From bca68e048a74ac3754e76ed738090402f7cbfd13 Mon Sep 17 00:00:00 2001 From: EmmettCox Date: Thu, 27 Feb 2020 14:20:52 +0000 Subject: [PATCH] [AAF] Add CMPv2 Cert Service This new micro service allow retrieval of certificates using CMPv2 protocol and relay the requests to CA server (such as EJBCA provided in contrib folder). Issue-ID: AAF-1083 Change-Id: Ib3acba3d071533ad933d043f067147e8406d8fa8 Signed-off-by: EmmettCox Signed-off-by: Sylvain Desbureaux --- docs/oom_hardcoded_certificates.rst | 2 + kubernetes/aaf/charts/aaf-cert-service/.helmignore | 22 ++++ kubernetes/aaf/charts/aaf-cert-service/Chart.yaml | 18 +++ .../resources/certServiceClient-keystore.jks | Bin 0 -> 4087 bytes .../resources/certServiceServer-keystore.jks | Bin 0 -> 4126 bytes .../resources/certServiceServer-keystore.p12 | Bin 0 -> 4691 bytes .../resources/default/cmpServers.json | 3 + .../aaf/charts/aaf-cert-service/resources/root.crt | 32 +++++ .../resources/test/cmpServers.json | 24 ++++ .../aaf-cert-service/resources/truststore.jks | Bin 0 -> 1722 bytes .../aaf-cert-service/templates/deployment.yaml | 123 ++++++++++++++++++ .../charts/aaf-cert-service/templates/secret.yaml | 56 ++++++++ .../charts/aaf-cert-service/templates/service.yaml | 17 +++ kubernetes/aaf/charts/aaf-cert-service/values.yaml | 141 +++++++++++++++++++++ kubernetes/aaf/values.yaml | 6 + .../overrides/aaf-cert-service-environment.yaml | 47 +++++++ kubernetes/onap/values.yaml | 21 +++ 17 files changed, 512 insertions(+) create mode 100644 kubernetes/aaf/charts/aaf-cert-service/.helmignore create mode 100644 kubernetes/aaf/charts/aaf-cert-service/Chart.yaml create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/certServiceClient-keystore.jks create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/certServiceServer-keystore.jks create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/certServiceServer-keystore.p12 create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/default/cmpServers.json create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/root.crt create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/test/cmpServers.json create mode 100644 kubernetes/aaf/charts/aaf-cert-service/resources/truststore.jks create mode 100644 kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml create mode 100644 kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml create mode 100644 kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml create mode 100644 kubernetes/aaf/charts/aaf-cert-service/values.yaml create mode 100644 kubernetes/onap/resources/overrides/aaf-cert-service-environment.yaml diff --git a/docs/oom_hardcoded_certificates.rst b/docs/oom_hardcoded_certificates.rst index 9cf11c5b26..46d74cd12c 100644 --- a/docs/oom_hardcoded_certificates.rst +++ b/docs/oom_hardcoded_certificates.rst @@ -14,6 +14,8 @@ Here's the list of these certificates: +-----------------------------------------------------------------------------------------------------------------------------------------------------+ | Project | ONAP Certificate | Own Certificate | MSB Certificate | Path | +==================+==================+==================+============================================================================================+ + | AAF | No | Yes | No | aaf/charts/aaf-cert-service/resources/ | + +------------------+------------------+------------------+--------------------------------------------------------------------------------------------+ | AAI | Yes | No | No | aai/oom/resources/config/haproxy/aai.pem | +------------------+------------------+------------------+--------------------------------------------------------------------------------------------+ | AAI | Yes | No | No | aai/oom/resources/config/aai/aai_keystore | diff --git a/kubernetes/aaf/charts/aaf-cert-service/.helmignore b/kubernetes/aaf/charts/aaf-cert-service/.helmignore new file mode 100644 index 0000000000..50af031725 --- /dev/null +++ b/kubernetes/aaf/charts/aaf-cert-service/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/kubernetes/aaf/charts/aaf-cert-service/Chart.yaml b/kubernetes/aaf/charts/aaf-cert-service/Chart.yaml new file mode 100644 index 0000000000..525b2ac4b6 --- /dev/null +++ b/kubernetes/aaf/charts/aaf-cert-service/Chart.yaml @@ -0,0 +1,18 @@ +# Copyright © 2020 Nokia +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +description: ONAP AAF Cert Service +name: aaf-cert-service +version: 6.0.0 diff --git a/kubernetes/aaf/charts/aaf-cert-service/resources/certServiceClient-keystore.jks b/kubernetes/aaf/charts/aaf-cert-service/resources/certServiceClient-keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..f24908c55dbb0abb8d38450f0c7c42b03dbfb369 GIT binary patch literal 4087 zcmc(hXH-+&(#KP2p$AZqUJW$?B?b_bDhkqjl_o6&L+=ozC?L{{f)puIg3_c&6B|XE z2+~175TrK=B5%~^z3W-`xu5Qr`(dwhX7;RE|1)RyZ}!i%pKAaB07PEE-;2rK5%2Bg zi1&4|ceHnRarE#e@7z){sB#AYpdcgx@)Jo zr5vZ~)Ec+#q~$E%u=3POLAF~~XFjJ)N96&?VcX(nTV@&%(4iWx{w00J>`|5I7kdl_ z{RH~$!HK?m)H+y)Z-jI)%~kt7@G?O~^;{{psCerzdK`o@QE6TU6JhH*^ zD5IO{qhCdNh=1Y16UtxmNg8V?Mm{TbA?TH?=?JH|M1o0 zLw_LRU!7KQnLAu_)3T{qu?miL@JntQM`D@^Lm>*&M_?+VJfxG-N%>zTxtJB zyx5~hs(RP@{ewL1oLa7aQ2)@i^p~$K7<@m5Q-d zTD+XX7p4+=H<>(HKgVHtsBEBRD){!&ZcC=54fMG5xfr4lr;Gz5%@p@)2Vx}c70D~0 z#&)MN(ar6iO18&WNg*$$p^{|EO3H#-g-Ky$j3wo_84<}xMgodw4AQO##KwGLaL(1^ zJ3tVf??#6Qs-c&&cZ+Y+W zIb$Oo5ZyUltA5uJr_F~zl<{0t-=qoeS-Kk@lS0fIww?s>}FPN@$ zWo-ys)%k9`Acmc*k$W-@)D6tC|1|rqGRObOQjfEa^0rZSl`wCf+|TbzD^ha2v8 z&X!PMw>4W&f4=D~2JOk6e+DF3w7=lU(w{$j-z!iS05TANAPJy_JTM3d0zsr`{jVYED5yoFuS6fv0fDsS2s{dg zq^1BHK`7uLT`d#~lKGcG1&68P+&uz#4cu>dxuF=zR3&>U;glwLoW1)EKNKqx{>wuH zr`5;dym?h{SkD_C0VpOU!!I`sPW9WZgTMLzE-;)5PmYwd$6=A&r|6`S$a6>;BnBlb zjWqvlqLI>nnaGH&|4tM)lJk!!)?Z`7;Ln&)`8_6habzj{NZvo{*#Egt*7f@f{>lM{ z|1-yL?F1nI-%CiIFkk|Zfm~@I4Tt~)0$S810$u2KqO`&^XuUobS%ykJG1HhMQ36U9 zZwkk{28WpBOP&e=-CQ!2_-cMMOuy5logyZ*!DYJ0!RChIzxoutrJeCiLN~Znm2Diy zyskjP#L#t4#6_pJf6tf*Xvu;d!7&O9!_fD2TleTAoxfMa_m%UQp=gY1qD!u0TRK?6 zCI_@SI2Tts6@qTeYm^;J7Qj2GU#vF^oT?DLmKZd-9F)BXS1>1_FSEc%&zii(G3idI%eYWnaFjVRLiq;CRa9 zo=ml?Yl_@C-QSJE1&2@}DS*He5DS%GfjR7I4WE@#^oh$m_Bsc9DS8sSDME#?20H;xhmedXJ!w2OB1R0Er zXY)>17>mTIs!(%bhdcQ-tPiM9=!M2=%U;I_y(_(3il8{qL0KBFQSy&W|74=`ea!x5 zEB)1e5`NmvGjDz8x?iho!$rm1TTku$FwK`l zO?UcB*E7Qa@!P&8?O7|GFV_4-hV8uVO&DlMSzrA#IssWZ+s6sLj&27(jcIBNP_rZT z)!O)|y38JNe?y)yp+GifD|nw))(toQc7XA=v1hpw{K) z{bKvnaQnX9%WwKCRP>4^6{7d0uRQ46qw1o_luZlSJY)QA;e4@O#Hp4Mml&Zcl(2~n zM+q9QF4(l!++Y0t#r44_vo^3?r zsODNU9@tfxJj*u9HvV-?Upai>(i3pX84p=@Lq1x=kM-Re<cY z9lcCEN52o#m$roT5#lMz3nwr}2KQ<3GhfK9R@|{LAAMj2SYP<^Na}EYZL|&tRnUK4 zHq_ckfof8I#T0&V>xtAPJ{f0Lpr)TnFB|S`QAxbG2l+4`PhH!yV^Ag=w|YgnbPdx-=Ee9`O9<8IXjx7uUc8}EVBH_` z3BbAyco=XgC!+I*Uj-LfXuz%eJxZq^GL!d}7`SEWD?l+<>`)-&H zX_gP`Hx5xd=-_0VTBMp(upQoXg7eN{fuGb1_bp}wcoiev5ZMFVN<4a^)RkPT6-<;& zRvozb(xnTHwg-(`yl!%z7&dW-R^v@hPj`e!EidA3*Vq(IBaC?=9Fw13$Mgmp1~yBJ zobu8tJ_^QoCZ8_7A1@;!{hm8{k6k>gxrY<3+-45AYQFd62x=g-0id+2Ej2NC z;dQptL4!>I8-?hMSCnG5ye2ogJ{Z%SE-D&CnVlD_`c}eRnBA+pLnJI0;_^7C;sh`q zRhi$!j8+JWO2nIYYza<~!u{OBtB4XtJfd959^RU5Q^UHnbU{0en>Nk1yFM0u?Mqae z0%0iV*$184b1|{bm*C#u_sMs71K~9{4HDIV%Ci(h3^y|pid9Vk&F97v?y!GX16Rgf zT9mEs`8FByqVnRI%OV!qTJp9`>gs;Jv5Jb^%N41t({F>c)*;My*Pggp1VUmq9u{@Q z%MoYh8#q7Jc9t-Y4Ty5u&p96{Y$Vs76)%pA=nml`3FgsFrKG17fA&or&v@;4k?Bw- zrt@6PfVI4~$e^E2YlGH_GOJxz)5ay@w)B+x$9VP<=VB6qXaNOnWn8o>3#e#oK^#?1=LW_^l+7Ze z$^tkjQ48w<8tk@X8zl!zuazFHxeBA5$vlktp)?TwS1W?0p3&rS>f5xZ&FvURbrp6) z{`Nq)d8f)p-b9f1l;Da> zJ*_@9a4;TvW3Iq8Zr53~ zQgFAR|8ix`O>dn5Wy9k32=4n5sH2RWt`mae!4J~n&*?qOkwyCJrdBdQV&;1tfAgjN zNBRbtDen?tVFP)gbEXI1Mt}A(gm?p?I-g9z?