Ocfxx improve local scripts

Jorge Moratinosrequested to merge
OCFXX-Improve_local_scripts into staging

This task is related with improvement needed to deploy CAPIF using docker compose. We need more flexibility, like what we have at helm/scripts, and also a way to stablish if we will use docker images from repository or build images for local testing.

Merge request reports

services/TS29222_CAPIF_API_Invoker_Management_API/prepare_invoker.sh

+29 −8
Changes for services/TS29222_CAPIF_API_Invoker_Management_API/prepare_invoker.sh: 29 added lines, 8 removed lines.
Original line number Diff line number Diff line 
#!/bin/bash





VAULT_ADDR="http://$VAULT_HOSTNAME:$VAULT_PORT"

VAULT_TOKEN=$VAULT_ACCESS_TOKEN



curl  -vv -k -retry 30 \

    --retry-all-errors \

    --connect-timeout 5 \

    --max-time 10 \

    --retry-delay 10 \

    --retry-max-time 300 \

# Maximum number of retry attempts

MAX_RETRIES=30

# Delay between retries (in seconds)

RETRY_DELAY=10

# Attempt counter

ATTEMPT=0



while [ $ATTEMPT -lt $MAX_RETRIES ]; do

    # Increment ATTEMPT using eval

    eval "ATTEMPT=\$((ATTEMPT + 1))"

    echo "Attempt $ATTEMPT of $MAX_RETRIES"



    # Make the request to Vault and store the response in a variable

    RESPONSE=$(curl -s -k --connect-timeout 5 --max-time 10 \

        --header "X-Vault-Token: $VAULT_TOKEN" \

    --request GET "$VAULT_ADDR/v1/secret/data/server_cert/pub" 2>/dev/null | jq -r '.data.data.pub_key' -j > /usr/src/app/api_invoker_management/pubkey.pem

        --request GET "$VAULT_ADDR/v1/secret/data/server_cert/pub" | jq -r '.data.data.pub_key')



    echo "$RESPONSE"



    # Check if the response is "null" or empty

    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then

        echo "$RESPONSE" > /usr/src/app/api_invoker_management/pubkey.pem

        echo "Public key successfully saved."

        gunicorn -k uvicorn.workers.UvicornH11Worker --bind 0.0.0.0:8080 \

         --chdir /usr/src/app/api_invoker_management wsgi:app

        exit 0  # Exit successfully

    else

        echo "Invalid response ('null' or empty), retrying in $RETRY_DELAY seconds..."

        sleep $RETRY_DELAY

    fi

done



echo "Error: Failed to retrieve a valid response after $MAX_RETRIES attempts."

exit 1  # Exit with failure

services/TS29222_CAPIF_API_Provider_Management_API/prepare_provider.sh

+29 −7
Changes for services/TS29222_CAPIF_API_Provider_Management_API/prepare_provider.sh: 29 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -3,15 +3,37 @@ 
VAULT_ADDR="http://$VAULT_HOSTNAME:$VAULT_PORT"

VAULT_TOKEN=$VAULT_ACCESS_TOKEN



curl  -vv -k -retry 30 \

    --retry-all-errors \

    --connect-timeout 5 \

    --max-time 10 \

    --retry-delay 10 \

    --retry-max-time 300 \

# Maximum number of retry attempts

MAX_RETRIES=30

# Delay between retries (in seconds)

RETRY_DELAY=10

# Attempt counter

ATTEMPT=0



while [ $ATTEMPT -lt $MAX_RETRIES ]; do

    # Increment ATTEMPT using eval

    eval "ATTEMPT=\$((ATTEMPT + 1))"

    echo "Attempt $ATTEMPT of $MAX_RETRIES"



    # Make the request to Vault and store the response in a variable

    RESPONSE=$(curl -s -k --connect-timeout 5 --max-time 10 \

        --header "X-Vault-Token: $VAULT_TOKEN" \

    --request GET "$VAULT_ADDR/v1/secret/data/server_cert/pub" 2>/dev/null | jq -r '.data.data.pub_key' -j > /usr/src/app/api_provider_management/pubkey.pem

