Add pod-level TLS termination for Keystone and Barbican - 007 WP-4 #12641
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| {{- include "barbican.tls.validate" . }} | ||
| kind: Deployment | ||
| apiVersion: apps/v1 | ||
|
|
||
|
|
@@ -12,8 +13,9 @@ metadata: | |
| type: api | ||
| component: barbican | ||
| annotations: | ||
| secret.reloader.stakater.com/reload: "{{ .Release.Name }}-secrets{{- if (include "barbican.tls.serving" .) }},{{ .Values.tls.secretName | default "barbican-tls" }}{{- end }}" | ||
| deployment.reloader.stakater.com/pause-period: "60s" | ||
| cloud.sap/tls-state: {{ .Values.tls.state | quote }} | ||
| spec: | ||
| replicas: {{ required ".Values.api.replicas is missing" .Values.api.replicas }} | ||
| revisionHistoryLimit: {{ .Values.pod.lifecycle.upgrades.deployments.revisionHistory }} | ||
|
|
@@ -39,12 +41,23 @@ spec: | |
| annotations: | ||
| configmap-etc-hash: {{ include (print $.Template.BasePath "/etc-configmap.yaml") . | sha256sum }} | ||
| configmap-bin-hash: {{ include (print $.Template.BasePath "/configmap-bin.yaml") . | sha256sum }} | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| config.linkerd.io/skip-inbound-ports: "443" | ||
| {{- end }} | ||
| {{- if .Values.proxysql.mode }} | ||
| prometheus.io/scrape: "true" | ||
| prometheus.io/targets: {{ required ".Values.alerts.prometheus missing" .Values.alerts.prometheus | quote }} | ||
| {{- end }} | ||
| {{- include "utils.linkerd.pod_and_service_annotation" . | indent 8 }} | ||
| spec: | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| securityContext: | ||
| # distroless "nonroot" gid of the tls-lifecycle-manager image; lets the | ||
| # non-root tls-init container read the 0440 tls-input Secret while keeping | ||
| # the key group-restricted (not world-readable) per the BSI least-privilege | ||
| # requirement (Sicherheitsarchitektur 4.1: non-root, restriktive Berechtigungen). | ||
| fsGroup: 65532 | ||
| {{- end }} | ||
| {{- if .Values.rbac.enabled }} | ||
| serviceAccountName: {{ .Release.Name }} | ||
| {{- end }} | ||
|
|
@@ -59,6 +72,22 @@ spec: | |
| {{- if .Values.proxysql.native_sidecar }} | ||
| {{- include "utils.proxysql.container" . | indent 6 }} | ||
| {{- end }} | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| - name: tls-init | ||
| image: {{ .Values.tls.lifecycle.image }}:{{ .Values.tls.lifecycle.imageTag }} | ||
| imagePullPolicy: IfNotPresent | ||
| args: | ||
| - --mode=unwrap | ||
| - --input-dir=/tls-input | ||
| - --output-dir=/mnt/secrets | ||
| - --key-wrapping={{ required "tls.keyWrapping is required" .Values.tls.keyWrapping }} | ||
| volumeMounts: | ||
| - name: tls-input | ||
| mountPath: /tls-input | ||
| readOnly: true | ||
| - name: tls-secrets | ||
| mountPath: /mnt/secrets | ||
| {{- end }} | ||
| containers: | ||
| - name: barbican-api | ||
| image: {{required ".Values.global.registry is missing" .Values.global.registry }}/loci-barbican:{{required "Values.imageVersionBarbicanApi is missing" .Values.imageVersionBarbicanApi}} | ||
|
|
@@ -115,6 +144,10 @@ spec: | |
| ports: | ||
| - name: barbican-api | ||
| containerPort: {{.Values.api_port_internal}} | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| - name: barbican-tls | ||
| containerPort: 443 | ||
| {{- end }} | ||
| volumeMounts: | ||
| - name: etcbarbican | ||
| mountPath: /etc/barbican | ||
|
|
@@ -138,6 +171,23 @@ spec: | |
| mountPath: /etc/barbican/logging.ini | ||
| subPath: logging.ini | ||
| readOnly: true | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| - name: tls-secrets | ||
| mountPath: /mnt/secrets | ||
| readOnly: true | ||
| - name: barbican-etc | ||
| mountPath: /etc/apache2/conf-enabled/00-ssl-load.conf | ||
| subPath: ssl-load.conf | ||
| readOnly: true | ||
| - name: barbican-etc | ||
| mountPath: /etc/apache2/conf-enabled/tls-hardening.conf | ||
| subPath: tls-hardening.conf | ||
| readOnly: true | ||
| - name: barbican-etc | ||
| mountPath: /etc/apache2/conf-enabled/apache-hardening.conf | ||
| subPath: apache-hardening.conf | ||
| readOnly: true | ||
| {{- end }} | ||
| - mountPath: /etc/barbican/barbican.conf.d | ||
| name: barbican-etc-confd | ||
| readOnly: true | ||
|
|
@@ -334,3 +384,13 @@ spec: | |
| {{- end }} | ||
| {{- include "utils.proxysql.volumes" . | indent 8 }} | ||
| {{- include "utils.trust_bundle.volumes" . | indent 8 }} | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| - name: tls-input | ||
| secret: | ||
| secretName: {{ .Values.tls.secretName | default "barbican-tls" }} | ||
| defaultMode: 0440 | ||
| - name: tls-secrets | ||
| emptyDir: | ||
| medium: Memory | ||
| sizeLimit: 1Mi | ||
| {{- end }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| {{- include "barbican.tls.validate" . }} | ||
| apiVersion: batch/v1 | ||
| kind: CronJob | ||
| metadata: | ||
| name: {{ .Release.Name }}-tls-rotation | ||
| labels: | ||
| app: {{ template "fullname" . }} | ||
| chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" | ||
| release: "{{ .Release.Name }}" | ||
| component: barbican | ||
| type: tls-rotation | ||
| spec: | ||
| schedule: {{ .Values.tls.rotationSchedule | default "0 3 * * 1" | quote }} | ||
| concurrencyPolicy: Forbid | ||
| successfulJobsHistoryLimit: 3 | ||
| failedJobsHistoryLimit: 3 | ||
| jobTemplate: | ||
| spec: | ||
| activeDeadlineSeconds: 600 | ||
| template: | ||
| spec: | ||
| restartPolicy: Never | ||
| serviceAccountName: {{ .Release.Name }}-tls-manager | ||
| containers: | ||
| - name: tls-rotation | ||
| image: {{ .Values.tls.lifecycle.image }}:{{ .Values.tls.lifecycle.imageTag }} | ||
| imagePullPolicy: IfNotPresent | ||
| args: | ||
| - --mode=rotation | ||
| - --namespace={{ .Release.Namespace }} | ||
| - --secret-name={{ .Values.tls.secretName | default "barbican-tls" }} | ||
| - --key-algorithm={{ .Values.tls.keyAlgorithm | default "ECDSAP256" }} | ||
| - --issuer-name={{ .Values.tls.issuerName | default "digicert-issuer" }} | ||
| - --issuer-kind={{ .Values.tls.issuerKind | default "ClusterIssuer" }} | ||
| - --issuer-group={{ .Values.tls.issuerGroup | default "certmanager.cloud.sap" }} | ||
| - --common-name={{ include "barbican_api_endpoint_host_public" . }} | ||
| - --san-dns={{ include "barbican_api_endpoint_host_public" . }} | ||
| - --renewal-threshold-days=30 | ||
| - --key-generation={{ required "tls.keyGeneration is required" .Values.tls.keyGeneration }} | ||
| - --key-wrapping={{ required "tls.keyWrapping is required" .Values.tls.keyWrapping }} | ||
| - --key-storage={{ required "tls.keyStorage is required" .Values.tls.keyStorage }} | ||
| {{- if .Values.tls.allowInsecureStorage }} | ||
| - --allow-insecure-storage | ||
| {{- end }} | ||
| backoffLimit: 3 | ||
|
tz3 marked this conversation as resolved.