^eE3`r`ebS}Tk5hL#VPOnha2gBZ1X zFzu-@f7H^PGq=kYP~!UWN`la38pVTwbI?_)mz!vzNSWI+=fk;#n@*`)Z}h*8aZ;Gt zuzL4l_*f`4=lGr=XsSB=vZ{f8wV~^zaWm{dNRfDVLcvbB-?x&#Sm6%cJH|wXH>HgR zDDl?JyLoS=Ey?cPv=8>Y@^MP?@FAUTP>6KUi=p{GgWjxIQL|xXwq&89XLC`;OJ?eJyBhOvm_b-lq<7XzBq%h0~=1%7RNA=X`7E!?B)-$=r;@U{g(p z@4VOs+ZG`U_PS|`q+C8Wu+n_xlY?WY;6RnV>SO#RBoTvIl8%U|%w1MA%ix+tT!-5l zy`(ZX@Eo3#F@ zOE&xQl!n`hJ=N^sFnPD%Ph`a{!q9f8ouVJn5IfhJcm)Amxl`d#HBgbP&0ktR%vxtE z#^#Zee4@WP@?b^HK*OTpuE-CIJ`7K=9|M!{ad-aS@@izZ<;MB1?8L{t)*p$QYT0P{ z*y~dcMGPmqgs14QlaO{%sHLBGvy~>NSUDcQ>xJ|_oK5h#gi$k z!TndnZ&s4oNXf&LNk9~VVabGGSTHRC3<82c5G$227Z@Eml~|lX+#VeeNJ|EQq2M$y zDsr$Dgd7SoGlsLkn9mGKD2*=C$1jB6!p9}R8_r0gD#=R$rMQkly85^T!C7I@GY>VC z)*OjM^XnjeZ@c(~z?onSXKorO@l*hkaU??Su6e;D3^o8-U)5*YKaxht#GF(AM z=EiSR5hn956BeEE|4WJw#`7mB)-#2$_#+T!9RkIVB&8w%f-1rGa6A0)MR@NnF5KAOnEprv_nxKtO(9WIT0+by+2p{tA1+MM*d)Il$;bK=I7j z(V$WB@-1Kdqq5|uEz$*ph63MQOZBXTv^34x5jeD}?uTvAT6)TiMj`#S!&kOFhw*iv z?Y9Zq^d;K2dgKkam7CmK{Mz-diOD6XI#Ibk)N^98{CT5^dcyx`Uuz#4n7Rho`_mXOX8 zi$onS7uVFCEU_t==-DtypHCs@V7%DBl^RRsgLHNA@k9ooe{U#WD1;J5P6`JB0kCst za|IzBFt#WbT!ww>YU!tq`sc4>SMVUS>r7PTf8H$&VS}-dQK+V;Kku->_MsdE-ymWoOyrnjkz*IweigrH7bH;Kc5|3!>+x5NulE9_2zN) z3!xSSHdhHz21d|m!B1E;8EQnDafS&NUAhnWEGC2#$Q;Nbkq#D{e8?38qO`up3Ewt> zKTb|KSUk2m$t;+5Nu;j8q{Fnlp1MbOVY^nJF`*Et7_W03G4VMXDLpv8IW5t}B3FbV zJk-HWPxC;!!NqcXVXBjkheX>3L{n(fXW!P-THh;}4GPhqS`^b*24DgGE6r+b&;MAW zr{w;L0?`!XQZ9IrM^YRuRr!Ycz6K(-l4UP~;_#v8KzH#F+rg>ImtVGgC(KpZSESBA zqfg$jZg{DW;V>Nw1^|e+9cC&O^`{4?!dzl1|k< z;>Lhf`M8^PMZFO2)oNr+-ZiCLj)R?&uXvZOhj(;lMA*jJran)aYex-h6@k;a{S-JY z&(m6t)%59?$h>$YDjdelz$cM~4S5L6R9q{Uqu-@5m$8QoVUx&93Z|8vCBW$o9=hIc89PjJH;p(RevZ6P}vmkFzynuu1pO_q1e7G zmAsg_(;C5hssmRK;$s!(%C}u(Ush-yf&>_(nit;@ewO#s%lok3mG7jrLQ*7&Y(p@l|&nquh6Pe`bkGVtOfltp(4zofcds;&F%L1ZM{>l?b6mj=i0PM zAJ6pb@>l^T_Moj(@N)uV;z4ob)herWMS({j$goKp{q`9sd+x7WZ*0E((F2mw|3wY{ zPhg+j8F-;*YCr}9le+&paK904KjdOFVpuY2UOz(Rb``16@LIY-$F~hlC$#7p89Jd? zuxmFb$gdIOEs7uJ(>!-gjH--xqm+q)$)OFI^kP-1-g&RynBQAvf?*4J;4szTUhzZt z@O9Ju*h;6uSy5|#2-nO+SNuSjWoVDLn0yzq zccRKdgjjB6;fT66fJV7V+&#|y%iyy6TFVNr`oGMCHUhpPIV{HG`pNT1?OR%vhy*bv zx-XpfP>4YHF+KAkaUn2yDys{j&U7Ff-ys)2?5JvT@m<~rk3ZPuH;4d1lNzsr2o m8%yGR?nyipEw>{BZI|Y0tP0V^dl-<37K`(JI4p*!e)%UQHr2)e literal 0 HcmV?d00001 diff --git a/kubernetes/aaf/charts/aaf-cert-service/resources/certServiceServer-keystore.p12 b/kubernetes/aaf/charts/aaf-cert-service/resources/certServiceServer-keystore.p12 new file mode 100644 index 0000000000000000000000000000000000000000..2106c817efbe3c69fc3ad4970fde274e24d9018d GIT binary patch literal 4691 zcmY+EbyO6Lw#8?Np*tNykgks*hEN)$8>EC8=`LvyfdPh)lA%$$kq+rbaOjXuK}5Pc zp7*Zz?p<%4b=KKypR>=OKL~G=L6GBu@VJr6$V(z14loBnc8!G~JBJ|1jv)x_ z!2h?xcELhmJN&h6{?_)G&5?+F~tQ5RjRS0n0TZfd69cjFt{ z+R!u`D!(t48`0oa8y*%JA2h=@h|QF{;bos}D(K_((??yfX8bH-5T>K+rzH`!d*X>& zo|Tqq^PpLE559UR0ZRa?S!?IL=Y?W7DZC3C*Q~UBHL5!`* zb4Ee_ES1lBjU(BW+@Y;rj>#`5M%qc2o;Qt8hddS9%;F$Sp&&YN16oX>b3gHd)0c=A zaM_ivjlsEjU}Y7wN@(*6%EAQ)wM}qq-n_OP?Fe{_RlqjrUP5;5-I}iTJuglpq2SuD zyU6ZS9xVWM(ZO`WS(|Jbo?w(TR#cWhO5*j>_>l+q&>uPV+1W{ms!)EnuLy6%0 z=6Yz2_@WZ+Ah8(Rd|G`9_sUrxR}8xssDRT0nS<5L@G@ zMaFX9JM1~66(a=%@fc}Y|Fk*dwV8FT`trx0i9Y&l z4+?McVW$mZTwAgytADhev@8cl+|w}Y(%KJppMeBx@4+*<&uhf zP5}NwTTbX@nIq#miIZNmu2!3iz2D$%Q~;@bLQ6=N|J%6IO$vDtDl%rF*QX@*y(sFt z`G=qi90O0J4%&~Ky(r{4qepFzzeerr@WK&!1f9Cr8GGO2LWBP?v}}yZT-Ky;z6NP| ziM3bws5~W(IFKsV=}C+f-MzTB&D{D0I1{foM20#drGis$&(KLe!4t=|yh zzfKeUH+6#%gtU2%4f`P6Sh5=VsZNqNzZ(JtCIj>QMIAejF|&hr z@#(Vz7zKL?Vuk!!G*&?r(a}6|J}l}UE4PEsL%_3%>cNo&20;6gq0!>8-y8v`c|@_& z`*;FqC@wOY)|tN|ofLQW%U953w3u~hFN*>5aHS~Mo%5scVpR0bcN^uJXg1z-yxX6~ z36Ztq!in^L`@~dn#cmv}2db&$S&_D6k%}5}osFa>NObf>vs@SIog$cRuB-o!EV#~7 zwMT3t^P?dtZ3~aSJT>m3?dwxV0li(SH@lI?if{rvTwt2rmyu>!2BWH{K}>Xg#A#X+ zKC+r7t;%@~jn?J;aqYG?+$k444Y4O4o9fATQ6}<)`Q!>%XQ(--F_2uYSf+?(vM*+W zoK#@5U003Q#BrF;%jZo zlUcwx}QxO z?>RbDe37!-q-*$33TX%)>L?WjtL63)`9u%MaGNYICo2(Olc{A``ZAd@%A~n6iFk>p zcbXWOgiBTBPNV&2LaWI6@%TFe$7au?BNX@pqr2p`F3xZlXutq(hLMfPpb(Hf?evb} zDa=*x6Vq>@U(Z(xhVEG7>)o{F7z{_q(-n7ujZP;*{HhINNW&kzYRVLO_?k&UU4`U1 zXk%d4h9H^EJ^^+Ul>0}hFWaKHtM_HA_omH5&)W2YT7*YS5|X}tJLH2ZCakI`lf*xl z>71U9%k$w(M1zv7DbvYZ^ASu|ng7lZQn)h>TeF?juSq6I9Hz;MQ~@_>93_Y$^Mh=nSWT>vz}a zvT6-kv4tIq-<(p~Dnp+K-Y(omM+y{tzyh&;u7>)!@jNnzf~Qph?O{x*7t>)X-Go5M zSP%suPm_YG^%;hlldIy`oX^kYP+L!+fA0}MaS7+0_en)A2TgX~QAbPd9p5r%941X9 zXbCkMk0XN4plrfPene*_xQ4j1u<-sM643INvBGU+HztYa4KCj}9P_GAKVxE(SR{QI zs^_7|8@9nQRFlK{nt@emB5YooxIP_IP=~o)t@A{Me}(rTLxpbx_vBt%tq_q8CY@I89807@gH@GmZ)M zxJanb#HTAuRL|%9hE7lqYs$KTM47w5P5;_4JCz~+##A!vAL&Nzo0j56?WnH&m+m-; zy}(cKS8|HzN(z-?4tyons{7jT!Kd3i8sgFqEC!|WG-CwJW{_nvuAx~YXh@BZPX1zI zt7K^cAewsSQ+*ap>Hc0C7_g1QK4O12k9!`F&vm~kR)9~TM61_wFU}66g?#Sw^yhaV z?E123`PpnVl<~Wx_aQ&&X;^3Iut)A?2Aik;a3#nKye!K=pi4^X@q&mm6n#Uz=tP|N zPO!8g+z4T;x*o(sfqPTQ@-mfNVdwN1Q&>rwgEy!_R|Vzr(FB-9udvwY_X|ODb(*GW z<);&LH|Y@igj3dV%US`-PFG>s$=j?}qe|R4X&eFDyW+y+$j`Ko-%bzU3xMTHWS{2{ zYvFgdoqe!h-qBF@7G=46SGV45B(Zr)C7+Dj#Kk*&|1Rk`D(OZ}l2-ewh^C-HMX$|& zbW#$3?w?YhexUu9pK-z5Tdyyw?N;!zvFCXKN<93wZ091}JTwdKgz8Ujjx>s<^d&`Y@YB=muG}dW*LEnqPT9I@Zy1Vv3=OW)NUf~E$dZF8L0Vyb4?7ci zdxe9z$EAUe;m9!@>#r?Z5*R*Vj^b-SX&7&xxtjWl0bm&~(MLt+r)=9nGJ=7VyJxHs zc3xyw>8vUGihy4<{*W{ab?}Kab&x>e0L2(rr&%)=YEc-jFwa)dFSwug zhNY(R>NMFaKE*NZ*0}kg1-D!5LKQzMoXs1pC+QNVFwb${lS4B(ryV`F53$|S38+dj zA6HFEN54Ny{osu={l49(nr-g7R>K!x$Gt<218UPNzju#A>LG;bLU{|tje6`%DEt+@XR~dfW8Xg=+HK-(v45NTd zNXMv)agSJ{vmgOX{oZNQoB|YjUyF z)$z5Y(uEia zvinT4cOkG%NMVxsO>_Al3-!+_HjnuO`|+~GXCLu{3KH${=@Z;8=X|wAYZ7lJ(wArZ zm-(v7i0WSO(uTNre(1tZV`&p{ni=kr2U$59#;OcQn*~Dx)N$f8V7ryy&UFBfn%}u)hQG1Pz z$CLzH68Qm%>SL>{L=hAnz1&G?Nm!VslLE;Uy8z!9XN*d>2Ox~#cGynrmboJ?CIMOxb!QQ>pUU4mxEIwxGQ4Md;Pq^hG0i&9Hv>9Py z9B{BU4Ow_`o4oU;h9+C+P9f5jB+WxC%IM6HnJv8{En=(|->Ta#Xzk>zJpYSyy==q+ z9IVFT)jIJ2mb3WcA0aJb$;HUrRI{J6!oX%8h%)_FP!q?_$tMqyf-pnyK-fIQm>6Je z02XDUY!@-SP?@HUY9J0UBC*%R32?!ptiyX{eArQ{^@ctypQ2dILbFIm0s{cUP=JC40BLgQX&X64bt^`=;ZL35U~(9Z_LPX-M|$kk zIoj|Jy6L0|FSQfi{gK4#mGQteW3pe6+F8<2cbeA->1Ty^{zQ8;4K-4u^WvqJrF@8z z#?#Ypm^ZR!;5cn=O3AVVWN&Dq2>Da*C!y2Y>@5_>X z-b>Fh7-g%NM=Gx$YrpjbCM(O@!u4L{<8{_SN6P+oX*Yo5_e&8$pX_;z%UwH!Qqur- zfFH^euHMe$s2`9-uM#$0LLCbFuc=J_1`siZf?yLq;@uRY`0dV^8fu6b%>0}{Hu3{P z2L}z+%haiv?}kF`);igKk3X=187f&Ze^-6PHi13(FHP|qnF+kVLP=FRbw-tLsbua} z@tI;ud5QfmaPVSzp%kD7?wl%}*QN|#q@51NTeu_lT#JD5tn>wrTt%Him9~L$qpd)c z$C$1!acema-IgwuU$(6DXxIzKoaCvit$^PjPjLNu9IbdRVZN#Uh(uVQ46iwT;_ zrt+5+3ujsW66UB18nI5MN9rg>E-aGG9zI_BV9mYvhx`E{n75dj3bw$lwZH6(0y|>k z%(&#oZt%z4AJwro^&@z3eA)dtg%yXcwiu51Upri5dSgvgo1%aqA-XP+L!fJbX9sJ0 zONi>soUGN^alyFQuSx&m%USJ4C?#_n3Z56hAm03zf<&YO${bRtpMkCK6t~U zKtO<=Wb2mz9i2yxZl>vkv~ybLQu8hy`+>UNB3Idy=h69G6pW+TARD~lDoCu3bi3AR z3_bQejE|3yfk`WX1>%9v%m3?YL@h*buBv2F%=7| zL@!G)TTrb|bGGN=*5kVd{DNnS&|)EG%(5&8b(PX1runA0teg4-7pO2e;r-n?GL=b0 z)KAd3Jjz89+96xmuN6D74lkfFwWtL-p0EFXIT>0J($V{pjwP5r>lU9-=@+P!9vv$SNjP4MHiOML&wy0I=QlvKVjqK zc}vl{4>&KTnPszsmSxH18A9~@H4t#XVWOMg|NPW+S~o;oTl{&|?a`?DG#9ZInr-oq zFa(lwqI8wuvlidHkqz-Zx}Nfsg?es9AIke6i{q%X}sVBYF8}4sVMndU4o<~KBh}jtqbC?LKWisocXtz z1DZ=5bG(L?jO!Pky-Nfcs+@$+Gfz_bT9Zqb&#=62QOB-lj=}MUC(PY{f3uJaE)|{L zs#poq360)fs*}wSPF(Ii!0>yA{6vO0lwGeMtW{r2v}*ZTc;ZZ<%uv96b5u;v{oQAr zB5D-l6jmD}+|ws-DniTNsL!t@0F{gyvP~uyhc?YFUS1d38p5^eXiR05+A1)@If`R7 zRD@mKEX+D#t5IGicj|0oZjGIiU@txqrlr@UP zlT`dcc%YWfKG<}8mJxDCe29{L6xa*JGQ7wl+=9#N#H_cy%Jpg_T&acPT!wN&7r;%~ zmEu;r4ATUxjy-KRN4ek+`fb!&(@6d2_Bm^5NYtM(%Ds+LQ;txJg%jtK1gQgm@Gwy- z_<-Kq-9RO5P)MRt?-Y#s!WVc3fTJW7r; zWISUGyx$uE0cyLM6c?8e0gv_wVo`>j)7qqR&lC1GyAeqg?F2hp;>0FjagQ`$ZITho zW^kF`bp>*mijsvTF^!H&Y+|}A@Oy-31%A3fr3WS!?))Hdp3q5E>0d1-K7OmNO9~gQ zL@+)uAutIB1uG5%0vZJX1Qe}2gt$9yT?9O?#L{Xxzkq;%Sr`Nqyd%}a`dA2ua^S-L QP+N65HcJ*|0s{etpglA>RsaA1 literal 0 HcmV?d00001 diff --git a/kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml b/kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml new file mode 100644 index 0000000000..76e610f169 --- /dev/null +++ b/kubernetes/aaf/charts/aaf-cert-service/templates/deployment.yaml @@ -0,0 +1,123 @@ +# Copyright © 2020, Nokia +# Modifications Copyright © 2020, Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +{{- if .Values.global.cmpv2Enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: {{- include "common.resourceMetadata" . | nindent 2 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: {{- include "common.selectors" . | nindent 4 }} + template: + metadata: {{- include "common.templateMetadata" . | nindent 6 }} + spec: + volumes: +{{- if .Values.global.addTestingComponents }} + - name: cmp-servers-template-volume + secret: + secretName: {{ .Values.cmpServers.secret.name }} + - name: {{ .Values.cmpServers.volume.name }} + emptyDir: + medium: Memory +{{- else }} + - name: {{ .Values.cmpServers.volume.name }} + secret: + secretName: {{ .Values.cmpServers.secret.name }} +{{- end }} + - name: {{ .Values.tls.server.volume.name }} + secret: + secretName: {{ .Values.tls.server.secret.name }} +{{- if .Values.global.addTestingComponents }} + initContainers: + - name: wait-for-ejbca + command: + - /root/ready.py + args: + - --container-name + - ejbca-ejbca + env: + - name: NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + - name: subsitute-envs + image: "{{ .Values.global.envsubstImage }}" + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + command: ['sh', '-c', "cd /config-input && envsubst < cmpServers.json > {{ .Values.cmpServers.volume.mountPath }}/cmpServers.json"] + volumeMounts: + - name: cmp-servers-template-volume + mountPath: /config-input + readOnly: true + - name: {{ .Values.cmpServers.volume.name }} + mountPath: {{ .Values.cmpServers.volume.mountPath }} + readOnly: false + env: + - name: CLIENT_IAK + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ejbca-server-client-iak" "key" "password") | indent 14 }} + - name: CLIENT_RV + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cmp-config-client-rv" "key" "password") | indent 14 }} + - name: RA_IAK + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ejbca-server-ra-iak" "key" "password") | indent 14 }} + - name: RA_RV + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cmp-config-ra-rv" "key" "password") | indent 14 }} +{{- end }} + containers: + - name: {{ include "common.name" . }} + image: {{ .Values.repository }}/{{ .Values.image }} + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + ports: {{ include "common.containerPorts" . | nindent 10 }} + env: + - name: HTTPS_PORT + value: "{{ .Values.envs.httpsPort }}" + - name: KEYSTORE_PATH + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.jksName }}" + - name: KEYSTORE_P12_PATH + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.p12Name }}" + - name: TRUSTSTORE_PATH + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.jksName }}" + - name: ROOT_CERT + value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.crtName }}" + - name: KEYSTORE_PASSWORD + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keystore-password" "key" "password") | indent 14 }} + - name: TRUSTSTORE_PASSWORD + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "truststore-password" "key" "password") | indent 14 }} + livenessProbe: + exec: + command: + - /bin/bash + - -c + - {{ .Values.liveness.command }} + initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }} + periodSeconds: {{ .Values.liveness.periodSeconds }} + readinessProbe: + exec: + command: + - /bin/bash + - -c + - {{ .Values.readiness.command }} + initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} + periodSeconds: {{ .Values.readiness.periodSeconds }} + volumeMounts: + - name: {{ .Values.cmpServers.volume.name }} + mountPath: {{ .Values.cmpServers.volume.mountPath }} + readOnly: false + - name: {{ .Values.tls.server.volume.name }} + mountPath: {{ .Values.tls.server.volume.mountPath }} + readOnly: true + resources: {{ include "common.resources" . | nindent 12 }} +{{ end -}} diff --git a/kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml b/kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml new file mode 100644 index 0000000000..ac92f56487 --- /dev/null +++ b/kubernetes/aaf/charts/aaf-cert-service/templates/secret.yaml @@ -0,0 +1,56 @@ +# Copyright © 2020, Nokia +# Modifications Copyright © 2020, Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +{{- if .Values.global.cmpv2Enabled }} +{{ include "common.secretFast" . }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.cmpServers.secret.name }} +type: Opaque +data: +{{ if .Values.global.addTestingComponents }} + {{ (.Files.Glob "resources/test/cmpServers.json").AsSecrets }} +{{ else }} + {{ (.Files.Glob "resources/default/cmpServers.json").AsSecrets }} +{{ end }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.global.aaf.certServiceClient.secret.name | default .Values.tls.client.secret.defaultName }} +type: Opaque +data: + certServiceClient-keystore.jks: + {{ (.Files.Glob "resources/certServiceClient-keystore.jks").AsSecrets }} + truststore.jks: + {{ (.Files.Glob "resources/truststore.jks").AsSecrets }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.tls.server.secret.name }} +type: Opaque +data: + certServiceServer-keystore.jks: + {{ (.Files.Glob "resources/certServiceServer-keystore.jks").AsSecrets }} + certServiceServer-keystore.p12: + {{ (.Files.Glob "resources/certServiceServer-keystore.p12").AsSecrets }} + truststore.jks: + {{ (.Files.Glob "resources/truststore.jks").AsSecrets }} + root.crt: + {{ (.Files.Glob "resources/root.crt").AsSecrets }} +{{ end -}} \ No newline at end of file diff --git a/kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml b/kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml new file mode 100644 index 0000000000..60e2afa41d --- /dev/null +++ b/kubernetes/aaf/charts/aaf-cert-service/templates/service.yaml @@ -0,0 +1,17 @@ +# Copyright © 2020, Nokia +# Modifications Copyright © 2020, Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +{{- if .Values.global.cmpv2Enabled }} + {{ include "common.service" . }} +{{ end -}} \ No newline at end of file diff --git a/kubernetes/aaf/charts/aaf-cert-service/values.yaml b/kubernetes/aaf/charts/aaf-cert-service/values.yaml new file mode 100644 index 0000000000..c2bbecd81a --- /dev/null +++ b/kubernetes/aaf/charts/aaf-cert-service/values.yaml @@ -0,0 +1,141 @@ +# Copyright © 2020, Nokia +# Modifications Copyright © 2020, Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Global +global: + envsubstImage: dibi/envsubst + +# Service configuration +service: + type: ClusterIP + ports: + - name: http + port: 8443 + port_protocol: http + + +# Deployment configuration +repository: nexus3.onap.org:10001 +image: onap/org.onap.aaf.certservice.aaf-certservice-api:1.0.0 +pullPolicy: Always +replicaCount: 1 + +liveness: + initialDelaySeconds: 60 + periodSeconds: 10 + command: curl https://localhost:$HTTPS_PORT/actuator/health --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD +readiness: + initialDelaySeconds: 30 + periodSeconds: 10 + command: curl https://localhost:$HTTPS_PORT/ready --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD + +flavor: small +resources: + small: + limits: + cpu: 0.5 + memory: 1Gi + requests: + cpu: 0.2 + memory: 512Mi + large: + limits: + cpu: 1 + memory: 2Gi + requests: + cpu: 0.4 + memory: 1Gi + unlimited: {} + + +# Application configuration +cmpServers: + secret: + name: aaf-cert-service-secret + volume: + name: aaf-cert-service-volume + mountPath: /etc/onap/aaf/certservice + +tls: + server: + secret: + name: aaf-cert-service-server-tls-secret + volume: + name: aaf-cert-service-server-tls-volume + mountPath: /etc/onap/aaf/certservice/certs/ + client: + secret: + defaultName: aaf-cert-service-client-tls-secret + +envs: + keystore: + jksName: certServiceServer-keystore.jks + p12Name: certServiceServer-keystore.p12 + truststore: + jksName: truststore.jks + crtName: root.crt + httpsPort: 8443 + +# External secrets with credentials can be provided to override default credentials defined below, +# by uncommenting and filling appropriate *ExternalSecret value +credentials: + tls: + keystorePassword: secret + truststorePassword: secret + #keystorePasswordExternalSecret: + #truststorePasswordExternalSecret: + # Below cmp values contain credentials for EJBCA test instance and are relevant only if global addTestingComponents flag is enabled + cmp: + #clientIakExternalSecret: + #clientRvExternalSecret: + #raIakExternalSecret: + #raRvExternalSecret: + client: {} + # iak: mypassword + # rv: unused + ra: {} + # iak: mypassword + # rv: unused + +secrets: + - uid: keystore-password + name: '{{ include "common.release" . }}-keystore-password' + type: password + externalSecret: '{{ tpl (default "" .Values.credentials.tls.keystorePasswordExternalSecret) . }}' + password: '{{ .Values.credentials.tls.keystorePassword }}' + passwordPolicy: required + - uid: truststore-password + name: '{{ include "common.release" . }}-truststore-password' + type: password + externalSecret: '{{ tpl (default "" .Values.credentials.tls.truststorePasswordExternalSecret) . }}' + password: '{{ .Values.credentials.tls.truststorePassword }}' + passwordPolicy: required + # Below values are relevant only if global addTestingComponents flag is enabled + - uid: ejbca-server-client-iak + type: password + externalSecret: '{{ tpl (default "" .Values.credentials.cmp.clientIakExternalSecret) . }}' + password: '{{ .Values.credentials.cmp.client.iak }}' + - uid: cmp-config-client-rv + type: password + externalSecret: '{{ tpl (default "" .Values.credentials.cmp.clientRvExternalSecret) . }}' + password: '{{ .Values.credentials.cmp.client.rv }}' + - uid: ejbca-server-ra-iak + type: password + externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raIakExternalSecret) . }}' + password: '{{ .Values.credentials.cmp.ra.iak }}' + - uid: cmp-config-ra-rv + type: password + externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raRvExternalSecret) . }}' + password: '{{ .Values.credentials.cmp.ra.rv }}' diff --git a/kubernetes/aaf/values.yaml