Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create the full-blown bootstrap/control container #2884

Closed
bnevis-i opened this issue Nov 18, 2020 · 0 comments · Fixed by #2970
Closed

Create the full-blown bootstrap/control container #2884

bnevis-i opened this issue Nov 18, 2020 · 0 comments · Fixed by #2970
Assignees
@jim-wang-intel @lenny-goodell
Labels
3-high priority denoting release-blocking issues enhancement New feature or request security-services
Milestone
Ireland

Comments

@bnevis-i
Copy link
Collaborator

This is a subtask for implementation of the secure bootstrapping ADR.

Create the full-blown bootstrap/control container and start moving bootstrapping logic into it.
@bnevis-i bnevis-i added enhancement New feature or request security-services 3-high priority denoting release-blocking issues labels Nov 18, 2020
@bnevis-i bnevis-i added this to the Ireland milestone Nov 18, 2020
@jim-wang-intel jim-wang-intel mentioned this issue Dec 23, 2020
Merged
3 tasks
@jim-wang-intel jim-wang-intel linked a pull request Dec 23, 2020 that will close this issue
feat(security): Add new implementation for security bootstrapper #2970
Merged
3 tasks
jim-wang-intel added a commit to jim-wang-intel/edgex-go that referenced this issue Jan 21, 2021
@jim-wang-intel
feat(security): Add new implementation for security bootstrapping/ins…
401c9bf 
…tallation

Closes: edgexfoundry#2884

The scurity container bootstrapping initiates with security-bootstrapper service, in which it bootstraps
the pre-seeded secrets and credentials.

The security-bootstrapper starts with seeding the vault_wait_install.sh script (contains the dockerize utility)
to be available for other containers that needs to wait for the intended done-listener is issued and connected.

The other containers in the security bootstrapping process currently are:
 - Redis bootstrapping
 - Consul bootstrapping
 - Kong bootstrapping
 - Postgres bootstrapping

The dockerize utility is used on those above containers to wait for that security-bootstrapper
tcp listener done signal and then those container can proceed to start up.

Security-bootstrapper's entrypoint script is also for other edgex-core-services to wait for the intended port to be ready.

The majority of edgex-core-services are converted to alpine-based image to facilitate the ability to use entrypoint scripts.

Also remove unused environment flag: SECRETSTORE_SETUP_DONE_FLAG from secretstore_setup's entrypoint script
That env flag will also needed to be cleaned up on the docker-compose file

All timeout for dockerize wait-timeout in one central place.
Also add the consul local config for disabling the auto check upate as currently consul is not running in SSL mode.

Add lib/pq into Attribution.txt

Run security-bootstrapper executeable as non-root user, $$EDGEX_USER

All env. variables of entrypoint scripts are populated from the env files of compose builder in developer-scripts

Signed-off-by: Jim Wang <[email protected]>
lenny-goodell pushed a commit that referenced this issue Jan 22, 2021
@jim-wang-intel
feat(security): Add new implementation for security bootstrapping/ins…
5dc76a6 
…tallation (#2970)

Closes: #2884

The scurity container bootstrapping initiates with security-bootstrapper service, in which it bootstraps
the pre-seeded secrets and credentials.

The security-bootstrapper starts with seeding the vault_wait_install.sh script (contains the dockerize utility)
to be available for other containers that needs to wait for the intended done-listener is issued and connected.

The other containers in the security bootstrapping process currently are:
 - Redis bootstrapping
 - Consul bootstrapping
 - Kong bootstrapping
 - Postgres bootstrapping

The dockerize utility is used on those above containers to wait for that security-bootstrapper
tcp listener done signal and then those container can proceed to start up.

Security-bootstrapper's entrypoint script is also for other edgex-core-services to wait for the intended port to be ready.

The majority of edgex-core-services are converted to alpine-based image to facilitate the ability to use entrypoint scripts.

Also remove unused environment flag: SECRETSTORE_SETUP_DONE_FLAG from secretstore_setup's entrypoint script
That env flag will also needed to be cleaned up on the docker-compose file

All timeout for dockerize wait-timeout in one central place.
Also add the consul local config for disabling the auto check upate as currently consul is not running in SSL mode.

Add lib/pq into Attribution.txt

Run security-bootstrapper executeable as non-root user, $$EDGEX_USER

All env. variables of entrypoint scripts are populated from the env files of compose builder in developer-scripts

Signed-off-by: Jim Wang <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jim-wang-intel jim-wang-intel

@lenny-goodell lenny-goodell

Labels
3-high priority denoting release-blocking issues enhancement New feature or request security-services
Projects
None yet
Milestone
Ireland
Development

Successfully merging a pull request may close this issue.

feat(security): Add new implementation for security bootstrapper jim-wang-intel/edgex-go
3 participants
@bnevis-i @jim-wang-intel @lenny-goodell