        --request GET "$VAULT_ADDR/v1/secret/data/server_cert/pub" | jq -r '.data.data.pub_key')



    echo "$RESPONSE"



    # Check if the response is "null" or empty

    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then

        echo "$RESPONSE" > /usr/src/app/api_provider_management/pubkey.pem

        echo "Public key successfully saved."

        gunicorn -k uvicorn.workers.UvicornH11Worker --bind 0.0.0.0:8080 \

         --chdir /usr/src/app/api_provider_management wsgi:app

        exit 0  # Exit successfully

    else

        echo "Invalid response ('null' or empty), retrying in $RETRY_DELAY seconds..."

        sleep $RETRY_DELAY

    fi

done



echo "Error: Failed to retrieve a valid response after $MAX_RETRIES attempts."

exit 1  # Exit with failure

services/TS29222_CAPIF_Security_API/prepare_security.sh

+27 −7
Changes for services/TS29222_CAPIF_Security_API/prepare_security.sh: 27 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -3,17 +3,37 @@ 
VAULT_ADDR="http://$VAULT_HOSTNAME:$VAULT_PORT"

VAULT_TOKEN=$VAULT_ACCESS_TOKEN



# Maximum number of retry attempts

MAX_RETRIES=30

# Delay between retries (in seconds)

RETRY_DELAY=10

# Attempt counter

ATTEMPT=0



while [ $ATTEMPT -lt $MAX_RETRIES ]; do

    # Increment ATTEMPT using eval

    eval "ATTEMPT=\$((ATTEMPT + 1))"

    echo "Attempt $ATTEMPT of $MAX_RETRIES"



curl  -k -retry 30 \

    --retry-all-errors \

    --connect-timeout 5 \

    --max-time 10 \

    --retry-delay 10 \

    --retry-max-time 300 \

    # Make the request to Vault and store the response in a variable

    RESPONSE=$(curl -s -k --connect-timeout 5 --max-time 10 \

        --header "X-Vault-Token: $VAULT_TOKEN" \

    --request GET "$VAULT_ADDR/v1/secret/data/server_cert/private" 2>/dev/null | jq -r '.data.data.key' -j > /usr/src/app/capif_security/server.key

        --request GET "$VAULT_ADDR/v1/secret/data/server_cert/private" | jq -r '.data.data.key')



    echo "$RESPONSE"



    # Check if the response is "null" or empty

    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then

        echo "$RESPONSE" > /usr/src/app/capif_security/server.key

        echo "Public key successfully saved."

        gunicorn -k uvicorn.workers.UvicornH11Worker --bind 0.0.0.0:8080 \

         --chdir /usr/src/app/capif_security wsgi:app

        exit 0  # Exit successfully

    else

        echo "Invalid response ('null' or empty), retrying in $RETRY_DELAY seconds..."

        sleep $RETRY_DELAY

    fi

done



echo "Error: Failed to retrieve a valid response after $MAX_RETRIES attempts."

exit 1  # Exit with failure

services/nginx/nginx_prepare.sh

+100 −22
Changes for services/nginx/nginx_prepare.sh: 100 added lines, 22 removed lines.
Original line number Diff line number Diff line
@@ -5,34 +5,112 @@ cd $CERTS_FOLDER 
VAULT_ADDR="http://$VAULT_HOSTNAME:$VAULT_PORT"

VAULT_TOKEN=$VAULT_ACCESS_TOKEN



curl  -k -retry 30 \

    --retry-all-errors \

    --connect-timeout 5 \

    --max-time 10 \

    --retry-delay 10 \

    --retry-max-time 300 \

# Maximum number of retry attempts

MAX_RETRIES=30

# Delay between retries (in seconds)

RETRY_DELAY=10

# Attempt counter

ATTEMPT=0

# Success check

SUCCES_OPERATION=false



while [ $ATTEMPT -lt $MAX_RETRIES ]; do

    # Increment ATTEMPT using eval

    eval "ATTEMPT=\$((ATTEMPT + 1))"

    echo "Attempt $ATTEMPT of $MAX_RETRIES"



