From 4d9702f7d3a9f7015d28874a37841c20e5a49efe Mon Sep 17 00:00:00 2001 From: Sylvain Desbureaux Date: Thu, 11 Mar 2021 08:31:57 +0100 Subject: [PATCH] [CDS] Update hardcoded certificates Update CDS UI certificates in order to have validity for one year Issue-ID: CCSDK-3207 Signed-off-by: Sylvain Desbureaux Change-Id: Id7a0dbdfb6a59ac7e76e00fd106855f05482b041 --- .../cds-ui/resources/certs/org.onap.sdnc-cds.p12 | Bin 0 -> 4383 bytes .../cds/charts/cds-ui/templates/deployment.yaml | 16 +++++++++++ kubernetes/cds/charts/cds-ui/templates/secret.yaml | 31 +++++++++++++++++++++ kubernetes/cds/charts/cds-ui/values.yaml | 14 ++++++++++ 4 files changed, 61 insertions(+) create mode 100644 kubernetes/cds/charts/cds-ui/resources/certs/org.onap.sdnc-cds.p12 create mode 100644 kubernetes/cds/charts/cds-ui/templates/secret.yaml diff --git a/kubernetes/cds/charts/cds-ui/resources/certs/org.onap.sdnc-cds.p12 b/kubernetes/cds/charts/cds-ui/resources/certs/org.onap.sdnc-cds.p12 new file mode 100644 index 0000000000000000000000000000000000000000..8240f4c59053e1a4702e71e61357484d05f45df6 GIT binary patch literal 4383 zcmZXUWmFUZ)`n;3W)K)e5GjEnhYm?Wx;rHVh90Dm9y%SQBqgMj9=fGdx*KT_fsqc^ z-Lv2B+4KFl_1yQ~pDz?aMuP#wgd#xGIQZ-liV>H@KwMxh0@RCz0Db$5+n@;S#Q#}g zBd`$Ifq(J4zu|>L`0pzs0w6{%0_zrvz`BG&a0vbn|9wt_MPY=msb{`49QtQ(fri9n z`A7*S@l!(-@6nQJ*BO5=Cc(_22;G(f56AAYBdut;qs0=3zIJ%Y-#-$fEP zqyap0*dUvu?;08TUi-qLr0ry@a*orjM!nIHdu@;*p3RQcLAlT!b0%wCfngc#4!IIaKEF$Q4zx!kdPj?uw(;LbT#J6 zPtOkC<;0uHD>sf0d%qpSPwfeQ*Mh}&kfUzIIznuJO{t$Sj2XOLLoauw1!(93i?wYa z>oa4j4dH&VJ;YrunNg*svG_4vMcHyj)RQ!e1og#%9AOEW-_U~AL|xfs2-TZY`Xu?X+RN=a>vq ztZ*CUrLMZN~zkS zOk{^8_#W5Z`72>;R5m|%u*fa!@RRHm@|aAfTy1c$X;U)qsK96fF>j_lz}X21rF+ie z(_@o)A%Xrh%8kC0VK!dL%I-Z^+4Yu1r@)o#`2AwrfHiGA?$FyP*N@{>M7P3ZRDkWBDekTbq^0&a`-3H;mnDO%PUeux{klw zAo%uL56g=M@rk-kKYNyya9Th6y{9?DogVB}su*}>{%+ghX3Sg2ea+kQSRu$Z4!sTy zSOO%Q-b+(u$oFJXY^i$Mt^}ew(=~o&so^L@FQWolSxp7G#etu-kx5RBSXQ}X<~->xwX??-SV(21Z^kuw;cd89FqyEHI3peZITY|C0}*P%du_G+mDK;LiuDR_nG z1OV;;Yk&*j4S?%!SpS`*{~zH7!2c>N0j_|5c5VO|l;OWmD0wNc9_iXU+tBk0@d^qE zKt=y1J^?6#koi9%T%244A?060h5-cpEd>AF0RP8{asKJV-CN3&%^^*FKwX+5E%lv} zy!O{M|8nAB1i?7(B`(;)<0ghmNKVrg(YvRIbtIh~Z!RS*vBur2=W?An(d zJoSjcIz$tOTIA9~8rU*DZ~!hoi}c$(ic_lxtuSatz#bt5UdD&w%hL6tBrGS3H}?eM ze{iAJ+Y1&bB`ZNxD$bU^zs!G1rg-B2I5?~qx89iz(l7MXz=50cL&^Lr`Fijdh^BvK z>P=6o&``|%8rd+WjR+t8qDU)%Eo;TEGPx5#^xJrqcdmPOr(`;iC2tVy$(Ho1$HmxkN)MVuwtv zw&A)sY!UY}EbrNS+hRLCZVM&tpqRraG$wJSZH(RN2%ifl#wAk z>h*dZ$hk{lYkl(j=thn!uP^|;qat-puPEy#7}0G=HzX$HL9M&A{sD>PGdC(2Cb3kd zq27t|R|=9;`)z6}D3roMO_ASG*!Qy*Z@U!K9fQ#k7g?s#3qh`4NHA;Pt1e(1eiED-OP$@;xK6th2j1?{&kCXqVlz{8xHGs2^(qpo!^n~*NPx@K!AmmtMWIeB$}d+{uP3$$d}(4O9s z04EofOy4*9ohJMys4$gkjLeK!>HKgD%fBzjc3P2!ZbJ+viLNHUiR5*z`Xu4;NG>_u zohjtt;5xh=-lh8ZW5c6N)px_cEAd}_J_E^j>RCJ4+L%hF4QR_&^JH(OE6Ol@+N^(` zrP#GXElgLoJ+pEKp%#Oj-9P0abI4skEqXwfSQ48(6AnT09yz8I*$31Z-fL{`67=hW zDa;%E$y_i}U?c_8z`U;y+^R3|8TNjNG8XQFFK&Ip%JX#} zm@)R1O6Ou3JK&isCEn~}S5IOf3^FQx#kf+f{WC37Q|M9Ve$Knl5YdY_O747Rx2rk3 zxDSW%a*7d{rPoIOPCV?f=7>81h`29 z3)`FCByZ`AmdU+MZI!