Feature 10947 Cert-manager installation for gRPC authentication
It includes:
- Cert-manager installation
- Custom CA bootstrap
- Mount CA in LCM pod
Change-Id: I8e6d73fb0c179df130f7f4a7f8829bd781713d51
Signed-off-by: Gabriel Cuba <gcuba@whitestack.com>
diff --git a/installers/docker/osm_pods/ca_setup.yaml b/installers/docker/osm_pods/ca_setup.yaml
new file mode 100644
index 0000000..6a3ee65
--- /dev/null
+++ b/installers/docker/osm_pods/ca_setup.yaml
@@ -0,0 +1,46 @@
+# Copyright 2022 Whitestack
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+ name: osm-selfsigned-issuer
+spec:
+ selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: osm-ca-certificate
+ namespace: osm
+spec:
+ isCA: true
+ commonName: osm
+ secretName: osm-ca
+ privateKey:
+ algorithm: ECDSA
+ size: 256
+ issuerRef:
+ name: osm-selfsigned-issuer
+ kind: ClusterIssuer
+ group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+ name: ca-issuer
+spec:
+ ca:
+ secretName: osm-ca
\ No newline at end of file
diff --git a/installers/docker/osm_pods/lcm.yaml b/installers/docker/osm_pods/lcm.yaml
index 5472518..3e5a271 100644
--- a/installers/docker/osm_pods/lcm.yaml
+++ b/installers/docker/osm_pods/lcm.yaml
@@ -60,3 +60,16 @@
envFrom:
- secretRef:
name: lcm-secret
+ volumeMounts:
+ - mountPath: /etc/ssl/certs/osm-ca.crt
+ name: osm-ca
+ readOnly: true
+ subPath: osm-ca.crt
+ volumes:
+ - name: osm-ca
+ secret:
+ defaultMode: 420
+ items:
+ - key: tls.crt
+ path: osm-ca.crt
+ secretName: osm-ca