    # Make the request to Vault and store the response in a variable

    RESPONSE=$(curl -s -k --connect-timeout 5 --max-time 10 \

        --header "X-Vault-Token: $VAULT_TOKEN" \

    --request GET "$VAULT_ADDR/v1/secret/data/ca" 2>/dev/null | jq -r '.data.data.ca' -j > $CERTS_FOLDER/ca.crt

        --request GET "$VAULT_ADDR/v1/secret/data/ca" | jq -r '.data.data.ca')



    echo "$RESPONSE"



    # Check if the response is "null" or empty

    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then

        echo "$RESPONSE" > $CERTS_FOLDER/ca.crt

        openssl verify -CAfile $CERTS_FOLDER/ca.crt $CERTS_FOLDER/ca.crt

        echo "CA Root successfully saved."

        SUCCES_OPERATION=true

        break

    else

        echo "Invalid response ('null' or empty), retrying in $RETRY_DELAY seconds..."

        sleep $RETRY_DELAY

    fi

done



if [ "$SUCCES_OPERATION" = false ]; then

    echo "Error: Failed to retrieve a valid response after $MAX_RETRIES attempts."

    exit 1  # Exit with failure

fi



curl  -k -retry 30 \

    --retry-all-errors \

    --connect-timeout 5 \

    --max-time 10 \

    --retry-delay 10 \

    --retry-max-time 300 \

# Setup inital value to ATTEMPT and SUCCESS_OPERATION

ATTEMPT=0

SUCCES_OPERATION=false



while [ $ATTEMPT -lt $MAX_RETRIES ]; do

    # Increment ATTEMPT using eval

    eval "ATTEMPT=\$((ATTEMPT + 1))"

    echo "Attempt $ATTEMPT of $MAX_RETRIES"



    # Make the request to Vault and store the response in a variable

    RESPONSE=$(curl -s -k --connect-timeout 5 --max-time 10 \

        --header "X-Vault-Token: $VAULT_TOKEN" \

    --request GET "$VAULT_ADDR/v1/secret/data/server_cert" 2>/dev/null | jq -r '.data.data.cert' -j > $CERTS_FOLDER/server.crt



curl  -k -retry 30 \

    --retry-all-errors \

    --connect-timeout 5 \

    --max-time 10 \

    --retry-delay 10 \

    --retry-max-time 300 \

        --request GET "$VAULT_ADDR/v1/secret/data/server_cert" | jq -r '.data.data.cert')



    echo "$RESPONSE"



    # Check if the response is "null" or empty

    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then

        echo "$RESPONSE" > $CERTS_FOLDER/server.crt

        echo "Server Certificate successfully saved."

        ATTEMPT=0

        SUCCES_OPERATION=true

        break

    else

        echo "Invalid response ('null' or empty), retrying in $RETRY_DELAY seconds..."

        sleep $RETRY_DELAY

    fi

done



if [ "$SUCCES_OPERATION" = false ]; then

    echo "Error: Failed to retrieve a valid response after $MAX_RETRIES attempts."

    exit 1  # Exit with failure

fi



# Setup inital value to ATTEMPT and SUCCESS_OPERATION

ATTEMPT=0

SUCCES_OPERATION=false



while [ $ATTEMPT -lt $MAX_RETRIES ]; do

    # Increment ATTEMPT using eval

    eval "ATTEMPT=\$((ATTEMPT + 1))"

    echo "Attempt $ATTEMPT of $MAX_RETRIES"



    # Make the request to Vault and store the response in a variable

    RESPONSE=$(curl -s -k --connect-timeout 5 --max-time 10 \

        --header "X-Vault-Token: $VAULT_TOKEN" \

    --request GET "$VAULT_ADDR/v1/secret/data/server_cert/private" 2>/dev/null | jq -r '.data.data.key' -j > $CERTS_FOLDER/server.key

        --request GET "$VAULT_ADDR/v1/secret/data/server_cert/private" | jq -r '.data.data.key')



    echo "$RESPONSE"



    # Check if the response is "null" or empty

    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then

        echo "$RESPONSE" > $CERTS_FOLDER/server.key

        echo "Server Key successfully saved."

