Skip to content
This repository was archived by the owner on Feb 11, 2025. It is now read-only.

Commit 45d7cdd

Browse files
b1tamaramaxmoehldomdom82
authored
refactor: Reimplement TLS configuration in coding and in jobs config (#79)
* wip: refactor: tls configuration * refactor: adapt tls spec config * refactor: Adapt integration tests to run with new TLS structs * refactor: Use client_cas instead of ca * refactor: Adapt acceptance tests to have a correct CN for bosh director cert --------- Co-authored-by: Maximilian Moehl <[email protected]> Co-authored-by: Dominik Froehlich <[email protected]>
1 parent bd75214 commit 45d7cdd

38 files changed

+343
-302
lines changed

‎acceptance-tests/bosh_helpers.go‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -99,20 +99,28 @@ var opsfileStartApache = `
9999
apt-get update && apt-get install apache2 -y && apache2ctl start
100100
`
101101

102+
var opsfileChangeBoshDirectorCN string = `---
103+
# Replace bosh director cert common name with the right one
104+
- type: replace
105+
path: /instance_groups/name=pcap-api/jobs/name=pcap-api/properties/pcap-api/bosh/tls/common_name
106+
value: ((director_common_name))
107+
`
108+
102109
// opsfiles that need to be set for all tests
103-
var defaultOpsfiles = []string{opsfileChangeName, opsfileChangeVersion, opsfileAddSSHUser, opsfileStartApache}
110+
var defaultOpsfiles = []string{opsfileChangeName, opsfileChangeVersion, opsfileChangeBoshDirectorCN, opsfileAddSSHUser, opsfileStartApache}
104111
var defaultSSHUser string = "ginkgo"
105112

106113
// buildManifestVars returns a map of variables needed to deploy pcap.
107114
func buildManifestVars(baseManifestVars baseManifestVars, customVars map[string]interface{}) map[string]interface{} {
108115
vars := map[string]interface{}{
109-
"release-version": config.ReleaseVersion,
110-
"director_ssl_ca": config.BoshDirectorCA,
111-
"bosh_director_api": config.BoshDirectorAPI,
112-
"director_ssl_cert": config.BoshDirectorCert,
113-
"director_ssl_key": config.BoshDirectorKey,
114-
"deployment-name": baseManifestVars.deploymentName,
115-
"ssh_user": defaultSSHUser,
116+
"release-version": config.ReleaseVersion,
117+
"director_ssl_ca": config.BoshDirectorCA,
118+
"bosh_director_api": config.BoshDirectorAPI,
119+
"director_ssl_cert": config.BoshDirectorCert,
120+
"director_ssl_key": config.BoshDirectorKey,
121+
"director_common_name": config.BoshDirectorCertCN,
122+
"deployment-name": baseManifestVars.deploymentName,
123+
"ssh_user": defaultSSHUser,
116124
}
117125
for k, v := range customVars {
118126
vars[k] = v

‎acceptance-tests/config.go‎

Lines changed: 37 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package acceptance_tests
22

33
import (
4+
"crypto/x509"
5+
"encoding/pem"
46
"fmt"
57
"os"
68
"os/exec"
@@ -9,18 +11,19 @@ import (
911
var config Config
1012

1113
type Config struct {
12-
ReleaseRepoPath string `json:"releaseRepoPath"`
13-
ReleaseVersion string `json:"releaseVersion"`
14-
BoshDirectorAPI string `json:"boshDirectorAPI"`
15-
BoshDirectorCert string `json:"boshDirectorCert"`
16-
BoshDirectorKey string `json:"boshDirectorKey"`
17-
BoshDirectorCA string `json:"boshDirectorCA"`
18-
BoshClient string `json:"boshClient"`
19-
BoshClientSecret string `json:"boshClientSecret"`
20-
BoshEnvironment string `json:"boshEnvironment"`
21-
BoshPath string `json:"boshPath"`
22-
BaseManifestPath string `json:"baseManifestPath"`
23-
HomePath string `json:"homePath"`
14+
ReleaseRepoPath string `json:"releaseRepoPath"`
15+
ReleaseVersion string `json:"releaseVersion"`
16+
BoshDirectorAPI string `json:"boshDirectorAPI"`
17+
BoshDirectorCertCN string `json:"boshDirectorCertCN"`
18+
BoshDirectorCert string `json:"boshDirectorCert"`
19+
BoshDirectorKey string `json:"boshDirectorKey"`
20+
BoshDirectorCA string `json:"boshDirectorCA"`
21+
BoshClient string `json:"boshClient"`
22+
BoshClientSecret string `json:"boshClientSecret"`
23+
BoshEnvironment string `json:"boshEnvironment"`
24+
BoshPath string `json:"boshPath"`
25+
BaseManifestPath string `json:"baseManifestPath"`
26+
HomePath string `json:"homePath"`
2427
}
2528

