From: ktimoney Date: Wed, 19 Apr 2023 10:32:34 +0000 (+0100) Subject: Add support for cert-manager X-Git-Url: https://gerrit.o-ran-sc.org/r/gitweb?a=commitdiff_plain;h=c5c3ab4b177f4ab134746045288b93ce3ec9e4e0;p=nonrtric.git Add support for cert-manager Issue-ID: NONRTRIC-866 Change-Id: Id8b9340a5c99d7feff3691ce83295f26dbd5b03d Signed-off-by: ktimoney --- diff --git a/service-exposure/MutatingWebhookConfiguration.yaml b/service-exposure/MutatingWebhookConfiguration.yaml index 1a3dd200..bb5cd6a2 100644 --- a/service-exposure/MutatingWebhookConfiguration.yaml +++ b/service-exposure/MutatingWebhookConfiguration.yaml @@ -1,6 +1,6 @@ # # ============LICENSE_START======================================================= -# Copyright (C) 2022 Nordix Foundation. +# Copyright (C) 2022-2023 Nordix Foundation. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -22,6 +22,8 @@ kind: MutatingWebhookConfiguration metadata: name: jwt-proxy-webhook namespace: default + annotations: + cert-manager.io/inject-ca-from: default/webhook-server-cert webhooks: - name: rapps-webhook.default.svc.cluster.local admissionReviewVersions: @@ -33,10 +35,9 @@ webhooks: app.kubernetes.io/name: rapp-helloworld-invoker1 clientConfig: service: - name: jwt-proxy-admission-controller + name: jwt-proxy-admission-controller namespace: default path: "/inject-sidecar" - caBundle: "${CA_PEM_B64}" rules: - operations: [ "CREATE" ] apiGroups: [""] diff --git a/service-exposure/README.md b/service-exposure/README.md index 938e4ae3..8afe45ba 100644 --- a/service-exposure/README.md +++ b/service-exposure/README.md @@ -21,32 +21,17 @@ This collection of files represent rapp service exposure prototyping in O-RAN. Prerequisites: Istio should be installed on your cluster with the demo profile. You may need to add istioctl to you $PATH variable. istioctl install --set profile=demo Please refer to the istio documentation for more information. -You will also need cfssl installed on your system: sudo apt install golang-cfssl Please refer to the K8s documentation: Manage TLS Certificates in a Cluster The deployments have been implemented and tested using minikube. If you are not using minikube, references to "minikube ip" should be changed to the appropiate value for you host. +The ipAddresses field in cluster-issuer.yaml not referring to the generic localhost ip should be changed to your own ip. To replicate these tests you will need to setup the various host path referenced in the yaml files on your own machine. chartmuseum.yaml: path: /var/chartmuseum/charts -keycloak.yaml: path: /var/keycloak/certs postgres.yaml: path: "/var/keycloak/data2" -rapps-keycloak-mgr.yaml: path: /var/rapps/certs -rapps-webhook.yaml: "-hostPath", "/var/rapps/certs" or change them to match your own setup. -The certs directory contains 3 shell scripts for creating the server, client and webhook certs: server_certs.sh, client_certs.sh and webhook_certs.sh -Keystores/Truststores generated by the server_certs.sh script: server.keystore and server.truststore go in the "/var/keycloak/certs" directory -Certs generated by the client_certs.sh script: client.crt, client.key and rootCA.crt go in the "/var/rapps/certs" directory -The webhook_certs.sh script generates certs for use in the MutatingWebhookConfiguration.yaml and the rapps-webhook.yaml files. -To configure MutatingWebhookConfiguration.yaml run the following commands: -1. ca_pem_b64="$(openssl base64 -A <"./certs/ca.pem")" -2. sed -i 's/${CA_PEM_B64}/'"$ca_pem_b64"'/g' MutatingWebhookConfiguration.yaml - -To configure rapps-webhook.yaml append the rapps-webhook-tls.yaml file to the end of it -1. cat rapps-webhook.yaml ./certs/rapps-webhook-tls.yaml >> rapps-webhook.yaml.tmp -2. mv rapps-webhook.yaml.tmp rapps-webhook.yaml - Create the istio-nonrtric namespace and enable it for istio injection kubectl create ns istio-nonrtric @@ -90,10 +75,15 @@ You will need to package your rapp charts and copy them to the /var/chartmuseum/ helm package rapp-helloworld-invoker2 scp -i $(minikube ssh-key) rapp-helloworld-invoker2-0.1.0.tgz docker@$(minikube ip):/var/chartmuseum/charts +Start cert-manager using the following command: + ./cert-manager.sh deploy -Start keycloak and postgres in the default namespace with istio injection: +Copy keycloak client certs into the istio-nonrtric namespace by running: + ./copy_tls_secret.sh -n cm-keycloak-client-certs -s default -d istio-nonrtric -Run ./keycloak.sh deploy +Start keycloak and postgres in the default namespace with istio injection by running: + + ./keycloak.sh deploy To start the management pods run: @@ -138,5 +128,8 @@ To uninstall the management pods and and rapps run: You can also uninstall individual rapp using the undeploy_rapp.sh script. e.g. ./undeploy_rapp.sh rapp-helloworld-provider -Remove postgres and keycloak with the following commands: +Remove postgres and keycloak with the following command: ./keycloak.sh undeploy + +Remove cert-manager with the following command: + ./cert-manager.sh undeploy diff --git a/service-exposure/cert-manager.sh b/service-exposure/cert-manager.sh new file mode 100755 index 00000000..1b5f8153 --- /dev/null +++ b/service-exposure/cert-manager.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# +# ============LICENSE_START======================================================= +# Copyright (C) 2023 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# + +if [ -z "$1" ] + then + echo "No argument supplied" + exit 1 +fi + +OPERATION=$1 +WORKDIR=$(dirname "$(realpath "$0")") + +if [ "$OPERATION" == "deploy" ]; then + echo "Deploying cert-manager application..." + echo "-------------------------------------" + kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml + echo "" + echo "Waiting for pods to start..." + echo "----------------------------" + kubectl wait deployment -n cert-manager cert-manager --for=condition=available --timeout=300s + kubectl wait deployment -n cert-manager cert-manager-cainjector --for=condition=available --timeout=300s + kubectl wait deployment -n cert-manager cert-manager-webhook --for=condition=available --timeout=300s + echo "" + echo "Checking pod status..." + echo "----------------------" + kubectl get pods -n cert-manager + echo "" + # Once the pods are up and running we still need to wait for the certificate controller process to start + # before certificates can be issued + echo "Waiting for certificate controller..." + echo "------------------------------------" + sleep 100 + echo "" + echo "Creating certificates..." + echo "------------------------" + kubectl apply -f $WORKDIR/cluster-issuer.yaml + kubectl apply -f $WORKDIR/issuer.yaml + kubectl apply -f $WORKDIR/webhook-server-certificate.yaml + kubectl apply -f $WORKDIR/keycloak-server-certificate.yaml + kubectl apply -f $WORKDIR/keycloak-client-certificate.yaml +elif [ "$OPERATION" == "undeploy" ]; then + echo "Deleting certificates..." + echo "------------------------" + kubectl delete -f $WORKDIR/cluster-issuer.yaml + kubectl delete -f $WORKDIR/issuer.yaml + kubectl delete -f $WORKDIR/webhook-server-certificate.yaml + kubectl delete -f $WORKDIR/keycloak-server-certificate.yaml + kubectl delete -f $WORKDIR/keycloak-client-certificate.yaml + kubectl delete secret -n default cm-cluster-issuer-rootca-secret + kubectl delete secret -n default cm-keycloak-client-certs + kubectl delete secret -n default cm-keycloak-server-certs + kubectl delete secret -n default cm-webhook-server-certs + echo "Undeploying cert-manager application..." + echo "---------------------------------------" + kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml +else + echo "Unrecogized operation ${OPERATION}" + exit 1 +fi + +exit 0 diff --git a/service-exposure/charts/rapp-helloworld-invoker1/values.yaml b/service-exposure/charts/rapp-helloworld-invoker1/values.yaml index 8e89cff4..f8c36e38 100644 --- a/service-exposure/charts/rapp-helloworld-invoker1/values.yaml +++ b/service-exposure/charts/rapp-helloworld-invoker1/values.yaml @@ -1,6 +1,6 @@ # # ============LICENSE_START======================================================= -# Copyright (C) 2022 Nordix Foundation. +# Copyright (C) 2022-2023 Nordix Foundation. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -113,6 +113,9 @@ rapp: realm: demo client: demoprovider-cli authenticator: client-jwt + caCrt: "/certs/ca.crt" + tlsCrt: "/certs/tls.crt" + tlsKey: "/certs/tls.key" roles: - role : provider-viewer grants: diff --git a/service-exposure/charts/rapp-helloworld-invoker2/values.yaml b/service-exposure/charts/rapp-helloworld-invoker2/values.yaml index bd6f5aba..4d7a1fa8 100644 --- a/service-exposure/charts/rapp-helloworld-invoker2/values.yaml +++ b/service-exposure/charts/rapp-helloworld-invoker2/values.yaml @@ -1,6 +1,6 @@ # # ============LICENSE_START======================================================= -# Copyright (C) 2022 Nordix Foundation. +# Copyright (C) 2022-2023 Nordix Foundation. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -113,6 +113,9 @@ rapp: realm: demo client: demoprovider-cli authenticator: client-jwt + caCrt: "/certs/ca.crt" + tlsCrt: "/certs/tls.crt" + tlsKey: "/certs/tls.key" roles: - role : provider-viewer grants: diff --git a/service-exposure/charts/rapp-helloworld-provider/values.yaml b/service-exposure/charts/rapp-helloworld-provider/values.yaml index bb6ef19d..d5435f94 100644 --- a/service-exposure/charts/rapp-helloworld-provider/values.yaml +++ b/service-exposure/charts/rapp-helloworld-provider/values.yaml @@ -1,6 +1,6 @@ # # ============LICENSE_START======================================================= -# Copyright (C) 2022 Nordix Foundation. +# Copyright (C) 2022-2023 Nordix Foundation. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -112,6 +112,10 @@ rapp: realm: demo client: demoprovider-cli authenticator: client-jwt + tlsCrt: "/certs/tls.crt" + email: "client@mail.com" + subjectDN: oran + mappingSource: "Subject's Alternative Name E-mail" roles: - role : provider-viewer grants: diff --git a/service-exposure/cluster-issuer.yaml b/service-exposure/cluster-issuer.yaml new file mode 100644 index 00000000..e6d96b2a --- /dev/null +++ b/service-exposure/cluster-issuer.yaml @@ -0,0 +1,66 @@ +# +# ============LICENSE_START======================================================= +# Copyright (C) 2023 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-rootca-cluster-issuer +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: selfsigned-rootca + namespace: default +spec: + isCA: true + duration: 2160h # 90d + renewBefore: 360h # 15d + commonName: selfsigned-rootca + subject: + organizations: + - oran + organizationalUnits: + - oran + countries: + - Ireland + localities: + - Dublin + streetAddresses: + - Main Street + secretName: cm-cluster-issuer-rootca-secret + privateKey: + rotationPolicy: Always + algorithm: RSA + encoding: PKCS1 + size: 2048 + issuerRef: + name: selfsigned-rootca-cluster-issuer + kind: ClusterIssuer + group: cert-manager.io + dnsNames: + - localhost + - minikube + ipAddresses: + - 127.0.0.1 + - 192.168.49.2 + emailAddresses: + - ca@mail.com +--- diff --git a/service-exposure/copy_tls_secret.sh b/service-exposure/copy_tls_secret.sh new file mode 100755 index 00000000..5b2fbe7e --- /dev/null +++ b/service-exposure/copy_tls_secret.sh @@ -0,0 +1,83 @@ +#!/bin/bash +# +# ============LICENSE_START======================================================= +# Copyright (C) 2023 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# + +function usage() +{ + echo "" + echo "Usage: $0 -n secretName -s sourceNamespace -d destinationNamespace" + echo -e "\t-n Name of the secret" + echo -e "\t-s Namespace of the secret" + echo -e "\t-d Namespace to copy the secret to" + exit 1 +} + +while getopts "n:s:d:" opt +do + case "$opt" in + n ) secretName="$OPTARG" ;; + s ) sourceNS="$OPTARG" ;; + d ) destinationNS="$OPTARG" ;; + ? ) usage ;; + esac +done + +# Check if any of the paramters are empty +if [ -z "$secretName" ] || [ -z "$sourceNS" ] || [ -z "$destinationNS" ] +then + echo "Some or all of the parameters are empty"; + usage +fi + +# Check if the secret exits +kubectl get secret $secretName -n $sourceNS >/dev/null 2>/dev/null +if [ $? -ne 0 ] +then + echo "$secretName in $sourceNS does not exist" + usage +fi + +# Check if the destination namespace exists +kubectl get ns $destinationNS >/dev/null 2>/dev/null +if [ $? -ne 0 ] +then + echo "$destinationNS does not exist" + usage +fi + +# Begin script in case all parameters are correct +echo "Copying $secretName from $sourceNS to $destinationNS" + +tlsCrt=$(kubectl get secret ${secretName} -n ${sourceNS} -o json -o=jsonpath="{.data.tls\.crt}") +tlsKey=$(kubectl get secret ${secretName} -n ${sourceNS} -o json -o=jsonpath="{.data.tls\.key}") +caCrt=$(kubectl get secret ${secretName} -n ${sourceNS} -o json -o=jsonpath="{.data.ca\.crt}") + +kubectl apply -f - <