From 3ea400b4e62a027caa9bbba14b52d2c04e07f6c0 Mon Sep 17 00:00:00 2001 From: Ramesh Parthasarathy Date: Sun, 5 Apr 2020 04:30:27 +0000 Subject: [PATCH] Added trust store for SOL003 Adapter & ETSI Catalog Manager Added the trust store provided by waqas to be included with vnfm adapter jvm arguments. Issue-ID: SO-2765 Signed-off-by: Ramesh Parthasarathy(rp6768) Change-Id: Ifbe7bd54dcf1f79b49bed1f887e472ad9b7ac634 --- docs/oom_hardcoded_certificates.rst | 2 ++ .../so-secrets/resources/certs/org.onap.so.trust.jks | Bin 0 -> 963 bytes kubernetes/so/charts/so-secrets/templates/secrets.yaml | 13 +++++++++++++ .../so/charts/so-vnfm-adapter/templates/deployment.yaml | 12 +++++++++--- kubernetes/so/values.yaml | 8 +++++--- 5 files changed, 29 insertions(+), 6 deletions(-) create mode 100644 kubernetes/so/charts/so-secrets/resources/certs/org.onap.so.trust.jks diff --git a/docs/oom_hardcoded_certificates.rst b/docs/oom_hardcoded_certificates.rst index 0745ec0df4..b5f3c075f8 100644 --- a/docs/oom_hardcoded_certificates.rst +++ b/docs/oom_hardcoded_certificates.rst @@ -48,5 +48,7 @@ Here's the list of these certificates: +------------------+------------------+------------------+--------------------------------------------------------------------------------------------+ | SO/VNFM | Yes | No? | Yes | kubernetes/so/resources/config/certificates | +------------------+------------------+------------------+--------------------------------------------------------------------------------------------+ + | SO/VNFM | No | Yes? | Yes | kubernetes/so/charts/so-secrets/resources/certs/org.onap.so.trust.jks | + +------------------+------------------+------------------+--------------------------------------------------------------------------------------------+ | VID | No | Yes | No | kubernetes/vid/resources/cert | +------------------+------------------+------------------+--------------------------------------------------------------------------------------------+ diff --git a/kubernetes/so/charts/so-secrets/resources/certs/org.onap.so.trust.jks b/kubernetes/so/charts/so-secrets/resources/certs/org.onap.so.trust.jks new file mode 100644 index 0000000000000000000000000000000000000000..96931ce1683a364fc53f922951c2b45588cc3a96 GIT binary patch literal 963 zcmezO_TO6u1_mY|W(3pBxy4C9cEQQw&X)|V5qhQumJAHc?FLQE%?3?O*-V@ae-m8G zv|{-$8}PDmYPET^edlFla zHZrgH=DH3D%>p90J;K9R*cp@-$8*V$!%6y&`Bko*Z8*ulaAor5uU2(+^Tibu3=V0n(lC^n*1O;Cg#1&@ zm0PEson`%FR?`%TJ=>>w@cGvKFXwkmJu&zFcB3{C-HTEuSoZwykytQ+S3XjGrs6(z zzx&@FOrNK*`LUtvJZ3hzJe3_wPjYZp3NP7N^XHAusc+{8OGmX;$8EZm>C%ukwXZWzJMXb$Y4F4S0VQE zzlq;Pz8+d)mSM?tiz__kcihak{k*~R-Sp0jlpp16-S}NxLgARq8x*c3On&Tg zYt3bK&7hW_j|20X_f&o^U9)MyqO>W?)}$YHTJ}FxhI?NX2ZMpy)hh?T&YbGGN|E^z z+q}69tdauCC-(ikykXimh3P$lED?`{mxzcvFzoR=JlR1uMs5+i$cruOQdaP+OqZ;9 zw(!H(-BmwrG`zFz_$Pf__d;dHgjdQr*F*~TDYR}(NPeEfE8hF<-*fRJ7qU|mj!