b/kubernetes/aaf/values.yaml index bedf243639..b1cb25419a 100644 --- a/kubernetes/aaf/values.yaml +++ b/kubernetes/aaf/values.yaml @@ -16,6 +16,7 @@ ################################################################# # Global configuration defaults. ################################################################# + global: nodePortPrefix: 302 # Readiness image @@ -40,6 +41,8 @@ global: #pullPolicy: IfNotPresent #repository: "nexus3.onap.org:10003" + cmpv2Enabled: true + addTestingComponents: false aaf: readiness: false image: onap/aaf/aaf_core:2.1.20 @@ -73,6 +76,9 @@ global: public_port: 31112 # Note: as hello is a sample app, find values in charts/aaf-hello/values.yaml + certServiceClient: + secret: + name: aaf-cert-service-client-tls-secret ################################################################# # Application configuration defaults. diff --git a/kubernetes/onap/resources/overrides/aaf-cert-service-environment.yaml b/kubernetes/onap/resources/overrides/aaf-cert-service-environment.yaml new file mode 100644 index 0000000000..da00f61e2f --- /dev/null +++ b/kubernetes/onap/resources/overrides/aaf-cert-service-environment.yaml @@ -0,0 +1,47 @@ +# Copyright © 2020 Nordix Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +################################################################# +# +# These overrides will affect all helm charts (ie. applications) +# that are listed below and are 'enabled'. +# +# +# This is specifically for the environments which take time to +# deploy ONAP. This increase in timeouts prevents false restarting of +# the pods during startup configuration. +# +# These timers have been tuned by the ONAP integration team. They +# have been tested and validated in the ONAP integration lab (Intel/Windriver lab). +# They are however indicative and may be adapted to your environment as they +# depend on the performance of the infrastructure you are installing ONAP on. +# +# Please note that these timers must remain reasonable, in other words, if +# your infrastructure is not performant enough, extending the timers to very +# large value may not fix all installation issues on over subscribed hardware. +# +################################################################# +global: + cmpv2Enabled: true + aaf: + certServiceClient: + envVariables: + # Certificate related + cmpv2Organization: "Linux-Foundation" + cmpv2OrganizationalUnit: "ONAP" + cmpv2Location: "San-Francisco" + cmpv2State: "California" + cmpv2Country: "US" + # Client configuration related + caName: "RA" diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml index 973613b464..dcbfd6d0cf 100755 --- a/kubernetes/onap/values.yaml +++ b/kubernetes/onap/values.yaml @@ -101,6 +101,27 @@ global: # Enabling CMPv2 cmpv2Enabled: true + aaf: + certServiceClient: + image: onap/org.onap.aaf.certservice.aaf-certservice-client:1.0.0 + secret: + name: aaf-cert-service-client-tls-secret + mountPath: /etc/onap/aaf/certservice/certs/ + envVariables: + # Certificate related + cmpv2Organization: "Linux-Foundation" + cmpv2OrganizationalUnit: "ONAP" + cmpv2Location: "San-Francisco" + cmpv2State: "California" + cmpv2Country: "US" + # Client configuration related + caName: "RA" + requestURL: "https://aaf-cert-service:8443/v1/certificate/" + requestTimeout: "20000" + keystorePath: "/etc/onap/aaf/certservice/certs/certServiceClient-keystore.jks" + keystorePassword: "secret" + truststorePath: "/etc/onap/aaf/certservice/certs/truststore.jks" + truststorePassword: "secret" # TLS # Set to false if you want to disable TLS for NodePorts. Be aware that this -- 2.16.6