2629
func loadConfig() (Config, error) {
@@ -84,20 +87,30 @@ func loadConfig() (Config, error) {
8487
if err != nil {
8588
return Config{}, err
8689
}
90+
// extract Bosh Director SSL Certificate Common Name
91+
block, _ := pem.Decode([]byte(boshDirectorCert))
92+
if block == nil {
93+
return Config{}, fmt.Errorf("failed to parse PEM block containing the public key")
94+
}
95+
96+
cert, _ := x509.ParseCertificate(block.Bytes) // handle error
97+
98+
boshDirectorCertCN := cert.Subject.CommonName
8799

88100
return Config{
89-
ReleaseRepoPath: releaseRepoPath,
90-
ReleaseVersion: releaseVersion,
91-
BoshDirectorAPI: boshDirectorAPI,
92-
BoshDirectorCert: boshDirectorCert,
93-
BoshDirectorKey: boshDirectorKey,
94-
BoshDirectorCA: boshDirectorCA,
95-
BoshClient: boshClient,
96-
BoshClientSecret: boshClientSecret,
97-
BoshEnvironment: boshEnvironment,
98-
BoshPath: boshPath,
99-
BaseManifestPath: baseManifestPath,
100-
HomePath: homePath,
101+
ReleaseRepoPath: releaseRepoPath,
102+
ReleaseVersion: releaseVersion,
103+
BoshDirectorAPI: boshDirectorAPI,
104+
BoshDirectorCertCN: boshDirectorCertCN,
105+
BoshDirectorCert: boshDirectorCert,
106+
BoshDirectorKey: boshDirectorKey,
107+
BoshDirectorCA: boshDirectorCA,
108+
BoshClient: boshClient,
109+
BoshClientSecret: boshClientSecret,
110+
BoshEnvironment: boshEnvironment,
111+
BoshPath: boshPath,
112+
BaseManifestPath: baseManifestPath,
113+
HomePath: homePath,
101114
}, nil
102115
}
103116

‎jobs/pcap-agent/spec‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,5 +36,5 @@ properties:
3636
description: "Certificate and chain to talk to pcap-api in PEM format"
3737
pcap-agent.listen.tls.private_key:
3838
description: "Private key to talk to pcap-api in PEM format"
39-
pcap-agent.listen.tls.ca:
39+
pcap-agent.listen.tls.client_cas:
4040
description: "CA bundle which is used to request and verify client certificates"

‎jobs/pcap-agent/templates/client-ca.crt.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
<%- if_p("pcap-agent.listen.tls.ca") do |client_ca| -%>
1+
<%- if_p("pcap-agent.listen.tls.client_cas") do |client_ca| -%>
22
<%= client_ca -%>
33
<%- end -%>

‎jobs/pcap-agent/templates/pcap-agent.yml.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ config = {
77
"tls" => {
88
"certificate"=> "/var/vcap/jobs/pcap-agent/config/certs/pcap-agent.crt",
99
"private_key" => "/var/vcap/jobs/pcap-agent/config/certs/pcap-agent.key",
10-
"ca" => "/var/vcap/jobs/pcap-agent/config/certs/client-ca.crt",
10+
"client_cas" => "/var/vcap/jobs/pcap-agent/config/certs/client-ca.crt",
1111
},
1212
},
1313
"buffer" => {