$Py zS~Wv1AiUN#^ULR-pF?csW=z_Z67QfRdA2+mi9D;7g~V*r4Ne&j56%U7r8| literal 0 HcmV?d00001 diff --git a/kubernetes/so/charts/so-secrets/templates/secrets.yaml b/kubernetes/so/charts/so-secrets/templates/secrets.yaml index 9a749638f0..5be2cc7c41 100644 --- a/kubernetes/so/charts/so-secrets/templates/secrets.yaml +++ b/kubernetes/so/charts/so-secrets/templates/secrets.yaml @@ -25,3 +25,16 @@ data: trustStorePassword: {{ .Values.global.client.certs.trustStorePassword }} keyStorePassword: {{ .Values.global.client.certs.keyStorePassword}} type: Opaque +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.release" . }}-so-truststore-secret + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{ tpl (.Files.Glob "resources/certs/*").AsSecrets . | indent 2 }} diff --git a/kubernetes/so/charts/so-vnfm-adapter/templates/deployment.yaml b/kubernetes/so/charts/so-vnfm-adapter/templates/deployment.yaml index 00b36a838e..a720753f47 100755 --- a/kubernetes/so/charts/so-vnfm-adapter/templates/deployment.yaml +++ b/kubernetes/so/charts/so-vnfm-adapter/templates/deployment.yaml @@ -40,17 +40,17 @@ spec: image: {{ include "common.repository" . }}/{{ .Values.image }} resources: {{ include "common.resources" . | indent 12 }} - {{- if eq .Values.global.security.aaf.enabled true }} env: - name: TRUSTSTORE - value: /app/org.onap.so.trust.jks + value: {{ .Values.global.client.certs.truststore }} - name: TRUSTSTORE_PASSWORD valueFrom: secretKeyRef: name: {{ .Release.Name}}-so-client-certs-secret key: trustStorePassword + {{ if eq .Values.global.security.aaf.enabled true }} - name: KEYSTORE - value: /app/org.onap.so.jks + value: {{ .Values.global.client.certs.keystore }} - name: KEYSTORE_PASSWORD valueFrom: secretKeyRef: @@ -67,6 +67,9 @@ spec: - name: config mountPath: /app/config readOnly: true + - name: {{ include "common.fullname" . }}-truststore + mountPath: /app/client + readonly: true livenessProbe: tcpSocket: port: {{ index .Values.livenessProbe.port }} @@ -84,5 +87,8 @@ spec: - name: config configMap: name: {{ include "common.fullname" . }}-app-configmap + - name: {{ include "common.fullname" . }}-truststore + secret: + secretName: {{ include "common.release" . }}-so-truststore-secret imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" diff --git a/kubernetes/so/values.yaml b/kubernetes/so/values.yaml index 4cf991ea60..e9c5637eef 100755 --- a/kubernetes/so/values.yaml +++ b/kubernetes/so/values.yaml @@ -60,8 +60,8 @@ global: defaultCloudOwner: onap cadi: cadiLoglevel: DEBUG - cadiKeyFile: /app/org.onap.so.keyfile - cadiTrustStore: /app/org.onap.so.trust.jks + cadiKeyFile: /app/client/org.onap.so.keyfile + cadiTrustStore: /app/client/org.onap.so.trust.jks cadiTruststorePassword: enc:MFpuxKeYK6Eo6QXjDUjtOBbp0FthY7SB4mKSIJm_RWC cadiLatitude: 38.4329 cadiLongitude: -90.43248 @@ -73,7 +73,9 @@ global: msoKey: 07a7159d3bf51a0e53be7a8f89699be7 client: certs: - trustStorePassword: b25hcDRzbw== + truststore: /app/client/org.onap.so.trust.jks + keystore: /app/client/org.onap.so.jks + trustStorePassword: LHN4Iy5DKlcpXXdWZ0pDNmNjRkhJIzpI keyStorePassword: c280b25hcA== certificates: path: /etc/ssl/certs -- 2.16.6