feat(jmx): custom entrypoint to support copying TLS certs into truststore for JMX #330
Conversation
andrewazores
force-pushed
the
jmx-tls
branch
6 times, most recently
from
57f1276 to
1b77e57
Compare
|
This PR/issue depends on: |
|
/build_test |
|
Workflow started at 3/22/2024, 2:34:06 PM. View Actions Run. |
|
@aali309 @mwangggg please review and ensure functionality works in your testing. @ebaron this keeps the same filesystem conventions as in Cryostat 2.x in terms of where the truststore is expected to be mounted into the container. I think that's OK to keep in this PR, but if we have time in this release cycle it's probably something worth adjusting, too. WDYT? |
|
CI build and push: All tests pass ✅ (JDK21) |
|
No OpenAPI schema changes detected. |
|
CI build and push: All tests pass ✅ (JDK17) |
andrewazores
force-pushed
the
jmx-tls
branch
2 times, most recently
from
f14af37 to
978ce4b
Compare
Sorry for the late reply. What sort of changes did you have in mind? |
|
Just changing some of the default paths: Rather than |
Oh yeah, that should be fine to do. Will only require changing some paths on the operator and Helm chart. |
|
Cool. I'll file some issues so we can settle on what the paths should be and implement the changes some time later. |
|
I added a simple endpoint that walks the truststore directory and returns a list of the paths to files it finds in there. I figure this fits in well with the other changes, and relates to #306 as it gives us something to replace the old "JMX SSL cert upload" UX with - now we can have a simple "Target TLS certificates list" view instead that just renders this list as a table and tells the user that if they need to add more certs, they have to do it by adding them to the truststore and restarting the Cryostat server. |
|
/build_test |
|
Workflow started at 4/16/2024, 9:30:25 AM. View Actions Run. |
|
OpenAPI schema change detected: diff --git a/schema/openapi.yaml b/schema/openapi.yaml
index b7db9ef..fcda791 100644
--- a/schema/openapi.yaml
+++ b/schema/openapi.yaml
@@ -2177,20 +2177,33 @@ paths:
type: object
description: OK
"401":
description: Not Authorized
"403":
description: Not Allowed
security:
- SecurityScheme: []
tags:
- Reports
+ /api/v3/tls/certs:
+ get:
+ responses:
+ "200":
+ content:
+ application/json:
+ schema:
+ items:
+ type: string
+ type: array
+ description: OK
+ tags:
+ - Trust Store
/health:
get:
responses:
"200":
description: OK
tags:
- Health
/health/liveness:
get:
responses:
|
|
CI build and push: At least one test failed ❌ (JDK17) |
|
/build_test |
|
Workflow started at 4/16/2024, 9:40:22 AM. View Actions Run. |
|
OpenAPI schema change detected: diff --git a/schema/openapi.yaml b/schema/openapi.yaml
index b7db9ef..fcda791 100644
--- a/schema/openapi.yaml
+++ b/schema/openapi.yaml
@@ -2177,20 +2177,33 @@ paths:
type: object
description: OK
"401":
description: Not Authorized
"403":
description: Not Allowed
security:
- SecurityScheme: []
tags:
- Reports
+ /api/v3/tls/certs:
+ get:
+ responses:
+ "200":
+ content:
+ application/json:
+ schema:
+ items:
+ type: string
+ type: array
+ description: OK
+ tags:
+ - Trust Store
/health:
get:
responses:
"200":
description: OK
tags:
- Health
/health/liveness:
get:
responses:
|
|
CI build and push: All tests pass ✅ (JDK17) |
Sounds good |
|
/build_test |
|
Workflow started at 4/18/2024, 5:12:07 PM. View Actions Run. |
|
No OpenAPI schema changes detected. |
|
CI build and push: All tests pass ✅ (JDK17) |
Welcome to Cryostat3! 👋
Before contributing, make sure you have:
mainbranch[chore, ci, docs, feat, fix, test]To recreate commits with GPG signature
git fetch upstream && git rebase --force --gpg-sign upstream/mainBased on #329
Related to #2
Related to #71
Description of the change:
Copies a simplified version of Cryostat 2.4's
entrypoint.bashandtruststore-setup.shinto the container build, sets up the container to initialize with the truststore copy and the entrypoint to copy in any additional user-supplied certificates into this truststore, before finally launching the server JVM.Motivation for the change:
This allows users (the ones who deploy Cryostat, not the ones who interact with the UI and API) to supply TLS certificates that their target applications present for JMX connections. This restores Cryostat 3's ability to connect to such JMX/TLS-enabled targets.
How to manually test:
mkdir truststorein the project directorytruststoresample-app-3:9095should now work as normal too.smoketest.bashwill copy the local project directorytruststoreinto a test volume and mount that to the Cryostat container. The Cryostat container should then see the new certificate and import it into its runtime truststore, then start the JVM which will now trust the certificate presented bysample-app-3.