|
||
| {{- end }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,6 +11,14 @@ data: | |
| {{ include (print .Template.BasePath "/etc/_barbican-api-paste.ini.tpl") . | indent 4 }} | ||
| barbican.conf: | | ||
| {{ include (print .Template.BasePath "/etc/_barbican.conf.tpl") . | indent 4 }} | ||
| {{- if (include "barbican.tls.serving" .) }} | ||
| ssl-load.conf: | | ||
| {{ include (print .Template.BasePath "/etc/_ssl-load.conf.tpl") . | indent 4 }} | ||
| tls-hardening.conf: | | ||
| {{ include (print .Template.BasePath "/etc/_tls-hardening.conf.tpl") . | indent 4 }} | ||
| apache-hardening.conf: | | ||
| {{ include (print .Template.BasePath "/etc/_apache-hardening.conf.tpl") . | indent 4 }} | ||
| {{- end }} | ||
| policy.yaml: | | ||
| {{ include (print .Template.BasePath "/etc/_barbican-policy.yaml.tpl") . | indent 4 }} | ||
| logging.ini: | | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| {{/* | ||
| Server-level Apache hardening: suppress the version banner, disable the TRACE | ||
| method, and turn off directory listing for the document root. Parsed after the | ||
| packaged apache2.conf so these directives take precedence. | ||
| */}} | ||
|
|
||
| # Suppress server version banner and disable TRACE | ||
| ServerTokens Prod | ||
| ServerSignature Off | ||
| TraceEnable Off | ||
|
|
||
| # Disable directory listing for the document root | ||
| <Directory /var/www/> | ||
| Options FollowSymLinks | ||
| AllowOverride None | ||
| Require all granted | ||
| </Directory> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| {{/* | ||
| Load mod_ssl and its socache dependency via read-only conf so the module is | ||
| available under a read-only root filesystem without a2enmod. mod_headers is | ||
| required for the HTTP security response headers set in the TLS vhost. | ||
| */}} | ||
|
|
||
| LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so | ||
| LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so | ||
| LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| {{/* | ||
| Apache TLS protocol hardening configuration. | ||
| Configures TLS 1.3/1.2 with compliant cipher suites, PFS, AEAD modes, | ||
| and brainpool curve preference. Shared between Keystone and Barbican. | ||
| */}} | ||
|
|
||
| # TLS Protocol Versions: only 1.3 and 1.2 | ||
| SSLProtocol -all +TLSv1.3 +TLSv1.2 | ||
|
|
||
| # TLS 1.2 Cipher Suites (ECDHE + AEAD only, PFS required) | ||
| SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 | ||
|
|
||
| # TLS 1.3 Cipher Suites (AES-GCM and AES-CCM) | ||
| SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256 | ||
|
|
||
| # Server chooses cipher order | ||
| SSLHonorCipherOrder on | ||
|
|
||
| # ECDHE Curve Preference: brainpool first, NIST as fallback | ||
| SSLOpenSSLConfCmd Curves brainpoolP256r1:brainpoolP384r1:prime256v1:secp384r1 | ||
|
|
||
| # Signature algorithms preference | ||
| SSLOpenSSLConfCmd SignatureAlgorithms ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384 | ||
|
|
||
| # Session cache | ||
| SSLSessionCache shmcb:/run/apache2/ssl_scache(512000) | ||
| SSLSessionCacheTimeout 300 | ||
|
|
||
| # Disable session tickets (for PFS) | ||
| SSLSessionTickets off | ||
|
|
||
| # Strict SNI | ||
| SSLStrictSNIVHostCheck on | ||
|
|
||
| # Disable TLS compression (CRIME mitigation) | ||
| SSLCompression off |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.