RFC-8040 migration

[sdnc/oam.git] / docs / cert_installation.rst

diff --git a/docs/cert_installation.rst b/docs/cert_installation.rst
index 8e665c2..424ac60 100644 (file)
--- a/docs/cert_installation.rst
+++ b/docs/cert_installation.rst
@@ -95,12 +95,13 @@ Once you have this downloaded you need to go the following location.
 
        */oam/installation/src/main/yaml*
 
 
        */oam/installation/src/main/yaml*
 

-Once you are there you need to edit the docker-compose.yaml file to include your directory where you have the zip file and certs.properties located. 
+Once you are there you need to edit the docker-compose.yaml file to map the zip file and certs.properties file into the container. 

 
 You need to add in the following lines into the yaml file just below *container_name: sdnc_controller_container* in the file::
 
        volumes:
 
 You need to add in the following lines into the yaml file just below *container_name: sdnc_controller_container* in the file::
 
        volumes:

-         - <Your_Workspace>:/opt/opendaylight/current/certs
+         - <Your_Workspace>/certs.properties:/opt/opendaylight/certs/certs.properties
+         - <Your_Workspace>/keys0.zip:/opt/opendaylight/certs/keys0.zip

 
 Once you have the mount path for your files added into the yaml file you can run the following command::
 
 
 Once you have the mount path for your files added into the yaml file you can run the following command::
 


@@ -135,7 +136,7 @@ EXAMPLE: Mounting pnf-simulator
 If you want to mount a pnf-simulator onto the SDNC container the you must have the pnf-simulator container up and running and the SDNC container running with the keys and certificates in the ODL keystore.
 
 To mount your pnf-simulator you must send the following RPC:
 If you want to mount a pnf-simulator onto the SDNC container the you must have the pnf-simulator container up and running and the SDNC container running with the keys and certificates in the ODL keystore.
 
 To mount your pnf-simulator you must send the following RPC:

-    *PUT /restconf/config/network-topology:network-topology/topology/topology-netconf/node/pnf-simulator*
+    *PUT /rests/data/network-topology:network-topology/topology/topology-netconf/node/pnf-simulator?content=config*

 
 
 You must also send this as the body of the request::
 
 
 You must also send this as the body of the request::


@@ -156,7 +157,102 @@ You must also send this as the body of the request::
      </node>
 
 
      </node>
 
 

-where IP-ADDRESS is the ip-address you are trying to mount the pnf-simulator on. 
+where IP-ADDRESS is the ip-address you are trying to mount the pnf-simulator on.
+
+
+
+
+New secure communication functionality
+=================================================================================
+
+In order to ensure secure communication on southband interface a new functionality have been introduced. The Certificate Management Protocol ver. 2 (CMPv2) is handled by the AAF microservice CertService.
+
+SDNC is capable of obtaining certificates signed by an external Certificate Authority to secure external ONAP communication.
+
+Confirmation of this functionality can be performed in OOM using the Contrib projects EJBCA service.
+
+Firstly, CertService will need to be deployed. This will require the global flag *global.cmpv2Enabled* to be set to true in *kubernetes/onap/resources/overrides/aaf-cert-service-environment.yaml*
+
+There is also an additional module that will need to be deployed named platform. This is required for secret creation.
+
+To deploy the EJBCA server the global flag *global.addTestingComponents* in  *kubernetes/onap/values.yaml* will need to be set to true. This flag will load the test configuration from *kubernetes/aaf/charts/aaf-cert-service/resources/test/cmpServers.json*
+
+
+
+cmpServers.json:
+
+.. code-block:: json
+
+    {
+      "cmpv2Servers": [
+        {
+          "caName": "Client",
+          "url": "http://aafcert-ejbca:8080/ejbca/publicweb/cmp/cmp",
+          "issuerDN": "CN=ManagementCA",
+          "caMode": "CLIENT",
+          "authentication": {
+            "iak": "mypassword",
+            "rv": "mypassword"
+          }
+        },
+        {
+          "caName": "RA",
+          "url": "http://aafcert-ejbca:8080/ejbca/publicweb/cmp/cmpRA",
+          "issuerDN": "CN=ManagementCA",
+          "caMode": "RA",
+          "authentication": {
+            "iak": "mypassword",
+            "rv": "mypassword"
+          }
+        }
+      ]
+    }
+
+
+
+SDNC invokes the CertService in a new initContainer called certs-init.
+
+There are a number of variables used that can be configured and these are available in *kubernetes/onap/values.yaml* under aaf/certServiceClient
+
+
+
+CertService configuration:
+
+.. code-block:: yaml
+
+ aaf:
+    certServiceClient:
+      image: onap/org.onap.aaf.certservice.aaf-certservice-client:1.0.0
+      secret:
+        name: aaf-cert-service-client-tls-secret
+        mountPath: /etc/onap/aaf/certservice/certs/
+      envVariables:
+        # Certificate related
+        cmpv2Organization: "Linux-Foundation"
+        cmpv2OrganizationalUnit: "ONAP"
+        cmpv2Location: "San-Francisco"
+        cmpv2State: "California"
+        cmpv2Country: "US"
+        # Client configuration related
+        caName: "RA"
+        requestURL: "https://aaf-cert-service:8443/v1/certificate/"
+        requestTimeout: "20000"
+        keystorePath: "/etc/onap/aaf/certservice/certs/certServiceClient-keystore.jks"
+        keystorePassword: "secret"
+        truststorePath: "/etc/onap/aaf/certservice/certs/truststore.jks"
+        truststorePassword: "secret"
+
+
+
+
+For more information:
+
++------------------------------------------------------------------------------------------+
+|https://onap-doc.readthedocs.io/en/latest/submodules/aaf/certservice.git/docs/index.html  |
++------------------------------------------------------------------------------------------+
+|https://doc.primekey.com/ejbca                                                            |
++------------------------------------------------------------------------------------------+
+

 
 
 
 
 
 


@@ -192,7 +288,7 @@ This is used to add the list of CA’s and server certificates from the xnf as t
 Checking Correct Certs Installation
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 If you would like to run a check to make sure that your keys and certificates were installed correctly in ODL you can run the following command in Postman REST client:
 Checking Correct Certs Installation
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 If you would like to run a check to make sure that your keys and certificates were installed correctly in ODL you can run the following command in Postman REST client:

-       *GET http://localhost:8282/restconf/config/netconf-keystore:keystore*
+       *GET http://localhost:8282/rests/data/netconf-keystore:keystore?content=config*

 
 The authorization that is needed to gain access to ODL’s restconf interface is the default SDNC username and password. 
 
 
 The authorization that is needed to gain access to ODL’s restconf interface is the default SDNC username and password.