From b81c681cb6be761a2abb5e2f5af1b923bef1f6b4 Mon Sep 17 00:00:00 2001 From: awudzins Date: Fri, 13 Mar 2020 16:54:18 +0100 Subject: Switch client and server to communicate over TLS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issue-ID: AAF-1084 Signed-off-by: Adam Wudziński Change-Id: I7f11b27c7dcdf4fc3eba2d5e64b6dc775c80dd74 --- .../resources/certServiceClient-keystore.jks | Bin 0 -> 4087 bytes .../resources/certServiceServer-keystore.jks | Bin 0 -> 4126 bytes .../resources/certServiceServer-keystore.p12 | Bin 0 -> 4691 bytes .../helm/aaf-cert-service/resources/root.crt | 32 ++++++++++++++++++ .../helm/aaf-cert-service/resources/truststore.jks | Bin 0 -> 1722 bytes .../aaf-cert-service/templates/deployment.yaml | 37 +++++++++++++++++---- .../templates/secret_client_tls.yaml | 10 ++++++ .../templates/secret_server_tls.yaml | 14 ++++++++ .../helm/aaf-cert-service/templates/service.yaml | 2 +- certService/helm/aaf-cert-service/values.yaml | 28 ++++++++++++++-- .../src/main/resources/application.properties | 11 ++++++ .../src/test/resources/application.properties | 11 ++++++ 12 files changed, 135 insertions(+), 10 deletions(-) create mode 100644 certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks create mode 100644 certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks create mode 100644 certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12 create mode 100644 certService/helm/aaf-cert-service/resources/root.crt create mode 100644 certService/helm/aaf-cert-service/resources/truststore.jks create mode 100644 certService/helm/aaf-cert-service/templates/secret_client_tls.yaml create mode 100644 certService/helm/aaf-cert-service/templates/secret_server_tls.yaml (limited to 'certService') diff --git a/certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks b/certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks new file mode 100644 index 00000000..f24908c5 Binary files /dev/null and b/certService/helm/aaf-cert-service/resources/certServiceClient-keystore.jks differ diff --git a/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks new file mode 100644 index 00000000..89605b6b Binary files /dev/null and b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.jks differ diff --git a/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12 b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12 new file mode 100644 index 00000000..2106c817 Binary files /dev/null and b/certService/helm/aaf-cert-service/resources/certServiceServer-keystore.p12 differ diff --git a/certService/helm/aaf-cert-service/resources/root.crt b/certService/helm/aaf-cert-service/resources/root.crt new file mode 100644 index 00000000..faeee813 --- /dev/null +++ b/certService/helm/aaf-cert-service/resources/root.crt @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFlDCCA3ygAwIBAgIETsAy8jANBgkqhkiG9w0BAQwFADByMQswCQYDVQQGEwJQ +TDEUMBIGA1UECBMLRG9sbnkgU2xhc2sxEDAOBgNVBAcTB1dyb2NsYXcxFTATBgNV +BAoTDFJvb3QgQ29tcGFueTERMA8GA1UECxMIUm9vdCBPcmcxETAPBgNVBAMTCHJv +b3QuY29tMB4XDTIwMDQwMzA5MTYxNloXDTMwMDQwMTA5MTYxNlowcjELMAkGA1UE +BhMCUEwxFDASBgNVBAgTC0RvbG55IFNsYXNrMRAwDgYDVQQHEwdXcm9jbGF3MRUw +EwYDVQQKEwxSb290IENvbXBhbnkxETAPBgNVBAsTCFJvb3QgT3JnMREwDwYDVQQD +Ewhyb290LmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAImm68wu +rtdkVrC5JI2y53+DoVE4al7NxC2yHeVW0PRD3CgW1xba6dlSQoDQQKkDkxtuNhlU +IQxU1bbKR6syqJgpJXwSDx4sl4J5lQGWN+iuNA72C1IyXATOgowGq6PbOVVTkApy +3+ZZGBCmweTjhvddAO7k5p8v+ePt17VvBTxSt6rSvrkGMbpCxBGAPfGpL9xykm9Z +okVSlA42gGhbra499QTT0Yc/WPPFotKkDKFGaDrLW3NYX1Lio11myYNvLOMwfSEV +Xy9vkwxcdqFJpHjx+EVLLQXwkudZP+D53N4bk8nP3SacbZSQ/A85mZpWNtw+r9QL +fZGecY1YIR0udLj66CIG3ybl3gSXX7TSRERTIMR6Um1lt+039FSa18mRBpQTCDXV +tSL58Qs5BHFkCe0sGpY+XiSEypc6oYPf/7YjiTvMT/mHhDffrvFjhK+wP/oCIg8u +vuPRoPWuyw41bBeFGitJgDn7E8p9B4K/1DCO/ZcjXiYMgn5Hwb3ojablYUeiXs99 +2AAV8gCceUCdgcP8d6wdAydOVljavkgHPG0IMbiVG1WT57oM3HQpejgpujlKDDsI +bi9/lbcC/U0JoN9yAaJZFr7CXJrxRv8DWeTwzMTo203KHNu9roQiERd38P8Dp6AQ +ivmqf0+0VZM3IpjWBYKM68tclHJcG+7wyFjvAgMBAAGjMjAwMB0GA1UdDgQWBBSN +lFyR56zh67mnvYTmmgJQVxEJrjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB +DAUAA4ICAQBczmFY0kmr1FK50glkT282ur0vukNtwXQNJONof3rYRqP2W98jID6D +ayma0B4/H1EqCa0d66wRBxFdwW+MqOc4uWD3uUwgazrYD/Bv+V3aumaw8yX6vbyL +hLNfpd4pViAEGtzYxYfMfFR6uzInF3NMpvt8OXCSGKiQjDMnMs0ekvUZLJm7yxwT +Qr9aAEFYQYM/GstUC6qFfuUa4MaGvmyKWhZ10JoKXYbGGeFU4wI7Kzifh3VvawTg +r314ZvQ3zpEwzNJpdvT5ZKuPvyN+drAKFpSPfOTFmmb3uF95FgYq33OFPpo7SR43 +tnw5u5YqKnsHmqCIRMctWiYZc8rBJ3+eBGmke6z/AN6FraG6Ejc8e4WPclrB8STb ++oB3a4Cvri1VHyodkm50Sb/d1FAMDXvzEPBfu2D0dVvOwOcISSN/MQUom8NN4YeI +aEATdAPNkokgehOzZ1OPRv47FKYEVPCXjaZEWAC7NNmNiRn4RQOti0DlNrLL7Nx9 +vK09G0EnW01MO2ARRkZ3dog+Ph7orJQV3sd7TO4EEortqWtbegSH75ylyYw6rt/j +uBzYtMOnEtnQKhxj4Wj7PO+StCgspoOByn0d+iSgDd2TlpWm4naP2pfFZT0R+TOH +wzSH0F47TSfRd0++uEz/QhViybrvQK7yMt1G1YwZp2im+imuWwUC8Q== +-----END CERTIFICATE----- diff --git a/certService/helm/aaf-cert-service/resources/truststore.jks b/certService/helm/aaf-cert-service/resources/truststore.jks new file mode 100644 index 00000000..c32d37fd Binary files /dev/null and b/certService/helm/aaf-cert-service/resources/truststore.jks differ diff --git a/certService/helm/aaf-cert-service/templates/deployment.yaml b/certService/helm/aaf-cert-service/templates/deployment.yaml index f8b2d43f..f4a28f46 100644 --- a/certService/helm/aaf-cert-service/templates/deployment.yaml +++ b/certService/helm/aaf-cert-service/templates/deployment.yaml @@ -16,27 +16,52 @@ spec: - name: {{ .Values.volume.name }} secret: secretName: {{ .Values.secret.name }} + - name: {{ .Values.tls.server.volume.name }} + secret: + secretName: {{ .Values.tls.server.secret.name }} containers: - name: aaf-cert-service image: {{ .Values.repository }}/{{ .Values.image }} imagePullPolicy: {{ .Values.pullPolicy }} ports: - containerPort: {{ .Values.containerPort }} + env: + - name: HTTPS_PORT + value: "{{ .Values.containerPort }}" + - name: KEYSTORE_PATH + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.jksName }}" + - name: KEYSTORE_P12_PATH + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.p12Name }}" + - name: TRUSTSTORE_PATH + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.jksName }}" + - name: ROOT_CERT + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.crtName }}" + - name: KEYSTORE_PASSWORD + value: "{{ .Values.envs.keystore.password }}" + - name: TRUSTSTORE_PASSWORD + value: "{{ .Values.envs.truststore.password }}" livenessProbe: - httpGet: - port: {{ .Values.containerPort }} - path: {{ .Values.liveness.path }} + exec: + command: + - /bin/bash + - -c + - {{ .Values.liveness.command }} initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }} periodSeconds: {{ .Values.liveness.periodSeconds }} readinessProbe: - httpGet: - port: {{ .Values.containerPort }} - path: {{ .Values.readiness.path }} + exec: + command: + - /bin/bash + - -c + - {{ .Values.readiness.command }} initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} periodSeconds: {{ .Values.readiness.periodSeconds }} volumeMounts: - name: {{ .Values.volume.name }} mountPath: {{ .Values.volume.mountPath }} readOnly: true + - name: {{ .Values.tls.server.volume.name }} + mountPath: {{ .Values.tls.server.volume.mountPath }} + readOnly: true resources: {{ toYaml .Values.resources }} diff --git a/certService/helm/aaf-cert-service/templates/secret_client_tls.yaml b/certService/helm/aaf-cert-service/templates/secret_client_tls.yaml new file mode 100644 index 00000000..b80a4af4 --- /dev/null +++ b/certService/helm/aaf-cert-service/templates/secret_client_tls.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.tls.client.secret.name }} +type: Opaque +data: + certServiceClient-keystore.jks: + {{ (.Files.Glob "resources/certServiceClient-keystore.jks").AsSecrets }} + truststore.jks: + {{ (.Files.Glob "resources/truststore.jks").AsSecrets }} diff --git a/certService/helm/aaf-cert-service/templates/secret_server_tls.yaml b/certService/helm/aaf-cert-service/templates/secret_server_tls.yaml new file mode 100644 index 00000000..535e3dbd --- /dev/null +++ b/certService/helm/aaf-cert-service/templates/secret_server_tls.