feat(security): Add new implementation for security bootstrapper #2970
Conversation
jim-wang-intel
added
enhancement
jim-wang-intel
requested review from
beaufrusetta,
hutchic,
cloudxxx8,
bnevis-i and
lenny-goodell
Codecov Report
@@ Coverage Diff @@
## master #2970 +/- ##
==========================================
+ Coverage 40.28% 40.92% +0.64%
==========================================
Files 158 168 +10
Lines 13736 14018 +282
==========================================
+ Hits 5533 5737 +204
- Misses 7882 7954 +72
- Partials 321 327 +6
Continue to review full report at Codecov.
|
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
from
0c4ac37 to
5afc258
Compare
jim-wang-intel
added
dependencies
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
2 times, most recently
from
81e80c1 to
4113549
Compare
|
edgex-go$ GO111MODULE=on go list -m all The bold one in the above list, github.com/lib/pq, is the new go import/module used in this PR. And the dependency graph shows that total increase in new imports in count = 1. edgex-go$ GO111MODULE=on go mod graph In particular, searching on Statistics measures as of 01/04/2021:
License type: MIT based on the content of license (compared https://github.com/lib/pq/blob/master/LICENSE.md with https://opensource.org/licenses/MIT). |
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
3 times, most recently
from
6ff8d3b to
f7efb5d
Compare
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
2 times, most recently
from
fb0dd7a to
dd0b41c
Compare
|
I approve adding |
cmd/security-bootstrapper/entrypoint-scripts/consul_wait_install.sh
Outdated
Show resolved
Hide resolved
cmd/security-bootstrapper/entrypoint-scripts/consul_wait_install.sh
Outdated
Show resolved
Hide resolved
cmd/security-bootstrapper/entrypoint-scripts/consul_wait_install.sh
Outdated
Show resolved
Hide resolved
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
2 times, most recently
from
66138a4 to
1fe9c57
Compare
cmd/security-bootstrapper/entrypoint-scripts/ready_to_run_wait_install.sh
Outdated
Show resolved
Hide resolved
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
from
1fe9c57 to
dc63644
Compare
cmd/security-bootstrapper/entrypoint-scripts/consul_wait_install.sh
Outdated
Show resolved
Hide resolved
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
5 times, most recently
from
d1b6f8c to
2446ae0
Compare
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
2 times, most recently
from
1b2dc09 to
1f38eab
Compare
|
recheck |
cmd/security-bootstrapper/entrypoint-scripts/consul_wait_install.sh
Outdated
Show resolved
Hide resolved
cmd/security-bootstrapper/entrypoint-scripts/redis_wait_install.sh
Outdated
Show resolved
Hide resolved
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
from
1f38eab to
c4eb6dd
Compare
|
@lenny-intel please re-review it again, i've addressed all comments + the toml structure we have agreed on over the phone. Thanks! |
…tallation Closes: edgexfoundry#2884 The scurity container bootstrapping initiates with security-bootstrapper service, in which it bootstraps the pre-seeded secrets and credentials. The security-bootstrapper starts with seeding the vault_wait_install.sh script (contains the dockerize utility) to be available for other containers that needs to wait for the intended done-listener is issued and connected. The other containers in the security bootstrapping process currently are: - Redis bootstrapping - Consul bootstrapping - Kong bootstrapping - Postgres bootstrapping The dockerize utility is used on those above containers to wait for that security-bootstrapper tcp listener done signal and then those container can proceed to start up. Security-bootstrapper's entrypoint script is also for other edgex-core-services to wait for the intended port to be ready. The majority of edgex-core-services are converted to alpine-based image to facilitate the ability to use entrypoint scripts. Also remove unused environment flag: SECRETSTORE_SETUP_DONE_FLAG from secretstore_setup's entrypoint script That env flag will also needed to be cleaned up on the docker-compose file All timeout for dockerize wait-timeout in one central place. Also add the consul local config for disabling the auto check upate as currently consul is not running in SSL mode. Add lib/pq into Attribution.txt Run security-bootstrapper executeable as non-root user, $$EDGEX_USER All env. variables of entrypoint scripts are populated from the env files of compose builder in developer-scripts Signed-off-by: Jim Wang <[email protected]>
jim-wang-intel
force-pushed
the
security-bootstrapper
branch
from
295f404 to
401c9bf
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
|
Rebased and squashed. Thanks! |
The full blown implementation is base on ADR security bootstrapping containers.
The security container bootstrapping initiates with security-bootstrapper service, in which it bootstraps
the pre-seeded secrets and credentials.
The security-bootstrapper starts with seeding the vault_wait_install.sh script (contains the dockerize utility)
to be available for other containers that needs to wait for the intended done-listener is issued and connected.
The other containers in the security bootstrapping process currently are:
The dockerize utility is used on those above containers to wait for that security-bootstrapper
tcp listener done signal and then those container can proceed to start up.
Signed-off-by: Jim Wang [email protected]
PR Checklist
Please check if your PR fulfills the following requirements:
If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/edgex-go/blob/master/.github/Contributing.md.
What is the current behavior?
This is a totally new implementation
Issue Number: #2884
What is the new behavior?
New security bootstrapping mechanism and entrypoint scripts to coordinate the startup steps for various service containers.
Does this PR introduce a breaking change?
New Imports
https://wiki.edgexfoundry.org/display/FA/Vetting+Process+for+3rd+Party+Dependencies
Add pure Golang postgres driver tool lib/pq to facilitate the pinging postgres db connection for the readiness of
kong-db. This is needed because thepostgres kong-dbservice docker-container currently is read-only and hence unable to install any new utilities on that container itself.Add dockerize executable to facilitate the gating or waiting mechanism on various containers. This one is not used directly in new imports or modules; rather only used in the shell scripts.
Specific Instructions
Are there any specific instructions or things that should be known prior to reviewing?
local testing instructions:
make dockerdocker-compose upOther information