From e0ab3ca89c2850f26ce7e3bbccb891d750f1491b Mon Sep 17 00:00:00 2001 From: dave kormann Date: Tue, 30 Jul 2019 14:07:46 -0400 Subject: [PATCH] FEATURE: Docker image for creating Helm secrets This change adds a docker image that generates Kubernetes secrets from TLS keys and certificates; it is primarily intended for use with TLS-enabled helm/tiller. Signed-off-by: dave kormann Change-Id: I850b8c9cd24abf260abde8be5ed4331807f8856f --- ric-infra/25-tiller/docker/Dockerfile | 36 ++++++++++ ric-infra/25-tiller/docker/bin/cert-gen.sh | 84 ++++++++++++++++++++++ .../25-tiller/docker/bin/svcacct-to-kubeconfig.sh | 45 ++++++++++++ ric-infra/25-tiller/docker/bin/tls-secrets.sh | 51 +++++++++++++ ric-infra/25-tiller/docker/container-tag.yaml | 2 + 5 files changed, 218 insertions(+) create mode 100644 ric-infra/25-tiller/docker/Dockerfile create mode 100755 ric-infra/25-tiller/docker/bin/cert-gen.sh create mode 100755 ric-infra/25-tiller/docker/bin/svcacct-to-kubeconfig.sh create mode 100755 ric-infra/25-tiller/docker/bin/tls-secrets.sh create mode 100644 ric-infra/25-tiller/docker/container-tag.yaml diff --git a/ric-infra/25-tiller/docker/Dockerfile b/ric-infra/25-tiller/docker/Dockerfile new file mode 100644 index 00000000..5883e038 --- /dev/null +++ b/ric-infra/25-tiller/docker/Dockerfile @@ -0,0 +1,36 @@ +# Copyright (c) 2019 AT&T Intellectual Property. +# Copyright (c) 2019 Nokia. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +FROM alpine + +MAINTAINER "RIC" + +LABEL name="A container with support for creating Kubernetes SSL secrets" + +RUN apk update + +RUN apk add openssl + +# unfortunately not available by itself in apk +ADD https://storage.googleapis.com/kubernetes-release/release/v1.14.1/bin/linux/amd64/kubectl /bin/kubectl +RUN chmod +x /bin/kubectl + +COPY bin/cert-gen.sh /bin/cert-gen.sh +COPY bin/svcacct-to-kubeconfig.sh /bin/svcacct-to-kubeconfig.sh +COPY bin/tls-secrets.sh /tls-secrets.sh + +RUN mkdir /pki + +CMD /tls-secrets.sh + diff --git a/ric-infra/25-tiller/docker/bin/cert-gen.sh b/ric-infra/25-tiller/docker/bin/cert-gen.sh new file mode 100755 index 00000000..29fba98d --- /dev/null +++ b/ric-infra/25-tiller/docker/bin/cert-gen.sh @@ -0,0 +1,84 @@ +#!/bin/sh + +# Copyright (c) 2019 AT&T Intellectual Property. +# Copyright (c) 2019 Nokia. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +dnBase=${CERT_DN:-'/C=US/O=O-RAN Alliance/OU=O-RAN Software Community'} +keyBits=${KEY_BITS:-4096} + +CAHome=${CA_DIR:-'/pki'} +CADays=${CA_CERT_EXPIRY:-9125} +CAKey=${CAHome}/${CA_KEY_NAME:-ca.key.pem} +CACert=${CAHome}/${CA_CERT_NAME:-ca.cert.pem} +# +CertHome=${CERT_DIR:-$CAHome} +# +TillerDays=${TILLER_CERT_EXPIRY:-3650} +TillerKey=${CertHome}/${TILLER_KEY_NAME:-tiller.key.pem} +TillerCert=${CertHome}/${TILLER_CERT_NAME:-tiller.cert.pem} +TillerCN=${TILLER_CN:-tiller} +# +HelmDays=${HELM_CERT_EXPIRY:-3650} +HelmKey=${CertHome}/${HELM_KEY_NAME:-helm.key.pem} +HelmCert=${CertHome}/${HELM_CERT_NAME:-helm.cert.pem} +HelmCN=${HELM_CN:-helm} + +# 1. CA +if [ ! -d ${CAHome} ]; then + mkdir -p ${CAHome} +fi +if [ ! -f ${CAKey} ]; then + openssl genrsa -out ${CAKey} ${keyBits} +fi +if [ ! -f ${CACert} ]; then + openssl req -new -x509 -extensions v3_ca -sha256 -days ${CADays} \ + -key ${CAKey} \ + -out ${CACert} \ + -subj "${dnBase}" +fi + +# 2. tiller server cert +if [ ! -f ${TillerKey} ]; then + openssl genrsa -out ${TillerKey} ${keyBits} +fi +if [ ! -f ${TillerCert} ]; then + CSR=`mktemp` + openssl req -new -sha256 \ + -key ${TillerKey} \ + -out ${CSR} \ + -subj "${dnBase}/CN=${TillerCN}" + openssl x509 -req -CAcreateserial -days ${TillerDays} \ + -CA ${CACert} \ + -CAkey ${CAKey} \ + -in ${CSR} \ + -out ${TillerCert} +fi + +# 3. helm client cert +if [ ! -f ${HelmKey} ]; then + openssl genrsa -out ${HelmKey} ${keyBits} +fi +if [ ! -f ${HelmCert} ]; then + CSR=`mktemp` + openssl req -new -sha256 \ + -key ${HelmKey} \ + -out ${CSR} \ + -subj "${dnBase}/CN=${HelmCN}" + openssl x509 -req -CAcreateserial -days ${HelmDays} \ + -CA ${CACert} \ + -CAkey ${CAKey} \ + -in ${CSR} \ + -out ${HelmCert} +fi diff --git a/ric-infra/25-tiller/docker/bin/svcacct-to-kubeconfig.sh b/ric-infra/25-tiller/docker/bin/svcacct-to-kubeconfig.sh new file mode 100755 index 00000000..e294b617 --- /dev/null +++ b/ric-infra/25-tiller/docker/bin/svcacct-to-kubeconfig.sh @@ -0,0 +1,45 @@ +#!/bin/sh + +# Copyright (c) 2019 AT&T Intellectual Property. +# Copyright (c) 2019 Nokia. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# generate a kubconfig (at ${KUBECONFIG} file from the automatically-mounted +# service account token. +# ENVIRONMENT: +# SVCACCT_NAME: the name of the service account user. default "default" +# CLUSTER_NAME: the name of the kubernetes cluster. default "kubernetes" +# KUBECONFIG: where the generated file will be deposited. +SVCACCT_TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token` +CLUSTER_CA=`base64 /var/run/secrets/kubernetes.io/serviceaccount/ca.crt|tr -d '\n'` + +cat >${KUBECONFIG} <<__EOF__ +ApiVersion: v1 +kind: Config +users: +- name: ${SVCACCT_NAME:-default} + user: + token: ${SVCACCT_TOKEN} +clusters: +- cluster: + certificate-authority-data: ${CLUSTER_CA} + server: https://kubernetes.default.svc.cluster.local/ + name: ${CLUSTER_NAME:-kubernetes} +contexts: +- context: + cluster: ${CLUSTER_NAME:-kubernetes} + user: ${SVCACCT_NAME:-default} + name: svcs-acct-context +current-context: svcs-acct-context +__EOF__ diff --git a/ric-infra/25-tiller/docker/bin/tls-secrets.sh b/ric-infra/25-tiller/docker/bin/tls-secrets.sh new file mode 100755 index 00000000..b2657504 --- /dev/null +++ b/ric-infra/25-tiller/docker/bin/tls-secrets.sh @@ -0,0 +1,51 @@ +#!/bin/sh + +# Copyright (c) 2019 AT&T Intellectual Property. +# Copyright (c) 2019 Nokia. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -x + +export ENTITIES=${ENTITIES:-helm tiller} +export KUBECONFIG=${KUBECONFIG:-/kubeconfig} +export CA_DIR=${CA_DIR:-/pki} +if [ ! -z ${TARGET_NAMESPACE} ]; then + SECRET_NS="--namespace ${TARGET_NAMESPACE}" +else + SECRET_NS='' +fi + +if [ ! -f ${KUBECONFIG} ]; then + export SVCACCT_NAME=${SVCACCT_NAME:-tiller} + /bin/svcacct-to-kubeconfig.sh +fi + +if [ ! -f ${CA_DIR}/helm.key.pem -o \ + ! -f ${CA_DIR}/tiller.key.pem ]; then + /bin/cert-gen.sh +fi + +# i'm assuming we can just lose the CA key. +for entity in ${ENTITIES}; do + kubectl create secret generic \ + --from-file=ca.crt=/pki/ca.cert.pem \ + --from-file=tls.crt=/pki/${entity}.cert.pem \ + --from-file=tls.key=/pki/${entity}.key.pem \ + ${SECRET_NS} ${entity} + + kubectl label secret \ + ${SECRET_NS} ${entity} \ + app=helm \ + name=${entity} +done diff --git a/ric-infra/25-tiller/docker/container-tag.yaml b/ric-infra/25-tiller/docker/container-tag.yaml new file mode 100644 index 00000000..079c0dc8 --- /dev/null +++ b/ric-infra/25-tiller/docker/container-tag.yaml @@ -0,0 +1,2 @@ +--- +tag: 0.0.1 -- 2.16.6