Skip to content

Iss2509 - Store KeyStore credentials in the CREDS, provide to HTTP/Docker Manager#551

Merged
jadecarino merged 11 commits intogalasa-dev:mainfrom
jadecarino:iss2509-docker-keystore
Mar 23, 2026
Merged

Iss2509 - Store KeyStore credentials in the CREDS, provide to HTTP/Docker Manager#551
jadecarino merged 11 commits intogalasa-dev:mainfrom
jadecarino:iss2509-docker-keystore

Conversation

@jadecarino
Copy link
Copy Markdown
Member

@jadecarino jadecarino commented Mar 19, 2026

Why?

Refer to galasa-dev/projectmanagement#2509

This pull request adds the ability to store a KeyStore credential in the local and ETCD CREDS stores. The purpose of this is to be able to provide that credential to the HTTP Manager so it can use it to set up client authentication with the enclosed certificates. The HTTP Manager can then pass this to the Docker Manager, so it can contact protected Docker engines via HTTPS.

Changes

Framework/Credentials

  • Adds a new credential type able to be stored in the credentials stores and used by Galasa tests, CredentialsKeyStore, which represents a Java KeyStore.
  • The CredentialsKeyStore has three parts: the KeyStore data which should be formatted as a prefix of "base64:" followed by the bytes of a Java KeyStore base64-encoded, the KeyStore password, and the KeyStore type (PKCS12 or JKS).
  • Unit tests for CredentialsKeyStore class.

Managers

  • New CPS property for the Docker Manager to provide a credentials ID for a particular Docker engine. If provided, the Docker Manager will attempt to retrieve the CredentialsKeyStore from the credentials.properties, and configure an HTTPS connection with the included certificates.
  • Changes to the HTTP Manager to set up client authentication using this KeyStore's certificates.
  • Changes to DockerExecImpl as this uses a raw HttpConnection instead of the manager's HTTPClient, and so couldn't access the KeyStore certificates, so this change checks if an SSL Context is available, and if so uses it in the HttpConnection.
  • DockerManagerIVT has been successfully ran against a protected Docker engine to test these changes.

REST API

  • KeyStore credentials can be stored and retrieved in the ETCD CREDS store by REST API calls.
  • Unit tests for servlet calls to create/update KeyStore credentials.
  • REST API changes tested in Minikube system.

Documentation

  • User facing documentation.
  • Release notes.

@jadecarino jadecarino requested a review from eamansour March 19, 2026 10:00
Copy link
Copy Markdown
Member

@eamansour eamansour left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good! I've added a few thoughts and suggestions to the PR - happy to approve once they're addressed!

Comment thread docs/docker-tls-configuration.md Outdated
Comment thread docs/docker-tls-configuration.md Outdated
Comment thread docs/docker-tls-configuration.md Outdated
…d ETCD credentials, and provided to HTTP Client Manager, allowing Docker Manager to contact protected engines via HTTPS

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
…tore by the REST API

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
…ature

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
…into the Mkdocs website layout, add Windows commands, fix layout issues

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
… if keystore can't be loaded instead of RuntimeException

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
…eTest, replace with mock objects

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
… JSON payload to need a 'base64:' prefix, to reduce chance of user error if users forget to add the prefix

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
…ovided, instead of the code running into a NullPointerException

Signed-off-by: Jade Carino <carino_jade@yahoo.co.uk>
@jadecarino jadecarino force-pushed the iss2509-docker-keystore branch from 1641dce to 9e72675 Compare March 23, 2026 11:56
@jadecarino jadecarino merged commit b349a05 into galasa-dev:main Mar 23, 2026
37 checks passed
@jadecarino jadecarino deleted the iss2509-docker-keystore branch April 13, 2026 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants