From: elinuxhenrik Date: Thu, 23 Jul 2020 16:35:50 +0000 (+0200) Subject: Add documentation for certs configuration X-Git-Tag: 2.0.1~11 X-Git-Url: https://gerrit.o-ran-sc.org/r/gitweb?a=commitdiff_plain;h=refs%2Fchanges%2F46%2F4446%2F1;p=nonrtric.git Add documentation for certs configuration Change-Id: Ia722c92c4963cfe19a42593d2dbf2aab9af67731 Issue-ID: NONRTRIC-264 Signed-off-by: elinuxhenrik --- diff --git a/docs/developer-guide.rst b/docs/developer-guide.rst index 36ae9d22..ffb5dc07 100644 --- a/docs/developer-guide.rst +++ b/docs/developer-guide.rst @@ -45,6 +45,36 @@ The SDNC url to access the Northbound API, Credentials: admin/Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U +Configuration of certs +---------------------- +The SDNC-A1 controller uses the default keystore and truststore that are built into the container. + +The paths and passwords for these stores are located in a properties file: + nonrtric/sdnc-a1-controller/oam/installation/src/main/properties/https-props.properties + +The default truststore includes the a1simulator cert as a trusted cert which is located here: + https://gerrit.o-ran-sc.org/r/gitweb?p=sim/a1-interface.git;a=tree;f=near-rt-ric-simulator/certificate;h=172c1e5aacd52d760e4416288dc5648a5817ce65;hb=HEAD + +The default keystore, truststore, and https-props.properties files can be overridden by mounting new files using the "volumes" field of docker-compose. Uncommment the following lines in docker-compose to do this, and provide paths to the new files: + +:: + +#volumes: +# - :/etc/ssl/certs/java/keystore.jks:ro +# - :/etc/ssl/certs/java/truststore.jks:ro +# - :/opt/onap/sdnc/data/properties/https-props.properties:ro + +The target paths in the container should not be modified. + +For example, assuming that the keystore, truststore, and https-props.properties files are located in the same directory as docker-compose: + +`volumes:` + `- ./new_keystore.jks:/etc/ssl/certs/java/keystore.jks:ro` + + `- ./new_truststore.jks:/etc/ssl/certs/java/truststore.jks:ro` + + `- ./new_https-props.properties:/opt/onap/sdnc/data/properties/https-props.properties:ro` + Policy Agent ============ @@ -62,6 +92,36 @@ The O-RAN Non-RT RIC Policy Agent provides a REST API for management of policice | The Policy Agent can be accessed over the REST API or through the DMaaP Interface. The REST API is documented in the | *nonrtric/policy-agent/docs/api.yaml* file. Please refer to the README file of Policy Agent to know more about the API's. +Configuration of certs +---------------------- +The Policy Agent uses the default keystore and truststore that are built into the container. The paths and passwords for these stores are located in a yaml file: + nonrtric/policy-agent/config/application.yaml + +The default truststore includes a1simulator cert as a trusted cert which is located here: + https://gerrit.o-ran-sc.org/r/gitweb?p=sim/a1-interface.git;a=tree;f=near-rt-ric-simulator/certificate;h=172c1e5aacd52d760e4416288dc5648a5817ce65;hb=HEAD + +The default truststore also includes a1controller cert as a trusted cert which is located here (keystore.jks file): + https://gerrit.o-ran-sc.org/r/gitweb?p=nonrtric.git;a=tree;f=sdnc-a1-controller/oam/installation/sdnc-a1/src/main/resources;h=17fdf6cecc7a866c5ce10a35672b742a9f0c4acf;hb=HEAD + +There is also Policy Agent's own cert in the default truststore for mocking purposes and unit-testing (ApplicationTest.java). + +The default keystore, truststore, and application.yaml files can be overridden by mounting new files using the "volumes" field of docker-compose or docker run command. + +Assuming that the keystore, truststore, and application.yaml files are located in the same directory as docker-compose, the volumes field should have these entries: + +`volumes:` + `- ./new_keystore.jks:/opt/app/policy-agent/etc/cert/keystore.jks:ro` + + `- ./new_truststore.jks:/opt/app/policy-agent/etc/cert/truststore.jks:ro` + + `- ./new_application.yaml:/opt/app/policy-agent/config/application.yaml:ro` + +The target paths in the container should not be modified. + +Example docker run command for mounting new files (assuming they are located in the current directory): + +`docker run -p 8081:8081 -p 8433:8433 --name=policy-agent-container --network=nonrtric-docker-net --volume "$PWD/new_keystore.jks:/opt/app/policy-agent/etc/cert/keystore.jks" --volume "$PWD/new_truststore.jks:/opt/app/policy-agent/etc/cert/truststore.jks" --volume "$PWD/new_application.yaml:/opt/app/policy-agent/config/application.yaml" o-ran-sc/nonrtric-policy-agent:2.0.0-SNAPSHOT` + End-to-end call =============== diff --git a/policy-agent/README.md b/policy-agent/README.md index 90a67c9e..649a2b54 100644 --- a/policy-agent/README.md +++ b/policy-agent/README.md @@ -33,8 +33,8 @@ volumes: The target paths in the container should not be modified. -Example docker run command for mounting new files: -docker run -p 8081:8081 -p 8433:8433 --name=policy-agent-container --network=nonrtric-docker-net --volume /new_keystore.jks:/opt/app/policy-agent/etc/cert/keystore.jks --volume /new_truststore.jks:/opt/app/policy-agent/etc/cert/truststore.jks --volume /new_application.yaml:/opt/app/policy-agent/config/application.yaml o-ran-sc/nonrtric-policy-agent:2.0.0-SNAPSHOT +Example docker run command for mounting new files (assuming they are located in the current directory): +docker run -p 8081:8081 -p 8433:8433 --name=policy-agent-container --network=nonrtric-docker-net --volume "$PWD/new_keystore.jks:/opt/app/policy-agent/etc/cert/keystore.jks" --volume "$PWD/new_truststore.jks:/opt/app/policy-agent/etc/cert/truststore.jks" --volume "$PWD/new_application.yaml:/opt/app/policy-agent/config/application.yaml" o-ran-sc/nonrtric-policy-agent:2.0.0-SNAPSHOT To Run Policy Agent in Local: