Skip to content

Commit 1e0157f

Browse files
jacobweinstockjacobweinstock
authored
Merge pull request #111 from rgl/rgl-remove-ca-from-crt-bundle
Remove the CA certificate from bundle
2 parents a7110f2 + 998912b commit 1e0157f

File tree

7 files changed

+96
-58
lines changed

7 files changed

+96
-58
lines changed

‎deploy/compose/docker-compose.yml‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -59,20 +59,6 @@ services:
5959
registry:
6060
condition: service_healthy
6161

62-
# registry ca.crt download
63-
registry-ca-crt-download:
64-
image: alpine
65-
entrypoint: wget
66-
working_dir: /code
67-
command: ["http://$TINKERBELL_HOST_IP:42114/cert", "-O", "ca.pem"]
68-
volumes:
69-
- ${REPO_TOP_LEVEL:-.}/state/webroot/workflow:/code
70-
depends_on:
71-
tink-server:
72-
condition: service_healthy
73-
db:
74-
condition: service_healthy
75-
7662
# Create hardware, template, and workflow records in tink-server
7763
create-tink-records:
7864
image: ${TINK_CLI_IMAGE}
@@ -218,7 +204,7 @@ services:
218204
REGISTRY_AUTH: htpasswd
219205
REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
220206
REGISTRY_AUTH_HTPASSWD_PATH: /auth/.htpasswd
221-
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/${FACILITY:-onprem}/bundle.pem
207+
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/${FACILITY:-onprem}/server-crt.pem
222208
REGISTRY_HTTP_TLS_KEY: /certs/${FACILITY:-onprem}/server-key.pem
223209
REGISTRY_HTTP_ADDR: $TINKERBELL_HOST_IP:443
224210
volumes:

‎deploy/compose/tls/ca-csr.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"CN": "Tinkerbell CA",
3+
"key": {
4+
"algo": "ecdsa",
5+
"size": 256
6+
},
7+
"names": [
8+
{
9+
"L": "@FACILITY@"
10+
}
11+
]
12+
}

‎deploy/compose/tls/csr.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"CN": "tinkerbell",
2+
"CN": "Tinkerbell",
33
"hosts": [
44
"tinkerbell.registry",
55
"tinkerbell.tinkerbell",
@@ -10,8 +10,8 @@
1010
"localhost"
1111
],
1212
"key": {
13-
"algo": "rsa",
14-
"size": 2048
13+
"algo": "ecdsa",
14+
"size": 256
1515
},
1616
"names": [
1717
{

‎deploy/compose/tls/generate.sh‎

Lines changed: 31 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
#!/usr/bin/env bash
22
# This script handles the generation of the TLS certificates.
3-
# The output is 2 files:
4-
# 1. /certs/${FACILITY:-onprem}/server-key.pem (TLS private key)
5-
# 2. /certs/${FACILITY:-onprem}/bundle.pem (TLS public certificate)
3+
# This generates the files:
4+
# 1. /certs/${FACILITY:-onprem}/ca-crt.pem (CA TLS public certificate)
5+
# 2. /certs/${FACILITY:-onprem}/server-crt.pem (server TLS certificate)
6+
# 3. /certs/${FACILITY:-onprem}/server-key.pem (server TLS private key)
7+
# 4. /certs/${FACILITY:-onprem}/bundle.pem (server TLS certificate; backward compat)
8+
# 5. /code/state/webroot/workflow/ca.pem (CA TLS public certificate)
69

7-
set -xo pipefail
10+
set -euxo pipefail
811

912
# update_csr will add the sans_ip, as a valid host domain in the csr
1013
update_csr() {
@@ -18,32 +21,46 @@ cleanup() {
1821
rm -rf ca-key.pem ca.csr ca.pem server.csr server.pem
1922
}
2023

21-
# gen will generate the key and bundle
24+
# gen will generate the key and certificate
2225
gen() {
23-
local bundle_destination="$1"
24-
local key_destination="$2"
25-
cfssl gencert -initca /code/tls/csr.json | cfssljson -bare ca -
26+
local ca_crt_destination="$1"
27+
local server_crt_destination="$2"
28+
local server_key_destination="$3"
29+
cfssl gencert -initca /code/tls/ca-csr.json | cfssljson -bare ca -
2630
cfssl gencert -config /code/tls/ca-config.json -ca ca.pem -ca-key ca-key.pem -profile server /code/tls/csr.json | cfssljson -bare server
27-
cat server.pem ca.pem >"${bundle_destination}"
28-
mv server-key.pem "${key_destination}"
31+
mv ca.pem "${ca_crt_destination}"
32+
mv server.pem "${server_crt_destination}"
33+
mv server-key.pem "${server_key_destination}"
2934
}
3035

3136
# main orchestrates the process
3237
main() {
3338
local sans_ip="$1"
3439
local csr_file="/code/tls/csr.json"
35-
local bundle_file="/certs/${FACILITY:-onprem}/bundle.pem"
40+
local ca_crt_workflow_file="/code/state/webroot/workflow/ca.pem"
41+
local ca_crt_file="/certs/${FACILITY:-onprem}/ca-crt.pem"
42+
local server_crt_file="/certs/${FACILITY:-onprem}/server-crt.pem"
3643
local server_key_file="/certs/${FACILITY:-onprem}/server-key.pem"
44+
# NB this is required for backward compat.
45+
# TODO once the other think-* services use server-crt.pem this should
46+
# be removed.
47+
local bundle_crt_file="/certs/${FACILITY:-onprem}/bundle.pem"
3748

3849
if ! grep -q "${sans_ip}" "${csr_file}"; then
3950
update_csr "${sans_ip}" "${csr_file}"
4051
else
4152
echo "IP ${sans_ip} already in ${csr_file}"
4253
fi
43-
if [ ! -f "${bundle_file}" ] && [ ! -f "${server_key_file}" ]; then
44-
gen "${bundle_file}" "${server_key_file}"
54+
if [ ! -f "${ca_crt_file}" ] && [ ! -f "${server_crt_file}" ] && [ ! -f "${server_key_file}" ]; then
55+
gen "${ca_crt_file}" "${server_crt_file}" "${server_key_file}"
56+
cp "${server_crt_file}" "${bundle_crt_file}"
4557
else
46-
echo "Files [${bundle_file}, ${server_key_file}] already exist"
58+
echo "Files [${ca_crt_file}, ${server_crt_file}, ${server_key_file}] already exist"
59+
fi
60+
if [ ! -f "${ca_crt_workflow_file}" ]; then
61+
cp "${ca_crt_file}" "${ca_crt_workflow_file}"
62+
else
63+
echo "File ${ca_crt_workflow_file} already exist"
4764
fi
4865
cleanup
4966
}

‎deploy/compose/tls/trust.sh‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
set -euxo pipefail
3+
4+
TINKERBELL_HOST_IP="$1"
5+
6+
if [ -d /vagrant/compose ]; then
7+
cd /vagrant/compose
8+
fi
9+
10+
# trust the tinkerbell CA.
11+
docker-compose exec -T registry cat /certs/onprem/ca-crt.pem >/usr/local/share/ca-certificates/tinkerbell.crt
12+
update-ca-certificates
13+
systemctl restart docker
14+
15+
# login into the docker registry.
16+
docker login "$TINKERBELL_HOST_IP" --username admin --password-stdin <<<'Admin1234'
17+
if id -u vagrant >/dev/null 2>&1; then
18+
su vagrant -c "docker login \"$TINKERBELL_HOST_IP\" --username admin --password-stdin" <<<'Admin1234'
19+
fi
20+
21+
# ensure everything is up after docker restart.
22+
docker-compose up --detach

‎deploy/terraform/main.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,8 @@ resource "null_resource" "setup" {
102102
provisioner "remote-exec" {
103103
inline = [
104104
"cd /root && tar zxvf /root/compose.tar.gz -C /root/sandbox",
105-
"cd /root/sandbox/compose && TINKERBELL_CLIENT_MAC=${metal_device.tink_worker.ports[1].mac} TINKERBELL_TEMPLATE_MANIFEST=/manifests/template/ubuntu-equinix-metal.yaml TINKERBELL_HARDWARE_MANIFEST=/manifests/hardware/hardware-equinix-metal.json docker-compose up -d"
105+
"cd /root/sandbox/compose && TINKERBELL_CLIENT_MAC=${metal_device.tink_worker.ports[1].mac} TINKERBELL_TEMPLATE_MANIFEST=/manifests/template/ubuntu-equinix-metal.yaml TINKERBELL_HARDWARE_MANIFEST=/manifests/hardware/hardware-equinix-metal.json docker-compose up -d",
106+
"cd /root/sandbox/compose && bash tls/trust.sh ${metal_device.tink_provisioner.network[0].address}",
106107
]
107108
}
108109
}

‎deploy/vagrant/Vagrantfile‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,26 @@ unless Vagrant.has_plugin?("vagrant-docker-compose")
1515
exit
1616
end
1717

18+
def provision_provisioner(config, provider_name)
19+
if provider_name == 'virtualbox'
20+
manifest_suffix = ''
21+
else
22+
manifest_suffix = "-#{provider_name}"
23+
end
24+
config.vm.provision :docker_compose,
25+
compose_version: "1.29.2",
26+
yml: "/vagrant/compose/docker-compose.yml",
27+
run: "always",
28+
env: {
29+
"TINKERBELL_HOST_IP": PROVISIONER_IP,
30+
"TINKERBELL_CLIENT_IP": MACHINE1_IP,
31+
"REPO_TOP_LEVEL": "/vagrant/compose",
32+
"TINKERBELL_HARDWARE_MANIFEST": "/manifests/hardware/hardware#{manifest_suffix}.json",
33+
"TINKERBELL_TEMPLATE_MANIFEST": "/manifests/template/ubuntu#{manifest_suffix}.yaml"
34+
}
35+
config.vm.provision "shell", name: "Trust the Tinkerbell CA", path: "../compose/tls/trust.sh", args: [PROVISIONER_IP]
36+
end
37+
1838
Vagrant.configure("2") do |config|
1939
config.vm.provider :libvirt do |libvirt|
2040
libvirt.qemu_use_session = false
@@ -36,34 +56,14 @@ Vagrant.configure("2") do |config|
3656
v.memory = 2048
3757
v.cpus = 2
3858
override.vm.synced_folder '../', '/vagrant'
39-
# vagrant plugin install vagrant-docker-compose
40-
override.vm.provision :docker_compose,
41-
compose_version: "1.29.1",
42-
yml: "/vagrant/compose/docker-compose.yml",
43-
run:"always",
44-
env: {
45-
"TINKERBELL_HOST_IP": PROVISIONER_IP,
46-
"TINKERBELL_CLIENT_IP": MACHINE1_IP,
47-
"REPO_TOP_LEVEL": "/vagrant/compose",
48-
"TINKERBELL_HARDWARE_MANIFEST": "/manifests/hardware/hardware.json",
49-
"TINKERBELL_TEMPLATE_MANIFEST": "/manifests/template/ubuntu.yaml"
50-
}
59+
provision_provisioner(override, 'virtualbox')
5160
end
5261

5362
provisioner.vm.provider "libvirt" do |l, override|
54-
override.vm.synced_folder '../', '/vagrant', type: "rsync"
55-
# vagrant plugin install vagrant-docker-compose
56-
override.vm.provision :docker_compose,
57-
compose_version: "1.29.1",
58-
yml: "/vagrant/compose/docker-compose.yml",
59-
run:"always",
60-
env: {
61-
"TINKERBELL_HOST_IP": PROVISIONER_IP,
62-
"TINKERBELL_CLIENT_IP": MACHINE1_IP,
63-
"REPO_TOP_LEVEL": "/vagrant/compose",
64-
"TINKERBELL_HARDWARE_MANIFEST": "/manifests/hardware/hardware-libvirt.json",
65-
"TINKERBELL_TEMPLATE_MANIFEST": "/manifests/template/ubuntu-libvirt.yaml"
66-
}
63+
l.memory = 2048
64+
l.cpus = 2
65+
override.vm.synced_folder '../', '/vagrant', type: 'rsync'
66+
provision_provisioner(override, 'libvirt')
6767
end
6868
end
6969

0 commit comments

Comments
 (0)