf-cert-service/templates/service.yaml
@@ -1,7 +1,7 @@
apiVersion: v1
kind: Service
metadata:
- name: {{ .Chart.Name }}-service
+ name: {{ .Chart.Name }}
spec:
type: {{ .Values.service.type }}
selector:
diff --git a/certService/helm/aaf-cert-service/values.yaml b/certService/helm/aaf-cert-service/values.yaml
index 0dab1e32..efb16a5a 100644
--- a/certService/helm/aaf-cert-service/values.yaml
+++ b/certService/helm/aaf-cert-service/values.yaml
@@ -3,17 +3,17 @@ replicaCount: 1
repository: nexus3.onap.org:10001
image: onap/org.onap.aaf.certservice.aaf-certservice-api:1.0.0
pullPolicy: Always
-containerPort: 8080
+containerPort: 8443
service:
type: ClusterIP
liveness:
initialDelaySeconds: 60
periodSeconds: 10
- path: /actuator/health
+ command: curl https://localhost:$HTTPS_PORT/actuator/health --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD
readiness:
initialDelaySeconds: 30
periodSeconds: 10
- path: /ready
+ command: curl https://localhost:$HTTPS_PORT/ready --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD
volume:
name: aaf-cert-service-volume
mountPath: /etc/onap/aaf/certservice
@@ -28,3 +28,25 @@ resources:
secret:
name: aaf-cert-service-secret
+
+tls:
+ server:
+ secret:
+ name: aaf-cert-service-server-tls-secret
+ volume:
+ name: aaf-cert-service-server-tls-volume
+ mountPath: /etc/onap/aaf/certservice/certs/
+ client:
+ secret:
+ name: aaf-cert-service-client-tls-secret
+
+envs:
+ keystore:
+ jksName: certServiceServer-keystore.jks
+ p12Name: certServiceServer-keystore.p12
+ password: secret
+ truststore:
+ jksName: truststore.jks
+ crtName: root.crt
+ password: secret
+
diff --git a/certService/src/main/resources/application.properties b/certService/src/main/resources/application.properties
index 9ccdd326..c5d14370 100644
--- a/certService/src/main/resources/application.properties
+++ b/certService/src/main/resources/application.properties
@@ -9,3 +9,14 @@ springdoc.swagger-ui.path=/docs
# AAF CertService app specific configuration
app.config.path=/etc/onap/aaf/certservice
+
+# Mutual TLS configuration
+server.ssl.enabled=true
+server.ssl.client-auth=need
+server.port=${HTTPS_PORT:8443}
+
+server.ssl.key-store=${KEYSTORE_PATH:/etc/onap/aaf/certservice/certs/certServiceServer-keystore.jks}
+server.ssl.key-store-password=${KEYSTORE_PASSWORD:secret}
+
+server.ssl.trust-store=${TRUSTSTORE_PATH:/etc/onap/aaf/certservice/certs/truststore.jks}
+server.ssl.trust-store-password=${TRUSTSTORE_PASSWORD:secret}
diff --git a/certService/src/test/resources/application.properties b/certService/src/test/resources/application.properties
index 39001571..b70ab3b4 100644
--- a/certService/src/test/resources/application.properties
+++ b/certService/src/test/resources/application.properties
@@ -1,2 +1,13 @@
# AAF CertService app specific configuration
app.config.path=./src/test/resources
+
+# Mutual TLS configuration
+server.ssl.enabled=true
+server.ssl.client-auth=need
+server.port=${HTTPS_PORT:8443}
+
+server.ssl.key-store=${KEYSTORE_PATH:/etc/onap/aaf/certservice/certs/certServiceServer-keystore.jks}
+server.ssl.key-store-password=${KEYSTORE_PASSWORD:secret}
+
+server.ssl.trust-store=${TRUSTSTORE_PATH:/etc/onap/aaf/certservice/certs/truststore.jks}
+server.ssl.trust-store-password=${TRUSTSTORE_PASSWORD:secret} \ No newline at end of file