}I*ejC3>H#n^wS18#cmH6O7Q}|LMC%L9hR{x^mXo6R7iU1KJoWArwaHrTmH12SgNuG zpKWTRSC{axp!46YZf7yOVG=AaVbWnLiEcSqRCcMP#T-T)c41(Czd!eFg(mI7J&)%< ze+|WFM?MP{9pQJcdvVT3h6_Xf;Nm4x!S?; zc+2qWZ#g;Cc9js!2rfx#&bp(S_+rM5E$JO%X~XP<95 zPkoTiB=%as7{_m0^TnUMooK*%T4gUp`qAvcH|6iz2R@ClQfz6lcy|?Lk|nAjW0>a+ z%_Kc-O~;s$14ueM7<-5?tCYf%AJusT3t{acvM`bs6!9%aXo< z7;LaFrKPZ9l?0R`%JOpAFM7WGI?Z`=sWPq^M(@{Cn<-J_xIzg8cFnM67qVuI0m(EI z=;c2O42R}~UrAKKT(}LDGEPDS`(Kh6jhXKY)+etV`8`6ZF&xL1aI$K|)b`AET87t*Gg%6dIUC`cqRA`sW)VgD;Ku~hmk zqZS;1!Tsy8ErEVwTtf3lB2D>_Wz+!2(}~zI@-*}@Dv5%J7A$9UZ@9ynsr7?oE$ z*}^qc9trK3CPFz{(mFf5npeO+5VxQb(exW35SQP5y+=U$Ge^yMt5T*?F+gU>k+?}e z4L|fi5eKPrDFky2QxPQ~?%c@xkvGJ|aaG_vLGDSWys12!e3esO^C8j;Ylb*kq@l@R&W#!Edw;L3{|kDMxVf+fui{v2 z++5U+LZ5|eSgIv+Q#i!EQkS<^k}+z4N .enc + node . env: - name: HOST value: 0.0.0.0 @@ -71,6 +78,10 @@ spec: value: "{{ .Values.config.api.processor.grpc.port }}" - name: API_BLUEPRINT_PROCESSOR_GRPC_AUTH_TOKEN value: {{ .Values.config.api.processor.grpc.authToken }} + - name: KEYSTORE + value: "/certs/org.onap.sdnc-cds.p12" + - name: PASSPHRASE_VALUE + {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cds-certs-pass" "key" "password") | indent 14 }} readinessProbe: tcpSocket: port: {{ .Values.service.internalPort }} @@ -80,6 +91,8 @@ spec: - mountPath: /etc/localtime name: localtime readOnly: true + - mountPath: /certs + name: certs resources: {{ include "common.resources" . | indent 12 }} {{- if .Values.nodeSelector }} @@ -94,5 +107,8 @@ spec: - name: localtime hostPath: path: /etc/localtime + - name: certs + secret: + secretName: {{ include "common.fullname" . }}-certs imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" diff --git a/kubernetes/cds/charts/cds-ui/templates/secret.yaml b/kubernetes/cds/charts/cds-ui/templates/secret.yaml new file mode 100644 index 0000000000..6dcf31f6ca --- /dev/null +++ b/kubernetes/cds/charts/cds-ui/templates/secret.yaml @@ -0,0 +1,31 @@ +{{/* +# Copyright © 2021 Orange +# Modifications Copyright © 2018 Amdocs, Bell Canada +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} + +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.fullname" . }}-certs + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ include "common.release" . }} + heritage: {{ .Release.Service }} +data: +{{ tpl (.Files.Glob "resources/certs/*").AsSecrets . | indent 2 }} +--- +{{ include "common.secretFast" . }} diff --git a/kubernetes/cds/charts/cds-ui/values.yaml b/kubernetes/cds/charts/cds-ui/values.yaml index 496aa85fea..d94c59f02a 100644 --- a/kubernetes/cds/charts/cds-ui/values.yaml +++ b/kubernetes/cds/charts/cds-ui/values.yaml @@ -21,6 +21,20 @@ global: loggingRepository: docker.elastic.co loggingImage: beats/filebeat:5.5.0 + +################################################################# +# Secrets metaconfig +################################################################# +secrets: + - uid: cds-certs-pass + type: password + externalSecret: '{{ tpl (default "" .Values.certs.certsExternalSecret) . }}' + password: '{{ .Values.certs.password }}' + +certs: + password: "DG*HkOIe5W^F}XYI6o!2sD(6" + #certsExternalSecret: + subChartsOnly: enabled: true -- 2.16.6