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.tls.server.secret.name }} +type: Opaque +data: + certServiceServer-keystore.jks: + {{ (.Files.Glob "resources/certServiceServer-keystore.jks").AsSecrets }} + certServiceServer-keystore.p12: + {{ (.Files.Glob "resources/certServiceServer-keystore.p12").AsSecrets }} + truststore.jks: + {{ (.Files.Glob "resources/truststore.jks").AsSecrets }} + root.crt: + {{ (.Files.Glob "resources/root.crt").AsSecrets }} \ No newline at end of file diff --git a/certService/helm/aaf-cert-service/templates/service.yaml b/certService/helm/aaf-cert-service/templates/service.yaml index fba7e5fa..f3c0ee0c 100644 --- a/certService/helm/aaf-cert-service/templates/service.yaml +++ b/certService/helm/aaf-cert-service/templates/service.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: {{ .Chart.Name }}-service + name: {{ .Chart.Name }} spec: type: {{ .Values.service.type }} selector: diff --git a/certService/helm/aaf-cert-service/values.yaml b/certService/helm/aaf-cert-service/values.yaml index 0dab1e32..efb16a5a 100644 --- a/certService/helm/aaf-cert-service/values.yaml +++ b/certService/helm/aaf-cert-service/values.yaml @@ -3,17 +3,17 @@ replicaCount: 1 repository: nexus3.onap.org:10001 image: onap/org.onap.aaf.certservice.aaf-certservice-api:1.0.0 pullPolicy: Always -containerPort: 8080 +containerPort: 8443 service: type: ClusterIP liveness: initialDelaySeconds: 60 periodSeconds: 10 - path: /actuator/health + command: curl https://localhost:$HTTPS_PORT/actuator/health --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD readiness: initialDelaySeconds: 30 periodSeconds: 10 - path: /ready + command: curl https://localhost:$HTTPS_PORT/ready --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD volume: name: aaf-cert-service-volume mountPath: /etc/onap/aaf/certservice @@ -28,3 +28,25 @@ resources: secret: name: aaf-cert-service-secret + +tls: + server: + secret: + name: aaf-cert-service-server-tls-secret + volume: + name: aaf-cert-service-server-tls-volume + mountPath: /etc/onap/aaf/certservice/certs/ + client: + secret: + name: aaf-cert-service-client-tls-secret + +envs: + keystore: + jksName: certServiceServer-keystore.jks + p12Name: certServiceServer-keystore.p12 + password: secret + truststore: + jksName: truststore.jks + crtName: root.crt + password: secret + diff --git a/certService/src/main/resources/application.properties b/certService/src/main/resources/application.properties index 9ccdd326..c5d14370 100644 --- a/certService/src/main/resources/application.properties +++ b/certService/src/main/resources/application.properties @@ -9,3 +9,14 @@ springdoc.swagger-ui.path=/docs # AAF CertService app specific configuration app.config.path=/etc/onap/aaf/certservice + +# Mutual TLS configuration +server.ssl.enabled=true +server.ssl.client-auth=need +server.port=${HTTPS_PORT:8443} + +server.ssl.key-store=${KEYSTORE_PATH:/etc/onap/aaf/certservice/certs/certServiceServer-keystore.jks} +server.ssl.key-store-password=${KEYSTORE_PASSWORD:secret} + +server.ssl.trust-store=${TRUSTSTORE_PATH:/etc/onap/aaf/certservice/certs/truststore.jks} +server.ssl.trust-store-password=${TRUSTSTORE_PASSWORD:secret} diff --git a/certService/src/test/resources/application.properties b/certService/src/test/resources/application.properties index 39001571..b70ab3b4 100644 --- a/certService/src/test/resources/application.properties +++ b/certService/src/test/resources/application.properties @@ -1,2 +1,13 @@ # AAF CertService app specific configuration app.config.path=./src/test/resources + +# Mutual TLS configuration +server.ssl.enabled=true +server.ssl.client-auth=need +server.port=${HTTPS_PORT:8443} + +server.ssl.key-store=${KEYSTORE_PATH:/etc/onap/aaf/certservice/certs/certServiceServer-keystore.jks} +server.ssl.key-store-password=${KEYSTORE_PASSWORD:secret} + +server.ssl.trust-store=${TRUSTSTORE_PATH:/etc/onap/aaf/certservice/certs/truststore.jks} +server.ssl.trust-store-password=${TRUSTSTORE_PASSWORD:secret} \ No newline at end of file -- cgit 1.2.3-korg