Documentation and compose

FROM ibm-semeru-runtimes:open-17.0.7_7-jdk

RUN mkdir -p /opt/openslice/lib/

COPY target/secret-controller-0.1.0.jar /opt/openslice/lib/

CMD ["java", "-Xshareclasses:cacheDir=/opt/shareclasses", "-jar", "/opt/openslice/lib/secret-controller-0.1.0.jar"]

# Openslice secret controller

Generic controller for Openslice that automatically stores secret

characteristics into an external secret management solution and replaces the

original characteristic with a link to the external secret management solution.

Generic controller for OpenSlice (ETSI OSL) that automatically stores secret

characteristics into Hashicorp Vault, an external secret management solution,

and replaces the original characteristic with a link to it.

## Status

## Configuration

Work in progress

The controller can be configured using the usual mechanisms provided by the

Spring framework, with the main options being the following:

```yaml

spring:

  artemis:

    broker-url: "tcp://artemis:61616"

    user: artemis

    password: password

vault:

  uri: "http://vault:8200"

  kvPath: "openslice"

  token: "hvs.AAAAAAAAAA"

```

The `vault.uri` is the address of the Hashicorp Vault server to be used, the

`kvPath` is the path where the KV secrets engine for Openslice (explained in the

next section) was mounted, and `token` is the authentication token that allows

access to the KV secret store.

## Vault setup

In order for the controller to function the Vault must be configured to have

a KV secret engine version 2 mounted. By default this is expected to reside at

`openslice`, but it can be changed in the controller configuration. To create

the KV engine the following command may be used:

```sh

$ vault secrets enable -path openslice -version=2 -options=max_versions=1 kv

```

Then a policy and token can be created for the controller using the following

commands:

```sh

$ vault policy write openslice-policy - <<EOF

path "openslice/data/*" {

  capabilities = ["read", "create", "update", "patch", "delete"]

}

EOF

$ vault token create -policy="openslice-policy"

```

The generated token should be set in the `vault.token` property of the

controller.

## Building

The controller can be built using the normal Maven workflows.

```sh

$ mvn package

```

To build the container, the controller must have been built first and then

a standard `docker build` can be used in the project's root.

```sh

$ docker build -t osl-secret-controller .

```

## Quickstart

A Docker compose file is available in the project's root to quickly bootstrap a

testing and development environment. This compose should not be used in production.

First start only the Hashicorp Vault container from the compose file.

```sh

$ docker compose up --build vault

```

Then access its UI at http://127.0.0.1:8200/ui/ and configure the sealing

shares. For development 1 key share with 1 key threshold is fine. The UI will

then show the shares and the root token, store all of them securely. Unseal

the vault.

At this point the vault is unsealed and the setup previously described can be

performed. The resulting token should be changed in the compose file. Stop the

compose command, and start again but this time with all services.

```sh

$ docker compose up --build

```

At this point the Vault will need to be unsealed again, but after doing so

everything will be working normally and the secret controller will seal any

secret characteristics that are created.

services:

  vault:

    image: hashicorp/vault:2.0

    container_name: osl-vault

    command: server

    ports:

    - "8200:8200"

    cap_add:

      - IPC_LOCK

    volumes:

      - vault_data:/vault/file

    configs:

      - source: vault_config

        target: /vault/config/config.hcl

  osl-secrets-controller:

    build:

      context: .

      dockerfile: Dockerfile

    container_name: osl-secrets-controller

    environment:

      SPRING_ARTEMIS_BROKER_URL: tcp://artemis:61616

      SPRING_ARTEMIS_USER: artemis

      SPRING_ARTEMIS_PASSWORD: password

      VAULT_URI: http://osl-vault:8200 

      VAULT_TOKEN: hvs.AAAAAAAAAAAA

    healthcheck:

      test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]

      interval: 30s

      timeout: 3s

      retries: 3

      start_period: 10s

volumes:

  vault_data:

configs:

  vault_config:

    content: |

      ui = true

      api_addr = "http://osl-vault:8200"

      disable_mlock = true

      storage "file" {

        path = "/vault/file"

      }

      listener "tcp" {

        address     = "0.0.0.0:8200"

        tls_disable = true

      }

    <groupId>org.etsi.osl</groupId>

    <artifactId>secret-controller</artifactId>

    <version>0.0.1-SNAPSHOT</version>

    <version>0.1.0</version>

    <name>org.etsi.osl.secret-controller</name>

    <description>org.etsi.osl.secret-controller</description>

    <properties>

        <java.version>17</java.version>

        <org.etsi.osl.model.tmf.version>1.3.0-alpha</org.etsi.osl.model.tmf.version>

        <maven.compiler.source>17</maven.compiler.source>

        <maven.compiler.target>17</maven.compiler.target>

        <org.etsi.osl.model.tmf.version>1.4.0-SNAPSHOT</org.etsi.osl.model.tmf.version>

    </properties>

    <repositories>