Skip to content

Commit 8eb638a

Browse files
paullatzelspergerpaullatzelsperger
authored
feat: replace using hard-coded certs with dynamically generated ones (#342)
* feat: replace using hard-coded certs with dynamically generated ones * added az login * set AZ KeyVault secrets before deploy test * allow no sub * escape command * avoid logging of sensitive info
1 parent d049ffa commit 8eb638a

File tree

5 files changed

+81
-188
lines changed

5 files changed

+81
-188
lines changed

‎.github/actions/run-deployment-test/action.yml

+5
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,11 @@ runs:
6969
###################################################
7070
# Install the test infrastructure
7171
###################################################
72+
- name: "Generate test credentials"
73+
shell: bash
74+
run: |-
75+
sh -c "edc-tests/deployment/src/main/resources/prepare-test.sh \
76+
edc-tests/deployment/src/main/resources/helm/test-infrastructure/values.yaml"
7277
- name: Install Infrastructure
7378
shell: bash
7479
run: |-

‎.github/workflows/deploy-test-secrets

-51
This file was deleted.

‎.github/workflows/deployment-test.yaml

+9-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ jobs:
8282
helm_command: |-
8383
helm install tx-inmem charts/tractusx-connector-memory \
8484
-f charts/tractusx-connector-memory/example.yaml \
85-
--set vault.secrets="$(cat ./.github/workflows/deploy-test-secrets)" \
85+
--set vault.secrets="daps-crt:$(cat daps.cert);daps-key:$(cat daps.key)" \
8686
--wait-for-jobs --timeout=120s
8787
8888
# wait for the pod to become ready
@@ -123,12 +123,20 @@ jobs:
123123
steps:
124124
- name: Checkout
125125
uses: actions/[email protected]
126+
- uses: Azure/login@v1
127+
with:
128+
creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
129+
allow-no-subscriptions: true
126130
- uses: ./.github/actions/run-deployment-test
127131
name: "Run deployment test using KinD and Helm"
128132
with:
129133
imagename: "edc-controlplane-postgresql-azure-vault edc-dataplane-azure-vault"
130134
rootDir: "."
131135
helm_command: |-
136+
az keyvault secret set --vault-name ${{ secrets.AZURE_VAULT_NAME }} --name daps-crt --value "$(cat daps.cert)" > /dev/null
137+
az keyvault secret set --vault-name ${{ secrets.AZURE_VAULT_NAME }} --name daps-key --value "$(cat daps.key)" > /dev/null
138+
az keyvault secret set --vault-name ${{ secrets.AZURE_VAULT_NAME }} --name aes-keys --value "$(cat aes.key)" > /dev/null
139+
132140
helm install tx-prod charts/tractusx-connector-azure-vault \
133141
-f edc-tests/deployment/src/main/resources/helm/tractusx-connector-azure-vault-test.yaml \
134142
--dependency-update \

‎edc-tests/deployment/src/main/resources/helm/test-infrastructure/values.yaml

+22-136
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,9 @@
55

66
fullnameOverride: ""
77
nameOverride: ""
8-
98
# -- Existing image pull secret to use to [obtain the container image from private registries](https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry)
109
imagePullSecrets: []
11-
1210
customLabels: {}
13-
1411
runtime:
1512
controlplane:
1613
image:
@@ -214,17 +211,16 @@ runtime:
214211
# -- [volume](https://kubernetes.io/docs/concepts/storage/volumes/) directories
215212
volumes: []
216213
# -- [resource management](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the container
217-
resources:
218-
{}
219-
# We usually recommend not to specify default resources and to leave this as a conscious
220-
# choice for the user. This also increases chances charts run on environments with little
221-
# resources, such as Minikube. If you do want to specify resources, uncomment the following
222-
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
223-
# limits:
224-
# cpu: 100m
225-
# memory: 128Mi
226-
# requests:
227-
# cpu: 100m
214+
resources: {}
215+
# We usually recommend not to specify default resources and to leave this as a conscious
216+
# choice for the user. This also increases chances charts run on environments with little
217+
# resources, such as Minikube. If you do want to specify resources, uncomment the following
218+
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
219+
# limits:
220+
# cpu: 100m
221+
# memory: 128Mi
222+
# requests:
223+
# cpu: 100m
228224
# memory: 128Mi
229225
replicaCount: 1
230226
autoscaling:
@@ -250,18 +246,15 @@ runtime:
250246
java.util.logging.ConsoleHandler.formatter=java.util.logging.SimpleFormatter
251247
java.util.logging.ConsoleHandler.level=ALL
252248
java.util.logging.SimpleFormatter.format=[%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS] [%4$-7s] %5$s%6$s%n
253-
254249
# [node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) to constrain pods to nodes
255250
nodeSelector: {}
256251
# [tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) to configure preferred nodes
257252
tolerations: []
258253
# [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) to configure which nodes the pods can be scheduled on
259254
affinity: {}
260-
261255
url:
262256
# -- Explicitly declared url for reaching the ids api (e.g. if ingresses not used)
263257
ids: ""
264-
265258
dataplane:
266259
image:
267260
# -- Which derivate of the data plane to use. when left empty the deployment will select the correct image automatically
@@ -415,17 +408,16 @@ runtime:
415408
# -- [volume](https://kubernetes.io/docs/concepts/storage/volumes/) directories
416409
volumes: []
417410
# -- [resource management](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the container
418-
resources:
419-
{}
420-
# We usually recommend not to specify default resources and to leave this as a conscious
421-
# choice for the user. This also increases chances charts run on environments with little
422-
# resources, such as Minikube. If you do want to specify resources, uncomment the following
423-
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
424-
# limits:
425-
# cpu: 100m
426-
# memory: 128Mi
427-
# requests:
428-
# cpu: 100m
411+
resources: {}
412+
# We usually recommend not to specify default resources and to leave this as a conscious
413+
# choice for the user. This also increases chances charts run on environments with little
414+
# resources, such as Minikube. If you do want to specify resources, uncomment the following
415+
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
416+
# limits:
417+
# cpu: 100m
418+
# memory: 128Mi
419+
# requests:
420+
# cpu: 100m
429421
# memory: 128Mi
430422
replicaCount: 1
431423
autoscaling:
@@ -457,17 +449,14 @@ runtime:
457449
tolerations: []
458450
# [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) to configure which nodes the pods can be scheduled on
459451
affinity: {}
460-
461452
url:
462453
# -- Explicitly declared url for reaching the public api (e.g. if ingresses not used)
463454
public: ""
464-
465455
postgresql:
466456
enabled: false
467457
jdbcUrl: ""
468458
username: ""
469459
password: ""
470-
471460
vault:
472461
hashicorp:
473462
enabled: true
@@ -486,17 +475,14 @@ runtime:
486475
transferProxyTokenEncryptionAesKey: transfer-proxy-token-encryption-aes-key
487476
dapsPrivateKey: daps-private-key
488477
dapsPublicKey: daps-public-key
489-
490478
daps:
491479
url: ""
492480
clientId: ""
493481
paths:
494482
jwks: /jwks.json
495483
token: /token
496-
497484
backendService:
498485
httpProxyTokenReceiverUrl: ""
499-
500486
serviceAccount:
501487
# Specifies whether a service account should be created
502488
create: true
@@ -507,8 +493,6 @@ runtime:
507493
name: ""
508494
# -- Existing image pull secret bound to the service account to use to [obtain the container image from private registries](https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry)
509495
imagePullSecrets: []
510-
511-
512496
########
513497
# DAPS #
514498
########
@@ -520,34 +504,7 @@ idsdaps:
520504
attributes:
521505
referringConnector: http://sokrates-controlplane/BPNSOKRATES
522506
# Must be the same certificate that is stores in section 'sokrates-vault'
523-
certificate: |-
524-
-----BEGIN CERTIFICATE-----
525-
MIIEAzCCAuugAwIBAgIUXFgjbN7jxGRUDkoUvEwcN3zcew8wDQYJKoZIhvcNAQEL
526-
BQAwgZAxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCZXJsaW4xDzANBgNVBAcMBkJl
527-
cmxpbjEMMAoGA1UECgwDQk1XMSAwHgYDVQQLDBdlZGMtcGxheWdyb3VuZC1wYXJ0
528-
bmVyMTEvMC0GA1UEAwwmc29rcmF0ZXMtZWRjLmRlbW8uY2F0ZW5hLXgubmV0L0JQ
529-
TjEyMzQwHhcNMjIwNTEwMDc1NzMzWhcNMjMwNTEwMDc1NzMzWjCBkDELMAkGA1UE
530-
BhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVybGluMQwwCgYDVQQK
531-
DANCTVcxIDAeBgNVBAsMF2VkYy1wbGF5Z3JvdW5kLXBhcnRuZXIxMS8wLQYDVQQD
532-
DCZzb2tyYXRlcy1lZGMuZGVtby5jYXRlbmEteC5uZXQvQlBOMTIzNDCCASIwDQYJ
533-
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAK/41S8rumkk+IzBk9pBDETvjlPmlXfw
534-
78yRrLmbzaed3kGgygJ2GFFPLcR/Lv0WG8F8au4UEssbOxAU4RRjncCVt66ajaCa
535-
llIqMlH8zaJ8rgxNpGeJU5YvmYRxlIo+Gwi0qnF0tqJh8Hry7OqSo0gK2YBBFJyV
536-
grMsEz3EcsS3ENYJufNgUIeg4QsaL49M0gWxSexPdC4pon96Nvju90D8RlvAJB21
537-
PInqLniMaFlSnRYzCrUaja6HMmzKA+ZPZ1r9lllzsE00RASxRIxlKkwfzTtMb9O6
538-
ey2i2vM7hKGGlXjNsnYVX9WXEfvK4JrCadHzgX8qdez19RxFKtB+5gECAwEAAaNT
539-
MFEwHQYDVR0OBBYEFOcHLXRWZjHwexDqtgMGTCN/7aZlMB8GA1UdIwQYMBaAFOcH
540-
LXRWZjHwexDqtgMGTCN/7aZlMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
541-
BQADggEBAD2a5kuIdICNXfYLpSe7AIONwZVucaArYtpXBxHEy5lMJsTEJgjZzypd
542-
iIMU7onEQGVbii6yVNpWfIpJYM4e8ytVdJuk5evclVKZs/lZ2IshLyWFVj+ITh2E
543-
28X4C/Hnmt4MPBCNowQf71nMp4LEziBgXp54qFV9C+qSTEVdrherRE0PU/zKyX10
544-
S/P5o42weTHnAO/pBN/8AmL3AymynKVgcPaW46IjjRAuc6kfZWCrYQ0M4+/7Ws5r
545-
uM55Zae/L+C82OTNNaaK324ogsCkORPeQ23OCrRD8rZJmQ9bpoOGglPminfwEOhB
546-
UHtyKgmvqCyOV3G/4G93W/xsLV0kxLA=
547-
-----END CERTIFICATE-----
548-
549-
550-
507+
certificate: |- # must be set externally!
551508
##############
552509
# POSTGRESQL #
553510
##############
@@ -563,7 +520,6 @@ postgresql:
563520
database: "edc"
564521
username: "user"
565522
password: "password"
566-
567523
#########
568524
# VAULT #
569525
#########
@@ -576,74 +532,4 @@ vault:
576532
enabled: true
577533
devRootToken: "root"
578534
# Must be the same certificate that is configured in section 'ids-daps'
579-
postStart:
580-
- "sh"
581-
- "-c"
582-
- |
583-
{
584-
585-
sleep 5
586-
587-
/bin/vault kv put secret/sokrates/data-encryption-aes-keys content=OcvxzWCK8ETSjt1jmZw3RA==
