From: Remigiusz Janeczek Date: Fri, 16 Oct 2020 09:08:09 +0000 (+0200) Subject: [OOM-K8S-CERT-EXTERNAL-PROVIDER] Provide certs to CMPv2 Issuer X-Git-Tag: 2.2.0~16^2 X-Git-Url: https://gerrit.onap.org/r/gitweb?a=commitdiff_plain;h=f85be7d76bf73d59dd4d70ffd07f1e34dfd1a2ef;p=oom%2Fplatform%2Fcert-service.git [OOM-K8S-CERT-EXTERNAL-PROVIDER] Provide certs to CMPv2 Issuer Format code Issue-ID: OOM-2559 Signed-off-by: Remigiusz Janeczek Change-Id: I88346b96657606b010aa8d7da0f8b86d1844f9d7 --- diff --git a/certServiceK8sExternalProvider/README.md b/certServiceK8sExternalProvider/README.md index 57ca5930..3fc00f90 100644 --- a/certServiceK8sExternalProvider/README.md +++ b/certServiceK8sExternalProvider/README.md @@ -9,13 +9,21 @@ There are two methods for building the project: ### Installation +Create secret with certificates for communication between CMPv2Issuer and Cert Service API: +``` +kubectl create secret generic -n onap cmpv2-issuer-secret --from-file=/certs/cmpv2Issuer-key.pem + --from-file=/certs/cmpv2Issuer-cert.pem --from-file=/certs/cacert.pem +``` + Apply k8s files from 'deploy' directory in following order: - crd.yaml - roles.yaml - deployment.yaml - - configuration.yaml + - configuration.yaml (certRef, keyRef and cacertRef should match file names if secret was created with command listed + above) +**Note:** Files and installation are currently examples, which should be used as a guide for OOM Helm Charts implementation ### Usage diff --git a/certServiceK8sExternalProvider/deploy/configuration.yaml b/certServiceK8sExternalProvider/deploy/configuration.yaml index 95c38d75..4a0f2dc6 100644 --- a/certServiceK8sExternalProvider/deploy/configuration.yaml +++ b/certServiceK8sExternalProvider/deploy/configuration.yaml @@ -28,7 +28,10 @@ metadata: name: cmpv2-issuer namespace: onap spec: - url: https://certservice.default.svc.cluster.local - keyRef: - name: certservice-key - key: key + url: https://oom-cert-service:8443/v1/certificate/ + caName: RA + certSecretRef: + name: cmpv2-issuer-secret + certRef: cmpv2Issuer-cert.pem + keyRef: cmpv2Issuer-key.pem + cacertRef: cacert.pem diff --git a/certServiceK8sExternalProvider/deploy/crd.yaml b/certServiceK8sExternalProvider/deploy/crd.yaml index 1d45b0c9..cc884388 100644 --- a/certServiceK8sExternalProvider/deploy/crd.yaml +++ b/certServiceK8sExternalProvider/deploy/crd.yaml @@ -58,27 +58,41 @@ spec: description: CMPv2IssuerSpec defines the desired state of CMPv2Issuer properties: url: - description: URL is the base URL for the certservice certificates instance. + description: URL to CertService API. type: string - keyRef: - description: keyRef is a reference to a Secret containing the - cmpv2provisioner password used to decrypt the cmpv2provisioner private key. + caName: + description: Name of the external CA server configured on CertService API side. + type: string + certSecretRef: + description: Reference to K8s secret which contains certificate, private key and CA certificate + needed to connect to CertService API (which requires client certificate authentication) properties: - key: - description: The key of the secret to select from. Must be a + name: + description: The name of K8s secret to select certificates from. Secret must be in the same + namespace as CMPv2Issuer. + type: string + keyRef: + description: The key of the secret to select private key from. Must be a valid secret key. type: string - name: - description: The name of the secret in the pod's namespace to - select from. + certRef: + description: The key of the secret to select cert from. Must be a + valid secret key. + type: string + cacertRef: + description: The key of the secret to select cacert from. Must be a + valid secret key. type: string required: - name - - key + - keyRef + - certRef + - cacertRef type: object required: - url - - keyRef + - caName + - certSecretRef type: object status: description: CMPv2IssuerStatus defines the observed state of CMPv2Issuer diff --git a/certServiceK8sExternalProvider/main.go b/certServiceK8sExternalProvider/main.go index 8e5d36cb..57058e9e 100644 --- a/certServiceK8sExternalProvider/main.go +++ b/certServiceK8sExternalProvider/main.go @@ -28,18 +28,20 @@ package main import ( "flag" "fmt" + "os" + certmanager "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" "k8s.io/apimachinery/pkg/runtime" clientgoscheme "k8s.io/client-go/kubernetes/scheme" _ "k8s.io/client-go/plugin/pkg/client/auth/gcp" "k8s.io/utils/clock" - app "onap.org/oom-certservice/k8s-external-provider/src" - certserviceapi "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" - controllers "onap.org/oom-certservice/k8s-external-provider/src/cmpv2controller" - "os" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/log/zap" "sigs.k8s.io/controller-runtime/pkg/manager" + + app "onap.org/oom-certservice/k8s-external-provider/src" + certserviceapi "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" + controllers "onap.org/oom-certservice/k8s-external-provider/src/cmpv2controller" ) var ( @@ -107,7 +109,7 @@ func createControllerManager(metricsAddr string, enableLeaderElection bool) mana return manager } -func registerCMPv2IssuerController(manager manager.Manager) { +func registerCMPv2IssuerController(manager manager.Manager) { setupLog.Info("Registering CMPv2IssuerController...") err := (&controllers.CMPv2IssuerController{ diff --git a/certServiceK8sExternalProvider/main_test.go b/certServiceK8sExternalProvider/main_test.go index d74fe0d3..0ad70246 100644 --- a/certServiceK8sExternalProvider/main_test.go +++ b/certServiceK8sExternalProvider/main_test.go @@ -21,14 +21,15 @@ package main import ( + "flag" "os" "testing" + "github.com/stretchr/testify/assert" - "flag" ) func Test_shouldParseArguments_defaultValues(t *testing.T) { - os.Args = []string { + os.Args = []string{ "first-arg-is-omitted-by-method-parse-arguments-so-this-only-a-placeholder"} flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ExitOnError) @@ -39,10 +40,10 @@ func Test_shouldParseArguments_defaultValues(t *testing.T) { } func Test_shouldParseArguments_valuesFromCLI(t *testing.T) { - os.Args = []string { + os.Args = []string{ "first-arg-is-omitted-by-method-parse-arguments-so-this-only-a-placeholder", "--metrics-addr=127.0.0.1:555", - "--enable-leader-election=true" } + "--enable-leader-election=true"} flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ExitOnError) metricsAddr, enableLeaderElection := parseInputArguments() diff --git a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info.go b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info.go index 996cf21a..ec4d6835 100644 --- a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info.go +++ b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info.go @@ -42,4 +42,3 @@ var ( ) const CMPv2IssuerKind = "CMPv2Issuer" - diff --git a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info_test.go b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info_test.go index b95bded5..eae6a2c8 100644 --- a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info_test.go +++ b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_groupversion_info_test.go @@ -22,6 +22,7 @@ package cmpv2api import ( "testing" + "github.com/stretchr/testify/assert" ) @@ -33,4 +34,3 @@ func Test_shouldHaveRightGroupVersion(t *testing.T) { func Test_shouldRightIssuerKind(t *testing.T) { assert.Equal(t, "CMPv2Issuer", CMPv2IssuerKind) } - diff --git a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_deepcopy.go b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_deepcopy.go index 68e79ce1..83785ab9 100644 --- a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_deepcopy.go +++ b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_deepcopy.go @@ -125,7 +125,7 @@ func (inputIssuerList *CMPv2IssuerList) DeepCopyObject() runtime.Object { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (inputIssuerSpec *CMPv2IssuerSpec) DeepCopyInto(outIssuerSpec *CMPv2IssuerSpec) { *outIssuerSpec = *inputIssuerSpec - outIssuerSpec.KeyRef = inputIssuerSpec.KeyRef + outIssuerSpec.CertSecretRef = inputIssuerSpec.CertSecretRef } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CMPv2IssuerSpec. diff --git a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_schema.go b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_schema.go index f2482657..f26dc876 100644 --- a/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_schema.go +++ b/certServiceK8sExternalProvider/src/cmpv2api/cmpv2_issuer_crd_schema.go @@ -37,10 +37,10 @@ func init() { type CMPv2IssuerSpec struct { // URL is the base URL for the CertService certificates instance. URL string `json:"url"` - + // CaName is the name of the external CA server + CaName string `json:"caName"` // KeyRef is a reference to a Secret containing the provisioner - // password used to decrypt the provisioner private key. - KeyRef SecretKeySelector `json:"keyRef"` + CertSecretRef SecretKeySelector `json:"certSecretRef"` } // CMPv2IssuerStatus defines the observed state of CMPv2Issuer @@ -72,9 +72,12 @@ type SecretKeySelector struct { // The name of the secret in the pod's namespace to select from. Name string `json:"name"` - // The key of the secret to select from. Must be a valid secret key. - // +optional - Key string `json:"key,omitempty"` + // The key of the secret to select private key from. Must be a valid secret key. + KeyRef string `json:"keyRef,omitempty"` + // The key of the secret to select cert from. Must be a valid secret key. + CertRef string `json:"certRef,omitempty"` + // The key of the secret to select cacert from. Must be a valid secret key. + CacertRef string `json:"cacertRef,omitempty"` } // ConditionType represents a CMPv2Issuer condition type. diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go index 38b5cdf3..54b4b103 100644 --- a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go +++ b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go @@ -28,8 +28,6 @@ package cmpv2controller import ( "context" "fmt" - "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" - provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner" "github.com/go-logr/logr" apiutil "github.com/jetstack/cert-manager/pkg/api/util" @@ -41,6 +39,9 @@ import ( "k8s.io/client-go/tools/record" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" + + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" + provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner" ) // CertificateRequestController reconciles a CMPv2Issuer object. @@ -144,7 +145,6 @@ func (controller *CertificateRequestController) setStatus(ctx context.Context, c return controller.Client.Status().Update(ctx, certificateRequest) } - func isCMPv2IssuerReady(issuer cmpv2api.CMPv2Issuer) bool { condition := cmpv2api.CMPv2IssuerCondition{Type: cmpv2api.ConditionReady, Status: cmpv2api.ConditionTrue} return hasCondition(issuer, condition) @@ -183,12 +183,12 @@ func (controller *CertificateRequestController) handleErrorCMPv2IssuerIsNotReady return err } -func (controller *CertificateRequestController) handleErrorGettingCMPv2Issuer(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest, issuerNamespaceName types.NamespacedName, req ctrl.Request) { +func (controller *CertificateRequestController) handleErrorGettingCMPv2Issuer(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest, issuerNamespaceName types.NamespacedName, req ctrl.Request) { log.Error(err, "Failed to retrieve CMPv2Issuer resource", "namespace", req.Namespace, "name", certificateRequest.Spec.IssuerRef.Name) _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to retrieve CMPv2Issuer resource %s: %v", issuerNamespaceName, err) } -func (controller *CertificateRequestController) handleErrorFailedToSignCertificate(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest) { +func (controller *CertificateRequestController) handleErrorFailedToSignCertificate(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest) { log.Error(err, "Failed to sign certificate request") _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonFailed, "Failed to sign certificate request: %v", err) } diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go index 7e55f36f..2c401cce 100644 --- a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go +++ b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go @@ -21,10 +21,10 @@ package cmpv2controller import ( - cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" "testing" - "github.com/stretchr/testify/assert" + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" + "github.com/stretchr/testify/assert" ) const group = "certmanager.onap.org" @@ -43,7 +43,6 @@ func Test_shouldBeInvalidCMPv2CertificateRequest_whenKindIsCertificateRequest(t assert.False(t, isCMPv2CertificateRequest(request)) } - func Test_shouldBeValidCMPv2CertificateRequest_whenKindIsCMPvIssuer(t *testing.T) { request := new(cmapi.CertificateRequest) request.Spec.IssuerRef.Group = group @@ -51,4 +50,3 @@ func Test_shouldBeValidCMPv2CertificateRequest_whenKindIsCMPvIssuer(t *testing.T assert.True(t, isCMPv2CertificateRequest(request)) } - diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go index f57f5677..1b4e5312 100644 --- a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go +++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go @@ -28,6 +28,7 @@ package cmpv2controller import ( "context" "fmt" + "github.com/go-logr/logr" core "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" @@ -35,10 +36,11 @@ import ( "k8s.io/apimachinery/pkg/types" "k8s.io/client-go/tools/record" "k8s.io/utils/clock" - "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" - provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" + + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" + provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner" ) // CMPv2IssuerController reconciles a CMPv2Issuer object @@ -74,21 +76,18 @@ func (controller *CMPv2IssuerController) Reconcile(req ctrl.Request) (ctrl.Resul var secret core.Secret secretNamespaceName := types.NamespacedName{ Namespace: req.Namespace, - Name: issuer.Spec.KeyRef.Name, + Name: issuer.Spec.CertSecretRef.Name, } if err := controller.loadResource(ctx, secretNamespaceName, &secret); err != nil { handleErrorInvalidSecret(ctx, log, err, statusUpdater, secretNamespaceName) return ctrl.Result{}, err } - password, ok := secret.Data[issuer.Spec.KeyRef.Key] - if !ok { - err := handleErrorSecretNotFound(ctx, log, issuer, statusUpdater, secretNamespaceName, secret) - return ctrl.Result{}, err - } // 4. Create CMPv2 provisioner and store the instance for further use - provisioner, err := provisioners.New(issuer, password) + provisioner, err := provisioners.CreateProvisioner(issuer, secret) if err != nil { + log.Error(err, "failed to initialize provisioner") + statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "Error", "Failed to initialize provisioner: %v", err) handleErrorProvisionerInitialization(ctx, log, err, statusUpdater) return ctrl.Result{}, err } @@ -103,7 +102,6 @@ func (controller *CMPv2IssuerController) Reconcile(req ctrl.Request) (ctrl.Resul return ctrl.Result{}, nil } - func (controller *CMPv2IssuerController) SetupWithManager(manager ctrl.Manager) error { return ctrl.NewControllerManagedBy(manager). For(&cmpv2api.CMPv2Issuer{}). @@ -114,18 +112,22 @@ func (controller *CMPv2IssuerController) loadResource(ctx context.Context, key c return controller.Client.Get(ctx, key, obj) } - func validateCMPv2IssuerSpec(issuerSpec cmpv2api.CMPv2IssuerSpec, log logr.Logger) error { switch { - case issuerSpec.URL == "": - return fmt.Errorf("spec.url cannot be empty") - case issuerSpec.KeyRef.Name == "": - return fmt.Errorf("spec.keyRef.name cannot be empty") - case issuerSpec.KeyRef.Key == "": - return fmt.Errorf("spec.keyRef.key cannot be empty") - default: - log.Info("CMPv2Issuer validated. ") - return nil + case issuerSpec.URL == "": + return fmt.Errorf("spec.url cannot be empty") + case issuerSpec.CaName == "": + return fmt.Errorf("spec.caName cannot be empty") + case issuerSpec.CertSecretRef.Name == "": + return fmt.Errorf("spec.certSecretRef.name cannot be empty") + case issuerSpec.CertSecretRef.KeyRef == "": + return fmt.Errorf("spec.certSecretRef.keyRef cannot be empty") + case issuerSpec.CertSecretRef.CertRef == "": + return fmt.Errorf("spec.certSecretRef.certRef cannot be empty") + case issuerSpec.CertSecretRef.CacertRef == "": + return fmt.Errorf("spec.certSecretRef.cacertRef cannot be empty") + default: + return nil } } @@ -134,22 +136,19 @@ func updateCMPv2IssuerStatusToVerified(statusUpdater *CMPv2IssuerStatusUpdater, return statusUpdater.Update(ctx, cmpv2api.ConditionTrue, Verified, "CMPv2Issuer verified and ready to sign certificates") } - // Error handling func handleErrorUpdatingCMPv2IssuerStatus(log logr.Logger, err error) { log.Error(err, "Failed to update CMPv2Issuer status") } - func handleErrorLoadingCMPv2Issuer(log logr.Logger, err error) { log.Error(err, "Failed to retrieve CMPv2Issuer resource") } - func handleErrorProvisionerInitialization(ctx context.Context, log logr.Logger, err error, statusUpdater *CMPv2IssuerStatusUpdater) { log.Error(err, "Failed to initialize provisioner") - statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, Error, "Failed initialize provisioner") + statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, Error, "Failed to initialize provisioner: %v", err) } func handleErrorCMPv2IssuerValidation(ctx context.Context, log logr.Logger, err error, statusUpdater *CMPv2IssuerStatusUpdater) { @@ -157,13 +156,6 @@ func handleErrorCMPv2IssuerValidation(ctx context.Context, log logr.Logger, err statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, ValidationFailed, "Failed to validate resource: %v", err) } -func handleErrorSecretNotFound(ctx context.Context, log logr.Logger, issuer *cmpv2api.CMPv2Issuer, statusUpdater *CMPv2IssuerStatusUpdater, secretNamespaceName types.NamespacedName, secret core.Secret) error { - err := fmt.Errorf("secret %s does not contain key %s", secret.Name, issuer.Spec.KeyRef.Key) - log.Error(err, "Failed to retrieve CMPv2Issuer provisioner secret", "namespace", secretNamespaceName.Namespace, "name", secretNamespaceName.Name) - statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, NotFound, "Failed to retrieve provisioner secret: %v", err) - return err -} - func handleErrorInvalidSecret(ctx context.Context, log logr.Logger, err error, statusUpdater *CMPv2IssuerStatusUpdater, secretNamespaceName types.NamespacedName) { log.Error(err, "Failed to retrieve CMPv2Issuer provisioner secret", "namespace", secretNamespaceName.Namespace, "name", secretNamespaceName.Name) if apierrors.IsNotFound(err) { diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go index 8409ea78..79c78ed5 100644 --- a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go +++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go @@ -21,13 +21,22 @@ package cmpv2controller import ( + "testing" + "github.com/go-logr/logr" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/mock" + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" - "testing" ) +func Test_shouldBeValidCMPv2IssuerSpec_whenAllFieldsAreSet(t *testing.T) { + spec := getValidCMPv2IssuerSpec() + + err := validateCMPv2IssuerSpec(spec, &MockLogger{}) + assert.Nil(t, err) +} + func Test_shouldBeInvalidCMPv2IssuerSpec_whenSpecIsEmpty(t *testing.T) { spec := cmpv2api.CMPv2IssuerSpec{} err := validateCMPv2IssuerSpec(spec, nil) @@ -35,32 +44,50 @@ func Test_shouldBeInvalidCMPv2IssuerSpec_whenSpecIsEmpty(t *testing.T) { } func Test_shouldBeInvalidCMPv2IssuerSpec_whenNotAllFieldsAreSet(t *testing.T) { - spec := cmpv2api.CMPv2IssuerSpec{} - spec.URL = "https://localhost" - spec.KeyRef = cmpv2api.SecretKeySelector{} - spec.KeyRef.Name = "secret-key" + setEmptyFieldFunctions := map[string]func(spec *cmpv2api.CMPv2IssuerSpec){ + "emptyUrl": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.URL = "" }, + "empryCaName": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CaName = "" }, + "emptySecretName": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.Name = "" }, + "emptySecretKeyRef": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.KeyRef = "" }, + "emptySecretCertRef": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.CertRef = "" }, + "emptySecretCaertRef": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.CacertRef = "" }, + } - err := validateCMPv2IssuerSpec(spec, &MockLogger{}) - assert.NotNil(t, err) + for caseName, setEmptyFieldFunction := range setEmptyFieldFunctions { + t.Run(caseName, func(t *testing.T) { + test_shouldBeInvalidCMPv2IssuerSpec_whenFunctionApplied(t, setEmptyFieldFunction) + }) + } } -func Test_shouldBeValidCMPv2IssuerSpec_whenAllFieldsAreSet(t *testing.T) { - spec := cmpv2api.CMPv2IssuerSpec{} - spec.URL = "https://localhost" - spec.KeyRef = cmpv2api.SecretKeySelector{} - spec.KeyRef.Name = "secret-key" - spec.KeyRef.Key = "the-key" +func test_shouldBeInvalidCMPv2IssuerSpec_whenFunctionApplied(t *testing.T, transformSpec func(spec *cmpv2api.CMPv2IssuerSpec)) { + spec := getValidCMPv2IssuerSpec() + transformSpec(&spec) + err := validateCMPv2IssuerSpec(spec, nil) + assert.NotNil(t, err) +} - err := validateCMPv2IssuerSpec(spec, &MockLogger{}) - assert.Nil(t, err) +func getValidCMPv2IssuerSpec() cmpv2api.CMPv2IssuerSpec { + issuerSpec := cmpv2api.CMPv2IssuerSpec{ + URL: "https://oom-cert-service:8443/v1/certificate/", + CaName: "RA", + CertSecretRef: cmpv2api.SecretKeySelector{ + Name: "issuer-cert-secret", + KeyRef: "cmpv2Issuer-key.pem", + CertRef: "cmpv2Issuer-cert.pem", + CacertRef: "cacert.pem", + }, + } + return issuerSpec } type MockLogger struct { mock.Mock } -func (m *MockLogger) Info(msg string, keysAndValues ...interface{}) {} + +func (m *MockLogger) Info(msg string, keysAndValues ...interface{}) {} func (m *MockLogger) Error(err error, msg string, keysAndValues ...interface{}) {} -func (m *MockLogger) Enabled() bool { return false } -func (m *MockLogger) V(level int) logr.Logger { return m } -func (m *MockLogger) WithValues(keysAndValues ...interface{}) logr.Logger { return m } -func (m *MockLogger) WithName(name string) logr.Logger { return m } +func (m *MockLogger) Enabled() bool { return false } +func (m *MockLogger) V(level int) logr.Logger { return m } +func (m *MockLogger) WithValues(keysAndValues ...interface{}) logr.Logger { return m } +func (m *MockLogger) WithName(name string) logr.Logger { return m } diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go index 017e36a4..f07101db 100644 --- a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go +++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go @@ -28,9 +28,11 @@ package cmpv2controller import ( "context" "fmt" + "github.com/go-logr/logr" core "k8s.io/api/core/v1" meta "k8s.io/apimachinery/pkg/apis/meta/v1" + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" ) diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go b/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go index d41712d3..fc1772e9 100644 --- a/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go +++ b/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go @@ -21,8 +21,8 @@ package cmpv2controller const ( - NotFound = "NotFound" + NotFound = "NotFound" ValidationFailed = "ValidationFailed" - Error = "Error" - Verified = "Verified" + Error = "Error" + Verified = "Verified" ) diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go index a51b8425..e48b527d 100644 --- a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner.go @@ -32,30 +32,39 @@ import ( "encoding/base64" "encoding/pem" "fmt" + "sync" + certmanager "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" "k8s.io/apimachinery/pkg/types" - "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" ctrl "sigs.k8s.io/controller-runtime" - "sync" + + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" ) var collection = new(sync.Map) type CertServiceCA struct { - name string - url string - key []byte + name string + url string + caName string + key []byte + cert []byte + cacert []byte } -func New(cmpv2Issuer *cmpv2api.CMPv2Issuer, key []byte) (*CertServiceCA, error) { +func New(cmpv2Issuer *cmpv2api.CMPv2Issuer, key []byte, cert []byte, cacert []byte) (*CertServiceCA, error) { ca := CertServiceCA{} ca.name = cmpv2Issuer.Name ca.url = cmpv2Issuer.Spec.URL + ca.caName = cmpv2Issuer.Spec.CaName ca.key = key + ca.cert = cert + ca.cacert = cacert log := ctrl.Log.WithName("cmpv2-provisioner") - log.Info("Configuring CA: ", "name", ca.name, "url", ca.url, "key", ca.key) + log.Info("Configuring CA: ", "name", ca.name, "url", ca.url, "caName", ca.caName, "key", ca.key, + "cert", ca.cert, "cacert", ca.cacert) return &ca, nil } diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go new file mode 100644 index 00000000..4a3898e7 --- /dev/null +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory.go @@ -0,0 +1,55 @@ +/* + * ============LICENSE_START======================================================= + * oom-certservice-k8s-external-provider + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package cmpv2provisioner + +import ( + "fmt" + + v1 "k8s.io/api/core/v1" + + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" +) + +func CreateProvisioner(issuer *cmpv2api.CMPv2Issuer, secret v1.Secret) (*CertServiceCA, error) { + secretKeys := issuer.Spec.CertSecretRef + key, err := readValueFromSecret(secret, secretKeys.KeyRef) + if err != nil { + return nil, err + } + cert, err := readValueFromSecret(secret, secretKeys.CertRef) + if err != nil { + return nil, err + } + cacert, err := readValueFromSecret(secret, secretKeys.CacertRef) + if err != nil { + return nil, err + } + return New(issuer, key, cert, cacert) +} + +func readValueFromSecret(secret v1.Secret, secretKey string) ([]byte, error) { + value, ok := secret.Data[secretKey] + if !ok { + err := fmt.Errorf("secret %s does not contain key %s", secret.Name, secretKey) + return nil, err + } + return value, nil +} diff --git a/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_test.go b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_test.go new file mode 100644 index 00000000..6ef33098 --- /dev/null +++ b/certServiceK8sExternalProvider/src/cmpv2provisioner/cmpv2_provisioner_factory_test.go @@ -0,0 +1,120 @@ +/* + * ============LICENSE_START======================================================= + * oom-certservice-k8s-external-provider + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package cmpv2provisioner + +import ( + "fmt" + "testing" + + "github.com/stretchr/testify/assert" + v1 "k8s.io/api/core/v1" + + "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api" +) + +const ( + secretName = "issuer-cert-secret" + url = "https://oom-cert-service:8443/v1/certificate/" + caName = "RA" + keySecretKey = "cmpv2Issuer-key.pem" + certSecretKey = "cmpv2Issuer-cert.pem" + cacertSecretKey = "cacert.pem" +) + +var ( + keySecretValue = []byte("keyData") + certSecretValue = []byte("certData") + cacertSecretValue = []byte("cacertData") +) + +func Test_shouldCreateProvisioner(t *testing.T) { + issuer, secret := getValidIssuerAndSecret() + + provisioner, _ := CreateProvisioner(&issuer, secret) + + assert.NotNil(t, provisioner) + assert.Equal(t, url, provisioner.url) + assert.Equal(t, caName, provisioner.caName) + assert.Equal(t, keySecretValue, provisioner.key) + assert.Equal(t, certSecretValue, provisioner.cert) + assert.Equal(t, cacertSecretValue, provisioner.cacert) +} + +func Test_shouldReturnError_whenSecretMissingKeyRef(t *testing.T) { + issuer, secret := getValidIssuerAndSecret() + delete(secret.Data, keySecretKey) + + provisioner, err := CreateProvisioner(&issuer, secret) + + assert.Nil(t, provisioner) + if assert.Error(t, err) { + assert.Equal(t, fmt.Errorf("secret %s does not contain key %s", secretName, keySecretKey), err) + } +} + +func Test_shouldReturnError_whenSecretMissingCertRef(t *testing.T) { + issuer, secret := getValidIssuerAndSecret() + delete(secret.Data, certSecretKey) + + provisioner, err := CreateProvisioner(&issuer, secret) + + assert.Nil(t, provisioner) + if assert.Error(t, err) { + assert.Equal(t, fmt.Errorf("secret %s does not contain key %s", secretName, certSecretKey), err) + } +} + +func Test_shouldReturnError_whenSecretMissingCacertRef(t *testing.T) { + issuer, secret := getValidIssuerAndSecret() + delete(secret.Data, cacertSecretKey) + + provisioner, err := CreateProvisioner(&issuer, secret) + + assert.Nil(t, provisioner) + if assert.Error(t, err) { + assert.Equal(t, fmt.Errorf("secret %s does not contain key %s", secretName, cacertSecretKey), err) + } +} + +func getValidIssuerAndSecret() (cmpv2api.CMPv2Issuer, v1.Secret) { + issuer := cmpv2api.CMPv2Issuer{ + Spec: cmpv2api.CMPv2IssuerSpec{ + URL: url, + CaName: caName, + CertSecretRef: cmpv2api.SecretKeySelector{ + Name: secretName, + KeyRef: keySecretKey, + CertRef: certSecretKey, + CacertRef: cacertSecretKey, + }, + }, + } + secret := v1.Secret{ + + Data: map[string][]byte{ + keySecretKey: keySecretValue, + certSecretKey: certSecretValue, + cacertSecretKey: cacertSecretValue, + }, + } + secret.Name = secretName + return issuer, secret +} diff --git a/certServiceK8sExternalProvider/src/exit_code.go b/certServiceK8sExternalProvider/src/exit_code.go index 7435c64f..4fb984d3 100644 --- a/certServiceK8sExternalProvider/src/exit_code.go +++ b/certServiceK8sExternalProvider/src/exit_code.go @@ -1,13 +1,13 @@ package app type ExitCode struct { - Code int + Code int Message string } var ( - FAILED_TO_CREATE_CONTROLLER_MANAGER = ExitCode{1, "Unable to create k8s controller manager"} + FAILED_TO_CREATE_CONTROLLER_MANAGER = ExitCode{1, "Unable to create K8s controller manager"} FAILED_TO_REGISTER_CMPv2_ISSUER_CONTROLLER = ExitCode{2, "Unable to register CMPv2Issuer controller"} FAILED_TO_REGISTER_CERT_REQUEST_CONTROLLER = ExitCode{3, "Unable to register CertificateRequestController"} - EXCEPTION_WHILE_RUNNING_CONTROLLER_MANAGER = ExitCode{4, "An exception occurs while running k8s controller manager"} + EXCEPTION_WHILE_RUNNING_CONTROLLER_MANAGER = ExitCode{4, "An exception occurs while running K8s controller manager"} ) diff --git a/certServiceK8sExternalProvider/src/exit_code_test.go b/certServiceK8sExternalProvider/src/exit_code_test.go index 8a42909a..1492036b 100644 --- a/certServiceK8sExternalProvider/src/exit_code_test.go +++ b/certServiceK8sExternalProvider/src/exit_code_test.go @@ -22,6 +22,7 @@ package app import ( "testing" + "github.com/stretchr/testify/assert" ) diff --git a/certs/Makefile b/certs/Makefile index 3dcb9cda..b684659a 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -1,9 +1,11 @@ -all: step_1 step_2 step_3 step_4 step_5 step_6 step_7 step_8 step_9 step_10 step_11 step_12 step_13 step_14 step_15 +all: step_1 step_2 step_3 step_4 step_5 step_6 step_7 step_8 step_9 step_10 step_11 step_12 step_13 step_14 step_15 \ + step_16 step_17 step_18 step_19 .PHONY: all #Clear certificates clear: @echo "Clear certificates" - rm certServiceClient-keystore.jks certServiceServer-keystore.jks root.crt truststore.jks certServiceServer-keystore.p12 + rm certServiceClient-keystore.jks certServiceServer-keystore.jks root.crt truststore.jks certServiceServer-keystore.p12 \ + cmpv2Issuer-cert.pem cmpv2Issuer-key.pem cacert.pem @echo "#####done#####" #Generate root private and public keys @@ -104,8 +106,36 @@ step_14: -destkeystore certServiceServer-keystore.p12 -deststoretype PKCS12 -deststorepass secret @echo "#####done#####" -#Clear unused certificates +#Convert certServiceClient-keystore(.jks) to PCKS12 format(.p12) step_15: + @echo "Convert certServiceServer-keystore(.jks) to PCKS12 format(.p12)" + keytool -importkeystore -srckeystore certServiceClient-keystore.jks -srcstorepass secret \ + -destkeystore certServiceClient-keystore.p12 -deststoretype PKCS12 -deststorepass secret + @echo "#####done#####" + +#Convert truststore(.jks) to PCKS12 format(.p12) +step_16: + @echo "Convert truststore(.jks) to PCKS12 format(.p12)" + keytool -importkeystore -srckeystore truststore.jks -srcstorepass secret \ + -destkeystore truststore.p12 -deststoretype PKCS12 -deststorepass secret + @echo "#####done#####" + +#Create CMPv2 Issuer PEM key pair from certServiceClient-keystore(.p12) +step_17: + @echo "Create CMPv2 Issuer key pair from certServiceClient-keystore(.p12)" + openssl pkcs12 -in certServiceServer-keystore.p12 -passin 'pass:secret' -nokeys -out cmpv2Issuer-cert.pem + openssl pkcs12 -in certServiceServer-keystore.p12 -passin 'pass:secret' -nodes -nocerts -out cmpv2Issuer-key.pem + @echo "#####done#####" + +#Convert truststore(.p12) to PEM format(.pem) +step_18: + @echo "Create CMPv2 Issuer key pair from certServiceClient-keystore(.p12)" + openssl pkcs12 -in truststore.p12 -passin 'pass:secret' -out cacert.pem + @echo "#####done#####" + +#Clear unused certificates +step_19: @echo "Clear unused certificates" - rm certServiceClientByRoot.crt certServiceClient.csr root-keystore.jks certServiceServerByRoot.crt certServiceServer.csr + rm certServiceClientByRoot.crt certServiceClient.csr root-keystore.jks certServiceServerByRoot.crt \ + certServiceServer.csr certServiceClient-keystore.p12 truststore.p12 @echo "#####done#####" diff --git a/certs/cacert.pem b/certs/cacert.pem new file mode 100644 index 00000000..26c9b3e2 --- /dev/null +++ b/certs/cacert.pem @@ -0,0 +1,40 @@ +Bag Attributes + friendlyName: root + 2.16.840.1.113894.746875.1.1: +subject=C = US, ST = California, L = San-Francisco, O = Linux-Foundation, OU = ONAP, CN = onap.org + +issuer=C = US, ST = California, L = San-Francisco, O = Linux-Foundation, OU = ONAP, CN = onap.org + +-----BEGIN CERTIFICATE----- +MIIFnjCCA4agAwIBAgIEGHBb6DANBgkqhkiG9w0BAQwFADB3MQswCQYDVQQGEwJV +UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZyYW5jaXNjbzEZ +MBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05BUDERMA8GA1UE +AxMIb25hcC5vcmcwHhcNMjAxMDE2MDkwNjUyWhcNMzAxMDE0MDkwNjUyWjB3MQsw +CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZy +YW5jaXNjbzEZMBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05B +UDERMA8GA1UEAxMIb25hcC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK +AoICAQCDBR06SSPmxUiug54/XkZbTSve183eDb+rObAOWu1c3yQHBjBAAECa4Iuq +TZGwNoK/vYXr2iryQ02Lpp77zBCypVCDrHGl15wHpkCYjNNoukoYHha+vCEstnlh +TLBPyerQpdcerHsUTaHphjdkpfLklFrfFz6SCo1kvInghFAERljOaN3/iq271IAT +epyAVDdTzQ+xzMBNQFgF3QUORh165IJ4Qd9ZVcXcjGwILGV9lw4AaISjVqIpkbLh +pwjnA4PmLdZvHr7yzT5GMxPY7QV9/7NQfknOTOSZqFX2dpsqXd7mNv/G081zDbJZ +bdyUHyAqPm4I7rZ+6frH78PoCHwAp1mOP5AzTKEYUen1PB+88lTqlmjxn8VXz8vN +55fI4YCQH6tlRuwQjl1HQyIPDXjh8OJIIn4Ig9ay9FM9CS/Jw7HkObjImhAM2MnQ +JnCAsOvXyn4jdbsGihZoXF387OgLtWCjzwZZMMBO8FnbncYgWecbnYpErr7NZxr1 +E3qB3JTsY5TAImN3NvrFIyuovf54dyrDWQhtle0cuneBBS57HSgXSeDjvVJ8Wr51 +pfRkdMBnA4ZYxJdZjkiW1ocTIexwWk1uPm0/wDUlW+ppysKHT5p290NktRUcB0bx +P4c938IumCNeNYOWiPCApeCRif860Lnh1d3TqG/WP0bTcX2HAQIDAQABozIwMDAd +BgNVHQ4EFgQUZA0N2+KNAehLqY7+CMl6Be3T9ywwDwYDVR0TAQH/BAUwAwEB/zAN +BgkqhkiG9w0BAQwFAAOCAgEAM1QDhC6dJzwEe0sf8x6ip+c/LHAElOOWX7+N/QRu +iZaccfgox6adu4BE+l9mUrqKxFBnpomzvoLfSrsOkjhj1G5uOjIuxARZnKrcwI4j +c+WucSqBBnDqyzL7+7G1Unm5+yifl5AEs2x+7ftFzogUKWa93xsQ22aNgDOz0+B6 +FL+VPC0JSLH2QGTtHJVMKiLKAj1M1rAsiuISK5KKmk9CGFJl2HAgWK4LT4cbZPT8 +2BODLKaW2qFVRJRCRJUB9HZGDz+Fn9MxNXmQf0ox++HycJlgQMsIDOUJj6B8bygI +eU0pD50RMKNC+tnaeHLRKLrGA1KaW9kku0UO/dINMdmIfi9FKGbUAoLh/2cR1bUF +XQtiKeKsH/0HWQ/M2iUpHaSSgx+xzNx/4waOL8WdZatjeqVcbRHly/lk6mq+WE81 +38i9rMZMiHwVKhbzuwYmQ4GLuAdQ/RttrULM1/4FohMhUplvugvx+fajqYf85kNR +okduFxOXt3Mc2rGdtjo/cCur1syKcjXnB+sYmzAbP2ZSkD0Lm+F7dpP2G46fL/aK +TTLHRKqVSGzCizCukPMOdo/LjBxrOMUduBungSEnpqGOCGw8n/7djVIll7eDmi8d +c4ond8czbqLhcMgaUkj6hU2IDxGTN/Hsxxx8q5MSw57pIAvuT6oHxECuGJH4tiU9 +QS4= +-----END CERTIFICATE----- diff --git a/certs/certServiceClient-keystore.jks b/certs/certServiceClient-keystore.jks index d91daa6e..7c651d60 100644 Binary files a/certs/certServiceClient-keystore.jks and b/certs/certServiceClient-keystore.jks differ diff --git a/certs/certServiceServer-keystore.jks b/certs/certServiceServer-keystore.jks index 046d7165..57a075ac 100644 Binary files a/certs/certServiceServer-keystore.jks and b/certs/certServiceServer-keystore.jks differ diff --git a/certs/certServiceServer-keystore.p12 b/certs/certServiceServer-keystore.p12 index 9ed89548..b3bb4946 100644 Binary files a/certs/certServiceServer-keystore.p12 and b/certs/certServiceServer-keystore.p12 differ diff --git a/certs/cmpv2Issuer-cert.pem b/certs/cmpv2Issuer-cert.pem new file mode 100644 index 00000000..22f42d0b --- /dev/null +++ b/certs/cmpv2Issuer-cert.pem @@ -0,0 +1,75 @@ +Bag Attributes + friendlyName: oom-cert-service + localKeyID: 54 69 6D 65 20 31 36 30 32 38 33 39 32 32 30 37 39 35 +subject=C = US, ST = California, L = San-Francisco, O = Linux-Foundation, OU = ONAP, CN = onap.org + +issuer=C = US, ST = California, L = San-Francisco, O = Linux-Foundation, OU = ONAP, CN = onap.org + +-----BEGIN CERTIFICATE----- +MIIFCzCCAvOgAwIBAgIEM8t7/jANBgkqhkiG9w0BAQwFADB3MQswCQYDVQQGEwJV +UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZyYW5jaXNjbzEZ +MBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05BUDERMA8GA1UE +AxMIb25hcC5vcmcwHhcNMjAxMDE2MDkwNjU5WhcNMjExMDE2MDkwNjU5WjB3MQsw +CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZy +YW5jaXNjbzEZMBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05B +UDERMA8GA1UEAxMIb25hcC5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQCr0qjRjcHoyMcmDBXjtern9WJXXyCAINDBzHUt0tzXQGniiIOTExetgXuI +v++h4EkgnRjUJ6esJKE+7TvgwmUKXjsycczMYHG1A9nND7pYqp3cGIeJtzOqWxCU +8u0Xm2tATb92nU4wtzZWxilBqkJrJj7i8OnuehM+GkVRfLP+qQbTQ5nxNww+e2ZL +Mg2oH7L30m7am4qgXE/RtGUr54kwWfUOA3v1YswWZF1YnXpD4oFggtbYYdUSW9Bp +SW6HNDFxQh2kiARrmOkZWLcbc7zFzR7GHG2erXB88Y7p7tUyenORYzFHg3CDth71 +ETl+Tf6HL6bzpjsa6RcIUrKXqKtnAgMBAAGjgZ4wgZswHQYDVR0OBBYEFDZ0R/yN +JNMVm4PCGh5cgWSGVD19MCkGA1UdEQEB/wQfMB2CEG9vbS1jZXJ0LXNlcnZpY2WC +CWxvY2FsaG9zdDAPBgNVHRMECDAGAQH/AgEAMB8GA1UdIwQYMBaAFGQNDdvijQHo +S6mO/gjJegXt0/csMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkq +hkiG9w0BAQwFAAOCAgEAOZCWY1t/PZFEcycxvOOcYojoFeqVatM50uq5RnKg8PmQ +ALLcuHeHUR2KdHgFXj4AykzWRCSZpv6lzFwY+iUE1iav0CGqdy2izVLvjjoP1hDt +AtUB85VpknRpvQobWp7K6MHN1teQiggHA68jAzuRS0/jTPdz17W4edtpk0t8BTZR +BPok3UVkRAda3LIEXxtayZhjnIOvYsgdieSiakENh1s54jwpvmNJ+99YOuX7+Mm4 +V5RcFdbJDz4R2TiFDLBuwfWhRTz/FkS+a9ohIasyv2eG3D5vUFxCrg62ud6sngjH +8TZfzIAqadInVB1qqvtx+DeY0h1EFTZFbXs6YZKW8n/zcCQDTDR9/ryW35QJuj3n +qkVlNpgDbUFUnqq2IIttSkKmo1X6ArQfL/kEF5eybzstYgfB2fLufihl024bGcV7 +/IJCCDQ+yH9d2CZ2fMmnxZiDy2amAENgOu1FVKQMT81+N5JTVIXQjxAOnrKXaKcl +AqnXtaPHyIEhSFa/dADLLwjdOlcgxi1KuP13Mu5sBPXB3UlvdF2as3NtchFNip3s +1xa1p4Tz8VLU0iq6bims5es5lTYPwbfe0hNycpvu4XrMy70sgabw/SLMiGx5TTh4 +D6BH2kEp451Vu0fqrSLfSmZASZzpXgyRBiT3+4sa5BXphvBwZNxLiS5tdbN4wvA= +-----END CERTIFICATE----- +Bag Attributes + friendlyName: CN=onap.org,OU=ONAP,O=Linux-Foundation,L=San-Francisco,ST=California,C=US +subject=C = US, ST = California, L = San-Francisco, O = Linux-Foundation, OU = ONAP, CN = onap.org + +issuer=C = US, ST = California, L = San-Francisco, O = Linux-Foundation, OU = ONAP, CN = onap.org + +-----BEGIN CERTIFICATE----- +MIIFnjCCA4agAwIBAgIEGHBb6DANBgkqhkiG9w0BAQwFADB3MQswCQYDVQQGEwJV +UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZyYW5jaXNjbzEZ +MBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05BUDERMA8GA1UE +AxMIb25hcC5vcmcwHhcNMjAxMDE2MDkwNjUyWhcNMzAxMDE0MDkwNjUyWjB3MQsw +CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZy +YW5jaXNjbzEZMBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05B +UDERMA8GA1UEAxMIb25hcC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK +AoICAQCDBR06SSPmxUiug54/XkZbTSve183eDb+rObAOWu1c3yQHBjBAAECa4Iuq +TZGwNoK/vYXr2iryQ02Lpp77zBCypVCDrHGl15wHpkCYjNNoukoYHha+vCEstnlh +TLBPyerQpdcerHsUTaHphjdkpfLklFrfFz6SCo1kvInghFAERljOaN3/iq271IAT +epyAVDdTzQ+xzMBNQFgF3QUORh165IJ4Qd9ZVcXcjGwILGV9lw4AaISjVqIpkbLh +pwjnA4PmLdZvHr7yzT5GMxPY7QV9/7NQfknOTOSZqFX2dpsqXd7mNv/G081zDbJZ +bdyUHyAqPm4I7rZ+6frH78PoCHwAp1mOP5AzTKEYUen1PB+88lTqlmjxn8VXz8vN +55fI4YCQH6tlRuwQjl1HQyIPDXjh8OJIIn4Ig9ay9FM9CS/Jw7HkObjImhAM2MnQ +JnCAsOvXyn4jdbsGihZoXF387OgLtWCjzwZZMMBO8FnbncYgWecbnYpErr7NZxr1 +E3qB3JTsY5TAImN3NvrFIyuovf54dyrDWQhtle0cuneBBS57HSgXSeDjvVJ8Wr51 +pfRkdMBnA4ZYxJdZjkiW1ocTIexwWk1uPm0/wDUlW+ppysKHT5p290NktRUcB0bx +P4c938IumCNeNYOWiPCApeCRif860Lnh1d3TqG/WP0bTcX2HAQIDAQABozIwMDAd +BgNVHQ4EFgQUZA0N2+KNAehLqY7+CMl6Be3T9ywwDwYDVR0TAQH/BAUwAwEB/zAN +BgkqhkiG9w0BAQwFAAOCAgEAM1QDhC6dJzwEe0sf8x6ip+c/LHAElOOWX7+N/QRu +iZaccfgox6adu4BE+l9mUrqKxFBnpomzvoLfSrsOkjhj1G5uOjIuxARZnKrcwI4j +c+WucSqBBnDqyzL7+7G1Unm5+yifl5AEs2x+7ftFzogUKWa93xsQ22aNgDOz0+B6 +FL+VPC0JSLH2QGTtHJVMKiLKAj1M1rAsiuISK5KKmk9CGFJl2HAgWK4LT4cbZPT8 +2BODLKaW2qFVRJRCRJUB9HZGDz+Fn9MxNXmQf0ox++HycJlgQMsIDOUJj6B8bygI +eU0pD50RMKNC+tnaeHLRKLrGA1KaW9kku0UO/dINMdmIfi9FKGbUAoLh/2cR1bUF +XQtiKeKsH/0HWQ/M2iUpHaSSgx+xzNx/4waOL8WdZatjeqVcbRHly/lk6mq+WE81 +38i9rMZMiHwVKhbzuwYmQ4GLuAdQ/RttrULM1/4FohMhUplvugvx+fajqYf85kNR +okduFxOXt3Mc2rGdtjo/cCur1syKcjXnB+sYmzAbP2ZSkD0Lm+F7dpP2G46fL/aK +TTLHRKqVSGzCizCukPMOdo/LjBxrOMUduBungSEnpqGOCGw8n/7djVIll7eDmi8d +c4ond8czbqLhcMgaUkj6hU2IDxGTN/Hsxxx8q5MSw57pIAvuT6oHxECuGJH4tiU9 +QS4= +-----END CERTIFICATE----- diff --git a/certs/cmpv2Issuer-key.pem b/certs/cmpv2Issuer-key.pem new file mode 100644 index 00000000..8fdd9596 --- /dev/null +++ b/certs/cmpv2Issuer-key.pem @@ -0,0 +1,32 @@ +Bag Attributes + friendlyName: oom-cert-service + localKeyID: 54 69 6D 65 20 31 36 30 32 38 33 39 32 32 30 37 39 35 +Key Attributes: +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCr0qjRjcHoyMcm +DBXjtern9WJXXyCAINDBzHUt0tzXQGniiIOTExetgXuIv++h4EkgnRjUJ6esJKE+ +7TvgwmUKXjsycczMYHG1A9nND7pYqp3cGIeJtzOqWxCU8u0Xm2tATb92nU4wtzZW +xilBqkJrJj7i8OnuehM+GkVRfLP+qQbTQ5nxNww+e2ZLMg2oH7L30m7am4qgXE/R +tGUr54kwWfUOA3v1YswWZF1YnXpD4oFggtbYYdUSW9BpSW6HNDFxQh2kiARrmOkZ +WLcbc7zFzR7GHG2erXB88Y7p7tUyenORYzFHg3CDth71ETl+Tf6HL6bzpjsa6RcI +UrKXqKtnAgMBAAECggEANoW2RCiza2aqqwwSths32zsmZYsuCPpgw95ZIJ1Urokm +EFg5SCY60TfRN2eQZtGA4vR2uHuM3TcSY6Fr6rpEzbFxH2S1E/VWn5YFOujOvOwH +A5xVBgI4Rsp2zIz5ZxBOTC1foAfyk8rPV2GyHcAlK1MLiX/g+2eJS5+Sd3UWuKvq +mMBrsyHXy6cGjwvilw0jaE39XK55MDOyoZMeJ8T4eFBAEyoBo9jfXZ8kmtD3NOeT +92Xem+/ggzDZ1kSYEq8pddJCEoUgisVfueKJt4MzOEqKW9sUmJz66N+AgOhsl56U +7uHit4FWO+VbmGBPChBK33GXI56ID6VjD26YkZSBwQKBgQD9jNY6qorZgWo8nrq2 +NU77QVcr9UswhmBS6PMsGMWXf/xX7qEZyIHo21O88NFxsiWk50g68PeSNt4Tdrgy +LnQkz838VNOYv3eBFEXV6EqEPV6UKeee8D622+DObXiKjKKpyYjiz86dOqGKy2cx +DNVFBtCXEbF1+pKfadm9MXy/OQKBgQCte6sD8OCNw+0K33+LaPh5NY2oGc5Vr6nr +N16yUWINTAFVMJfAAR9I4ZCGeyEL5QSX8ZlF9R9ceUoSibR2gh8Uyt4+gFCSrAIo +Q0kZHIxoAbzy0oAjrH4kp5WvADewVBCnZJlWxacqFLGctY6QamOjZVUupJUNChzS +p3aLujYfnwKBgFjW5x1JMjuB1+qDp2I+jX0F6PhTC1RmUQvb6ZBy4ZDy3EUnLLVv +Bu3DI7UZIBnZVM1R6IIWenh11xw0xdd3ZWScl00pn7Zup/3HT6zipnFtW11IzYpo +HWFO65cIzmqlWj1pixgFvhxjNcT+/ho2p+d2utGj9m0jLgrDOPLMiywpAoGAE54f +eaOckQtt28PoVWh6aKKAsVixt4jUyy+IuttvHhfRMsP69RBrbD9tq3dzBjhQq6n7 +bijI8hkZIj2GNbyDLUO/nAvAkMV4vPrW4ksTKZPAvSjGqsIPxa9Zwt9gbMUk2PkM +Sf6x55VNfG4ff/834ztLRaoA3Oee2MdtJWHaSvsCgYEAyowbkfptaMIOolx9ckfK +DSEM8Bm5DuIZj3VBXGQeKf2w/XpWzDyIdCw/Y80E5dR5iLdHVKPo9Rjy69njKy3k +rmkjss31kgKi1XGAB3+S7lfPMlBqBk+yXuDOZV+vsdQVGNq3X0PUdGOpWH6UKsNo +osNGN6HxtgCEh51vSoOkAcE= +-----END PRIVATE KEY----- diff --git a/certs/root.crt b/certs/root.crt index 54798de4..7d2bd04f 100644 --- a/certs/root.crt +++ b/certs/root.crt @@ -1,33 +1,33 @@ -----BEGIN CERTIFICATE----- -MIIFnjCCA4agAwIBAgIES09RbTANBgkqhkiG9w0BAQwFADB3MQswCQYDVQQGEwJV +MIIFnjCCA4agAwIBAgIEGHBb6DANBgkqhkiG9w0BAQwFADB3MQswCQYDVQQGEwJV UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZyYW5jaXNjbzEZ MBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05BUDERMA8GA1UE -AxMIb25hcC5vcmcwHhcNMjAwNzI5MTMxMjQwWhcNMzAwNzI3MTMxMjQwWjB3MQsw +AxMIb25hcC5vcmcwHhcNMjAxMDE2MDkwNjUyWhcNMzAxMDE0MDkwNjUyWjB3MQsw CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZy YW5jaXNjbzEZMBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05B UDERMA8GA1UEAxMIb25hcC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQCFkduZzAq9OCELD34x94FqVLtEjBqhuoc70vX1Ymcb9D+LFh4F3tZ+FN1S -C38EnXTRrnoNgO+upv56FhqY0rDvDq8ldgNBnJLHQHJn5L5HNEY4QdP934CcZOUA -6DEDu2CNUq3uuxBSezcQsRMtpCMahsDEL5MBo1OZcrez3vccV4/RuFwvjhRY6Gff -TLJTBnkMZtdjKi1XUS1dzO1R+o1xKH0928FZ+poJggU8ClB6K0rl66uL9mWbLRK6 -WuRCFPsfQ3IZQHec1GEjgEx3LbW1YVVCrXrseRfQIRRVQNrVDiC63N4fxfTbg6IP -N06UI0uOvETAV6LaFGM7pFy2EhhY0+njCABp8GiOC9Ti56gzT14oUXp1SMbvEfqH -S3YjS77AxPZLH9Nk4PCTGYsChVe4zBXZMryH99YdKVPZKfwOGug8Q3wpqK6GR27Q -2/z1kqajS75A5nQRRS280ocHUjUZei9WDsvoewEbksKazH2z8UDiO7VmihC1z8LZ -2wDGt3NaCcWYiMY2JUE7nMS/N4+S+uVGK3tLUn4VYCuTTBJwR7Fl3pptQUpH4ghJ -faJQ3ZyUkxr+7C1qky3KpWCPIbpwZ0Z+jza44KcwZhtykSiUGNs2ZVAgYdKWKEzN -3IaiRTZ8a26thx3Emc3VW8C1ROKV7Z1xRtMIThHCQCAuCosiqwIDAQABozIwMDAd -BgNVHQ4EFgQUrgR74ialS4IseMsG3HxOI1ZnzlswDwYDVR0TAQH/BAUwAwEB/zAN -BgkqhkiG9w0BAQwFAAOCAgEAgLlAXuD3EQpn5vn2wkUcF0yFLG5UzjaTwHQAAdZU -jtK+9IxcccOwMCaF3S17eqRxiVO6a+fxTsS5yXY8qsvmbJpeDStMUWgPUDVAf1XP -sZ0LI2c/V9R4JKYSUTXkpW1Ljkiu7AqO+VRV43I8//sjDr7gotusdehrLGyFQy9S -aQPmg3fk/zN8solAATD1+FMxoawmoQUAUvKVlGYpVu0JOaZywhF9QI9E1eJziUxO -5B3TcDVlbSxmEVHD1Z/Vc3e50yN+vxN2tQBLkfM9uBDON75TiFXSBd0rUfaOXjb+ -Zab5vMF4h4VeUocx+BJtA1SDuEF5JoKY+1QL8ZOIkWtsCaiQQ6psJDLP4GVic6k7 -FFh9nL4KFCGVKh7Q7RqUiyUhU69MYFNEHcEpZvBrksInlXwIdDv9v2gVGufjp7+2 -2YdOzzOVYP+/kbLbNwYPVEKs2BQK97SNw+0AN0ZM1y2XdXQ14HHh9VxhKPj7FUpV -c7u8CaQMjCotLvKLcCxlVkOBTpPPO75i81Z+j8BMqIdTOp5KptZLvPRavJY31VTs -OPULKA0vjdEmid/syLuta9BSNvyJkhvvJmQ43LCRpteOOQsB6MhHvYZqsubifsJE -SSe1GKF90FIPp6/P2ya5jwVl3KyLmOBMplJIbIekS8EVNvkEGIHhBS2AYr2VDsgK -YhM= +AoICAQCDBR06SSPmxUiug54/XkZbTSve183eDb+rObAOWu1c3yQHBjBAAECa4Iuq +TZGwNoK/vYXr2iryQ02Lpp77zBCypVCDrHGl15wHpkCYjNNoukoYHha+vCEstnlh +TLBPyerQpdcerHsUTaHphjdkpfLklFrfFz6SCo1kvInghFAERljOaN3/iq271IAT +epyAVDdTzQ+xzMBNQFgF3QUORh165IJ4Qd9ZVcXcjGwILGV9lw4AaISjVqIpkbLh +pwjnA4PmLdZvHr7yzT5GMxPY7QV9/7NQfknOTOSZqFX2dpsqXd7mNv/G081zDbJZ +bdyUHyAqPm4I7rZ+6frH78PoCHwAp1mOP5AzTKEYUen1PB+88lTqlmjxn8VXz8vN +55fI4YCQH6tlRuwQjl1HQyIPDXjh8OJIIn4Ig9ay9FM9CS/Jw7HkObjImhAM2MnQ +JnCAsOvXyn4jdbsGihZoXF387OgLtWCjzwZZMMBO8FnbncYgWecbnYpErr7NZxr1 +E3qB3JTsY5TAImN3NvrFIyuovf54dyrDWQhtle0cuneBBS57HSgXSeDjvVJ8Wr51 +pfRkdMBnA4ZYxJdZjkiW1ocTIexwWk1uPm0/wDUlW+ppysKHT5p290NktRUcB0bx +P4c938IumCNeNYOWiPCApeCRif860Lnh1d3TqG/WP0bTcX2HAQIDAQABozIwMDAd +BgNVHQ4EFgQUZA0N2+KNAehLqY7+CMl6Be3T9ywwDwYDVR0TAQH/BAUwAwEB/zAN +BgkqhkiG9w0BAQwFAAOCAgEAM1QDhC6dJzwEe0sf8x6ip+c/LHAElOOWX7+N/QRu +iZaccfgox6adu4BE+l9mUrqKxFBnpomzvoLfSrsOkjhj1G5uOjIuxARZnKrcwI4j +c+WucSqBBnDqyzL7+7G1Unm5+yifl5AEs2x+7ftFzogUKWa93xsQ22aNgDOz0+B6 +FL+VPC0JSLH2QGTtHJVMKiLKAj1M1rAsiuISK5KKmk9CGFJl2HAgWK4LT4cbZPT8 +2BODLKaW2qFVRJRCRJUB9HZGDz+Fn9MxNXmQf0ox++HycJlgQMsIDOUJj6B8bygI +eU0pD50RMKNC+tnaeHLRKLrGA1KaW9kku0UO/dINMdmIfi9FKGbUAoLh/2cR1bUF +XQtiKeKsH/0HWQ/M2iUpHaSSgx+xzNx/4waOL8WdZatjeqVcbRHly/lk6mq+WE81 +38i9rMZMiHwVKhbzuwYmQ4GLuAdQ/RttrULM1/4FohMhUplvugvx+fajqYf85kNR +okduFxOXt3Mc2rGdtjo/cCur1syKcjXnB+sYmzAbP2ZSkD0Lm+F7dpP2G46fL/aK +TTLHRKqVSGzCizCukPMOdo/LjBxrOMUduBungSEnpqGOCGw8n/7djVIll7eDmi8d +c4ond8czbqLhcMgaUkj6hU2IDxGTN/Hsxxx8q5MSw57pIAvuT6oHxECuGJH4tiU9 +QS4= -----END CERTIFICATE----- diff --git a/certs/truststore.jks b/certs/truststore.jks index 3d8187f6..a1478775 100644 Binary files a/certs/truststore.jks and b/certs/truststore.jks differ