        ATTEMPT=0

        SUCCES_OPERATION=true

        break

    else

        echo "Invalid response ('null' or empty), retrying in $RETRY_DELAY seconds..."

        sleep $RETRY_DELAY

    fi

done



if [ "$SUCCES_OPERATION" = false ]; then

    echo "Error: Failed to retrieve a valid response after $MAX_RETRIES attempts."

    exit 1  # Exit with failure

fi



LOG_LEVEL=$(echo "${LOG_LEVEL}" | tr '[:upper:]' '[:lower:]')

services/vault/vault_prepare_certs.sh

100644 → 100755
+5 −5
Changes for services/vault/vault_prepare_certs.sh: 5 added lines, 5 removed lines.
Original line number Diff line number Diff line
@@ -3,9 +3,9 @@ 
# Setup environment variables for Vault

export VAULT_ADDR="http://$VAULT_DEV_LISTEN_ADDRESS"

export VAULT_TOKEN=$VAULT_DEV_ROOT_TOKEN_ID

HOSTNAME="$CAPIF_HOSTNAME"

CAPIF_HOSTNAME="${CAPIF_HOSTNAME:-capifcore}"



echo "CAPIF_HOSTNAME: $HOSTNAME"

echo "CAPIF_HOSTNAME: $CAPIF_HOSTNAME"

echo "VAULT_ADDR: $VAULT_ADDR"

echo "VAULT_TOKEN: $VAULT_TOKEN"
@@ -44,7 +44,7 @@ vault write -format=json pki/root/sign-intermediate \ 
vault write pki_int/intermediate/set-signed certificate=@capif_intermediate.cert.pem



# Configure the role for the intermediate CA

vault write pki_int/roles/my-ca use_csr_common_name=false require_cn=true use_csr_sans=false allowed_domains=$HOSTNAME allow_any_name=true allow_bare_domains=true allow_glob_domains=true allow_subdomains=true max_ttl=4300h ttl=4300h

vault write pki_int/roles/my-ca use_csr_common_name=false require_cn=true use_csr_sans=false allowed_domains=$CAPIF_HOSTNAME allow_any_name=true allow_bare_domains=true allow_glob_domains=true allow_subdomains=true max_ttl=4300h ttl=4300h



# Generate a certificate

openssl genrsa -out ./server.key 2048
@@ -55,7 +55,7 @@ STATE="Madrid" # state or province name 
LOCALITY="Madrid"        # Locality Name (e.g. city)

ORGNAME="Telefonica I+D" # Organization Name (eg, company)

ORGUNIT="Innovation"                  # Organizational Unit Name (eg. section)

COMMONNAME="$HOSTNAME"

COMMONNAME="$CAPIF_HOSTNAME"

EMAIL="inno@tid.es"    # certificate's email address

# optional extra details

CHALLENGE=""                # challenge password
@@ -77,7 +77,7 @@ $COMPANY 
__EOF__





vault write -format=json pki_int/sign/my-ca  format=pem_bundle ttl="43000h" csr=@server.csr common_name="$HOSTNAME" | jq -r '.data.issuing_ca as $issuing_ca | .data.certificate as $certificate | [$issuing_ca, $certificate]' > cert_data.json

vault write -format=json pki_int/sign/my-ca  format=pem_bundle ttl="43000h" csr=@server.csr common_name="$CAPIF_HOSTNAME" | jq -r '.data.issuing_ca as $issuing_ca | .data.certificate as $certificate | [$issuing_ca, $certificate]' > cert_data.json



jq -r '.[0]' cert_data.json > root_ca.crt.pem

jq -r '.[1]' cert_data.json > server_certificate.crt.pem