588-
589-
cat << EOF | /bin/vault kv put secret/daps-key content=-
590-
-----BEGIN PRIVATE KEY-----
591-
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCv+NUvK7ppJPiM
592-
wZPaQQxE745T5pV38O/Mkay5m82nnd5BoMoCdhhRTy3Efy79FhvBfGruFBLLGzsQ
593-
FOEUY53Albeumo2gmpZSKjJR/M2ifK4MTaRniVOWL5mEcZSKPhsItKpxdLaiYfB6
594-
8uzqkqNICtmAQRSclYKzLBM9xHLEtxDWCbnzYFCHoOELGi+PTNIFsUnsT3QuKaJ/
595-
ejb47vdA/EZbwCQdtTyJ6i54jGhZUp0WMwq1Go2uhzJsygPmT2da/ZZZc7BNNEQE
596-
sUSMZSpMH807TG/TunstotrzO4ShhpV4zbJ2FV/VlxH7yuCawmnR84F/KnXs9fUc
597-
RSrQfuYBAgMBAAECggEAO+KjsjTgcG3bhBNQnMLsSP15Y0Yicbn18ZlVvaivGS7Z
598-
d14fwSytY+ZdPfTGaey/L16HCVSdfK9cr0Fbw9OO2P5ajzobnp9dLsMbctlkpbpm
599-
hNtbarzKTF8QkIkSsuUl0BWjt46vpJ1N+Jl5VO7oUFkY4dPEDvG2lAEY3zlekWDm
600-
cQeOC/YgpoW4xfRwPPS6QE0w3Q+H5NfNjfz+mSHeItTlVfTKDRliWQLPWeRZFuXh
601-
FlRFUQnTmEE/9wpIe3Hn7WXJ3fQqcYDzxU7/zwwY9I7bB15SgVHlR0ENDPAD5X8F
602-
MVZ3EcLlqGBy+WvTWALp6pc8YfhW3fiTWyuamXtNrQKBgQDonsIzBKEOOKdKGW0e
603-
uyw79ErmnmzkY5nuMrMxrmTA4WKCfJ/YRRA+4sxiltWsIJ3UkHe3OBCSSCdj79hb
604-
ugb/+UzE70hOdgrct2NUQqbrj3gvsVvU8ZRQgTRMqKpmC0zY7KOMx6NU85z3IvS1
605-
z5fjszcUv4kLQlldYGSAuqPy+wKBgQDBqIkc8p/wcw7ygo1q/GerNeszfoxiIFp8
606-
h4RWLVhkwrcXFz30wBlUWuv5/kxU8tmJcmXxe72EmUstd6wvNOAnYwCiile6zQiJ
607-
vsr1axavZnGOtNGUp6DUAsd2iviBl7IZ7kAcqCrQo4ivGhfHmahH3hmg8wuAMjYB
608-
8f+FSPgaMwKBgQC7W4tMrjDOFIFhJEOIWfcRvvxI7VcFSNelS76aiDzsQVwnfxr7
609-
hPzFucQmsBgfUBHvMADMWGK4f1cCnh5kGtwidXgIsjVJxLeQ+EAPkLOCzQZfW3l8
610-
dKshgD9QcxTzpaxal5ZPAEikVqaZQtVYToCmzCTUGETYBbOWitnH+Qut2wKBgQC6
611-
Y6DcSLUhc0xOotLDxv1sbu/aVxF8nFEbDD+Vxf0Otc4MnmUWPRHj+8KlkVkcZcR0
612-
IrP1kThd+EDAGS+TG9wmbIY+6tH3S8HM+eJUBWcHGJ1xUZ1p61DC3Y3nDWiTKlLT
613-
3Fi+fCkBOHSku4Npq/2odh7Kp0JJd4o9oxJg0VNhuwKBgQDSFn7dqFE0Xmwc40Vr
614-
0wJH8cPWXKGt7KJENpj894buk2DniLD4w2x874dzTjrOFi6fKxEzbBNA9Rq9UPo8
615-
u9gKvl/IyWmV0c4zFCNMjRwVdnkMEte/lXcJZ67T4FXZByqAZlhrr/v0FD442Z9B
616-
AjWFbUiBCFOo+gpAFcQGrkOQHA==
617-
-----END PRIVATE KEY-----
618-
EOF
619-
620-
cat << EOF | /bin/vault kv put secret/daps-crt content=-
621-
-----BEGIN CERTIFICATE-----
622-
MIIEAzCCAuugAwIBAgIUXFgjbN7jxGRUDkoUvEwcN3zcew8wDQYJKoZIhvcNAQEL
623-
BQAwgZAxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCZXJsaW4xDzANBgNVBAcMBkJl
624-
cmxpbjEMMAoGA1UECgwDQk1XMSAwHgYDVQQLDBdlZGMtcGxheWdyb3VuZC1wYXJ0
625-
bmVyMTEvMC0GA1UEAwwmc29rcmF0ZXMtZWRjLmRlbW8uY2F0ZW5hLXgubmV0L0JQ
626-
TjEyMzQwHhcNMjIwNTEwMDc1NzMzWhcNMjMwNTEwMDc1NzMzWjCBkDELMAkGA1UE
627-
BhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVybGluMQwwCgYDVQQK
628-
DANCTVcxIDAeBgNVBAsMF2VkYy1wbGF5Z3JvdW5kLXBhcnRuZXIxMS8wLQYDVQQD
629-
DCZzb2tyYXRlcy1lZGMuZGVtby5jYXRlbmEteC5uZXQvQlBOMTIzNDCCASIwDQYJ
630-
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAK/41S8rumkk+IzBk9pBDETvjlPmlXfw
631-
78yRrLmbzaed3kGgygJ2GFFPLcR/Lv0WG8F8au4UEssbOxAU4RRjncCVt66ajaCa
632-
llIqMlH8zaJ8rgxNpGeJU5YvmYRxlIo+Gwi0qnF0tqJh8Hry7OqSo0gK2YBBFJyV
633-
grMsEz3EcsS3ENYJufNgUIeg4QsaL49M0gWxSexPdC4pon96Nvju90D8RlvAJB21
634-
PInqLniMaFlSnRYzCrUaja6HMmzKA+ZPZ1r9lllzsE00RASxRIxlKkwfzTtMb9O6
635-
ey2i2vM7hKGGlXjNsnYVX9WXEfvK4JrCadHzgX8qdez19RxFKtB+5gECAwEAAaNT
636-
MFEwHQYDVR0OBBYEFOcHLXRWZjHwexDqtgMGTCN/7aZlMB8GA1UdIwQYMBaAFOcH
637-
LXRWZjHwexDqtgMGTCN/7aZlMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
638-
BQADggEBAD2a5kuIdICNXfYLpSe7AIONwZVucaArYtpXBxHEy5lMJsTEJgjZzypd
639-
iIMU7onEQGVbii6yVNpWfIpJYM4e8ytVdJuk5evclVKZs/lZ2IshLyWFVj+ITh2E
640-
28X4C/Hnmt4MPBCNowQf71nMp4LEziBgXp54qFV9C+qSTEVdrherRE0PU/zKyX10
641-
S/P5o42weTHnAO/pBN/8AmL3AymynKVgcPaW46IjjRAuc6kfZWCrYQ0M4+/7Ws5r
642-
uM55Zae/L+C82OTNNaaK324ogsCkORPeQ23OCrRD8rZJmQ9bpoOGglPminfwEOhB
643-
UHtyKgmvqCyOV3G/4G93W/xsLV0kxLA=
644-
-----END CERTIFICATE-----
645-
EOF
646-
647-
/bin/vault kv put secret/aes-keys content=OcvxzWCK8ETSjt1jmZw3RA==
648-
649-
}
535+
postStart: # must be set externally!