‎jobs/pcap-api/spec‎

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ templates:
99
pcap-api.crt.erb: config/certs/pcap-api.crt
1010
pcap-api.key.erb: config/certs/pcap-api.key
1111
pcap-api.ca.erb: config/certs/pcap-api-ca.crt
12-
bosh_mtls/pcap-api-bosh.ca.erb: config/certs/bosh/pcap-api-bosh-ca.crt
13-
bosh_mtls/pcap-api-bosh.crt.erb: config/certs/bosh/pcap-api-bosh.crt
14-
bosh_mtls/pcap-api-bosh.key.erb: config/certs/bosh/pcap-api-bosh.key
12+
pcap-api-bosh.ca.erb: config/certs/bosh/pcap-api-bosh-ca.crt
1513
agents_mtls/pcap-api-client.crt.erb: config/certs/pcap-api-client.crt
1614
agents_mtls/pcap-api-client.key.erb: config/certs/pcap-api-client.key
1715
agents_mtls/pcap-api-client.ca.erb: config/certs/pcap-api-client-ca.crt
@@ -44,7 +42,7 @@ properties:
4442
description: "Certificate chain to talk to gorouter in PEM format"
4543
pcap-api.listen.tls.private_key:
4644
description: "Private key to talk to gorouter in PEM format"
47-
pcap-api.listen.tls.ca:
45+
pcap-api.listen.tls.client_cas:
4846
description: "CA bundle which is used to request and verify client certificates" # platform CA (gorouter CA)
4947

5048
pcap-api.agents_mtls.enabled:
@@ -70,19 +68,15 @@ properties:
7068
description: "Endpoint of the BOSH Director API"
7169
pcap-api.bosh.token_scope:
7270
description: "Scope of the token"
73-
pcap-api.bosh.mtls.enabled:
71+
pcap-api.bosh.tls.enabled:
7472
default: true
75-
pcap-api.bosh.mtls.common_name:
73+
pcap-api.bosh.tls.common_name:
7674
description: "Common name of the Bosh Director"
77-
pcap-api.bosh.mtls.skip_verify:
75+
pcap-api.bosh.tls.skip_verify:
7876
description: "Skip server verification for connection to Bosh Director"
7977
default: false
80-
pcap-api.bosh.mtls.certificate:
81-
description: "Client certificate to talk to Bosh Director in PEM format"
82-
pcap-api.bosh.mtls.private_key:
83-
description: "Private key to talk to Bosh Director in PEM format"
84-
pcap-api.bosh.mtls.ca:
85-
description: "CA bundle which is used to request and verify Bosh Director client certificates"
78+
pcap-api.bosh.tls.ca:
79+
description: "CA bundle which is used to request and verify Bosh Director certificates"
8680

8781

8882
pcap-api.cli_download_root:

‎jobs/pcap-api/templates/agents_mtls/pcap-api-client.ca.erb‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
<%
2-
if_p("pcap-api.agents_mtls.ca") do |pem|
3-
%>
1+
<%- if p("pcap-api.agents_mtls.enabled").to_s == "true"
2+
if !p("pcap-api.agents_mtls.ca", nil)
3+
raise "Conflicting configuration: pcap-api.agents_mtls.enabled is true, you must provide a valid client CAs"
4+
end
5+
end
6+
-%>
7+
<%- if_p("pcap-api.agents_mtls.ca") do |pem| -%>
48
<%= pem %>
5-
<%
6-
end
7-
%>
9+
<%- end -%>

‎jobs/pcap-api/templates/agents_mtls/pcap-api-client.crt.erb‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
<%
2-
if_p("pcap-api.agents_mtls.certificate") do |pem|
3-
%>
1+
<%- if p("pcap-api.agents_mtls.enabled").to_s == "true"
2+
if !p("pcap-api.agents_mtls.certificate", nil)
3+
raise "Conflicting configuration: pcap-api.agents_mtls.enabled is true, you must provide a valid certificate"
4+
end
5+
end
6+
-%>
7+
<%- if_p("pcap-api.agents_mtls.certificate") do |pem| -%>
48
<%= pem %>
5-
<%
6-
end
7-
%>
9+
<%- end -%>

‎jobs/pcap-api/templates/agents_mtls/pcap-api-client.key.erb‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
<%
2-
if_p("pcap-api.agents_mtls.private_key") do |pem|
3-
%>
1+
<%- if p("pcap-api.agents_mtls.enabled").to_s == "true"
2+
if !p("pcap-api.agents_mtls.private_key", nil)
3+
raise "Conflicting configuration: pcap-api.agents_mtls.enabled is true, you must provide a valid private key"
4+
end
5+
end
6+
-%>
7+
<%- if_p("pcap-api.agents_mtls.private_key") do |pem| -%>
48
<%= pem %>
5-
<%
6-
end
7-
%>
9+
<%- end -%>

‎jobs/pcap-api/templates/bosh_mtls/pcap-api-bosh.ca.erb‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

0 commit comments

Comments
 (0)