...
How to run CertService Client
As standalone docker:
You need certificate and trust anchors to connect to CertService API via HTTPS. Information how to generate truststore and keystore files you can find in project repository README Gerrit GitWeb
Create certificate for HTTPS connection.
Create file with environments as in example below.
| Code Block | ||
|---|---|---|
| ||
#Client envs
REQUEST_URL=<URL to CertService API>
REQUEST_TIMEOUT=10000
OUTPUT_PATH=/var/certs
CA_NAME=RA
OUTPUT_TYPE=P12
#CSR config envs
COMMON_NAME=onap.org
ORGANIZATION=Linux-Foundation
ORGANIZATION_UNIT=ONAP
LOCATION=San-Francisco
STATE=California
COUNTRY=US
SANS=test.onap.org:onap.com
#TLS config envs
KEYSTORE_PATH=/etc/onap/aaf/certservice/certs/certServiceClient-keystore.jks
KEYSTORE_PASSWORD=<password to certServiceClient-keystore.jks>
TRUSTSTORE_PATH=/etc/onap/aaf/certservice/certs/certServiceClient-truststore.jks
TRUSTSTORE_PASSWORD=<password to certServiceClient-truststore.jks> |
Run docker container with environments file and docker network (API and client must be running in same network).
| Code Block |
|---|
docker run \
--rm \
--name aafcert-client \
--env-file <path to client env> \
--network <docker network of cert service> \
--mount type=bind,src=<path to local host directory where certificate and trust anchor will be created>,dst=<OUTPUT_PATH (same as in env file)> \
--volume <local path to keystore in JKS format>:<KEYSTORE_PATH> \
--volume <local path to truststore in JKS format>:<TRUSTSTORE_PATH> \
nexus3.onap.org:10001/onap/org.onap.aaf.certservice.aaf-certservice-client:$VERSION |
As init container for K8s:
| Code Block | ||
|---|---|---|
| ||
...
kind: Deployment
metadata:
...
spec:
...
template:
...
spec:
containers:
- image: sample.image
name: sample.name
...
volumeMounts:
- mountPath: /var/certs #CERTS CAN BE FOUND IN THIS DIRECTORY
name: certs
...
initContainers:
- name: cert-service-client
image: nexus3.onap.org:10001/onap/org.onap.aaf.certservice.aaf-certservice-client:latest
imagePullPolicy: Always
env:
- name: REQUEST_URL
value: https://aaf-cert-service:8443/v1/certificate/
- name: REQUEST_TIMEOUT
value: "1000"
- name: OUTPUT_PATH
value: /var/certs
- name: CA_NAME
value: RA
- name: OUTPUT_TYPE
value: P12
- name: COMMON_NAME
value: onap.org
- name: ORGANIZATION
value: Linux-Foundation
- name: ORGANIZATION_UNIT
value: ONAP
- name: LOCATION
value: San-Francisco
- name: STATE
value: California
- name: COUNTRY
value: US
- name: SANS
value: test.onap.org:onap.com
- name: KEYSTORE_PATH
value: /etc/onap/aaf/certservice/certs/certServiceClient-keystore.jks
- name: KEYSTORE_PASSWORD
value: secret
- name: TRUSTSTORE_PATH
value: /etc/onap/aaf/certservice/certs/truststore.jks
- name: TRUSTSTORE_PASSWORD
value: secret
volumeMounts:
- mountPath: /var/certs
name: certs
- mountPath: /etc/onap/aaf/certservice/certs/
name: tls-volume
...
volumes:
- name: certs
emptyDir: {}
- name tls-volume
secret:
secretName: aaf-cert-service-client-tls-secret # Value of global.aaf.certService.client.secret.name
...
|
Client's exiting codes:
...
Success
...
All necessary information could be find in official documentation, see Read The Docs.
Client's exiting codes:
Exiting codes could be find in official documentation, see Read The Docs