‎edc-tests/deployment/src/main/resources/prepare-test.sh

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/bin/bash
2+
3+
#
4+
# Copyright (c) 2023 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
5+
#
6+
# This program and the accompanying materials are made available under the
7+
# terms of the Apache License, Version 2.0 which is available at
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# SPDX-License-Identifier: Apache-2.0
11+
#
12+
# Contributors:
13+
# Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
14+
#
15+
#
16+
17+
set -euo pipefail
18+
19+
if [ "$#" -lt 1 ]; then
20+
echo "usage prepare-test.sh PATH_TO_YAML"
21+
echo ""
22+
echo "Please provide the path to the YAML file, which contains the config for the test infrastructure! In most cases
23+
this will be edc-tests/deployment/src/main/resources/helm/test-infrastructure/values.yaml"
24+
exit 42
25+
fi
26+
27+
VALUES_FILE=$1
28+
KEY_FILE=daps.key
29+
CERT_FILE=daps.cert
30+
31+
# generate a new short-lived certificate and export the private key
32+
openssl req -newkey rsa:2048 -new -nodes -x509 -days 1 -keyout $KEY_FILE -out $CERT_FILE -subj "/CN=test"
33+
34+
DAPSCRT=$(cat $CERT_FILE)
35+
DAPSKEY=$(cat $KEY_FILE)
36+
AES_KEY=$( echo aes_enckey_test | base64)
37+
echo $AES_KEY > aes.key
38+
39+
# replace the cert for DAPS
40+
yq -i ".idsdaps.connectors[0].certificate=\"$DAPSCRT\"" "$VALUES_FILE"
41+
42+
# add a "postStart" command to the vault config, that creates a daps-key, daps-cert and an aes-keys secret
43+
yq -i ".vault.server.postStart |= [\"sh\",\"-c\",\"{\nsleep 5\n\ncat << EOF | /bin/vault kv put secret/daps-crt content=-\n$DAPSCRT\nEOF\n\n
44+
cat << EOF | /bin/vault kv put secret/daps-key content=-\n$DAPSKEY\nEOF\n\n
45+
/bin/vault kv put secret/aes-keys content=$AES_KEY\n\n}\"]" "$VALUES_FILE"

0 commit comments

Comments
 (0)