Skip to content

Commit 5c8eec2

Browse files
jfmyers9jenspinney
jfmyers9
authored and
jenspinney
committed
bump auctioneer bbs cf_http converger diego-ssh inigo nsync receptor rep route-emitter stager tps ifrit
Submodule src/github.com/cloudfoundry-incubator/auctioneer e4f24a7..f61b515: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/bbs 8bf3bb4..9d6efd4: > implements optional mutual SSL for BBS Client/Server communication Submodule src/github.com/cloudfoundry-incubator/cf_http e2698df..8e03667: > improve error messages for TLS config creation Submodule src/github.com/cloudfoundry-incubator/converger 5603922..be5b1fc: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/diego-ssh 9c52952..d704e4e: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/inigo 0560d23..30aea2e: > require TLS connectiions to BBS Submodule src/github.com/cloudfoundry-incubator/nsync a607507..dac4e55: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/receptor 073dba7..40b817a: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/rep a044731..96c1cd9: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/route-emitter 127ed48..98a0077: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/stager a495461..f88e307: > support mutual-auth TLS to BBS Submodule src/github.com/cloudfoundry-incubator/tps a4787ad..c2cb0e5: > support mutual-auth TLS to BBS Submodule src/github.com/tedsuo/ifrit 65ca48c..5ddc47c: > Merge pull request #9 from jenspinney/wip-bbs-ssl Signed-off-by: Jen Spinney <[email protected]>
1 parent d7488a9 commit 5c8eec2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+752
-39
lines changed

‎jobs/auctioneer/spec‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ name: auctioneer
44
templates:
55
auctioneer_ctl.erb: bin/auctioneer_ctl
66
dns_health_check.erb: bin/dns_health_check
7+
bbs_ca.crt.erb: config/certs/bbs/ca.crt
8+
bbs_client.crt.erb: config/certs/bbs/client.crt
9+
bbs_client.key.erb: config/certs/bbs/client.key
710

811
packages:
912
- pid_utils
@@ -22,3 +25,10 @@ properties:
2225

2326
diego.auctioneer.bbs.api_url:
2427
description: "Address to the BBS Server"
28+
29+
diego.auctioneer.bbs.ca_cert:
30+
description: "PEM-encoded CA certificate"
31+
diego.auctioneer.bbs.client_cert:
32+
description: "PEM-encoded client certificate"
33+
diego.auctioneer.bbs.client_key:
34+
description: "PEM-encoded client key"

‎jobs/auctioneer/templates/auctioneer_ctl.erb‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,17 @@ PIDFILE=$RUN_DIR/auctioneer.pid
77

88
source /var/vcap/packages/pid_utils/pid_utils.sh
99

10+
<% require 'uri' %>
11+
12+
<% if URI(p("diego.auctioneer.bbs.api_url")).scheme == "https" %>
13+
bbs_sec_flags=" \
14+
-bbsClientCert=${CONF_DIR}/certs/bbs/client.crt \
15+
-bbsClientKey=${CONF_DIR}/certs/bbs/client.key \
16+
-bbsCACert=${CONF_DIR}/certs/bbs/ca.crt"
17+
<% else %>
18+
bbs_sec_flags=""
19+
<% end %>
20+
1021
case $1 in
1122

1223
start)
@@ -23,7 +34,7 @@ case $1 in
2334
# Allowed number of open file descriptors
2435
ulimit -n 100000
2536

26-
exec chpst -u vcap:vcap /var/vcap/packages/auctioneer/bin/auctioneer \
37+
exec chpst -u vcap:vcap /var/vcap/packages/auctioneer/bin/auctioneer ${bbs_sec_flags} \
2738
-bbsAddress=<%= p("diego.auctioneer.bbs.api_url") %> \
2839
-consulCluster=http://127.0.0.1:8500 \
2940
-debugAddr=<%= p("diego.auctioneer.debug_addr") %> \

‎jobs/auctioneer/templates/bbs_ca.crt.erb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<%= p("diego.auctioneer.bbs.ca_cert") %>
2+

‎jobs/auctioneer/templates/bbs_client.crt.erb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<%= p("diego.auctioneer.bbs.client_cert") %>
2+

‎jobs/auctioneer/templates/bbs_client.key.erb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<%= p("diego.auctioneer.bbs.client_key") %>
2+

‎jobs/bbs/spec‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ templates:
77
etcd_ca.crt.erb: config/certs/etcd/ca.crt
88
etcd_client.crt.erb: config/certs/etcd/client.crt
99
etcd_client.key.erb: config/certs/etcd/client.key
10+
bbs_ca.crt.erb: config/certs/ca.crt
11+
bbs_server.crt.erb: config/certs/server.crt
12+
bbs_server.key.erb: config/certs/server.key
1013

1114
packages:
1215
- pid_utils
@@ -44,3 +47,13 @@ properties:
4447
diego.bbs.encryption_keys:
4548
description: "List of encryption keys to be used"
4649
default: []
50+
51+
diego.bbs.require_ssl:
52+
description: "require ssl for all communication the bbs"
53+
default: true
54+
diego.bbs.ca_cert:
55+
description: "PEM-encoded CA certificate"
56+
diego.bbs.server_cert:
57+
description: "PEM-encoded client certificate"
58+
diego.bbs.server_key:
59+
description: "PEM-encoded client key"

‎jobs/bbs/templates/bbs_ca.crt.erb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<%= p("diego.bbs.ca_cert") %>
2+

‎jobs/bbs/templates/bbs_ctl.erb‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,18 @@ etcd_sec_flags=" \
1818
etcd_sec_flags=""
1919
<% end %>
2020

21+
<% if p("diego.bbs.require_ssl") %>
22+
ad_url_scheme="https"
23+
bbs_sec_flags=" \
24+
-certFile=${CONF_DIR}/certs/server.crt \
25+
-keyFile=${CONF_DIR}/certs/server.key \
26+
-caFile=${CONF_DIR}/certs/ca.crt"
27+
<% else %>
28+
ad_url_scheme="http"
29+
bbs_sec_flags=""
30+
<% end %>
31+
32+
2133
case $1 in
2234

2335
start)
@@ -61,9 +73,9 @@ case $1 in
6173
# Allowed number of open file descriptors
6274
ulimit -n 100000
6375

64-
exec chpst -u vcap:vcap /var/vcap/packages/bbs/bin/bbs ${etcd_sec_flags} \
76+
exec chpst -u vcap:vcap /var/vcap/packages/bbs/bin/bbs ${etcd_sec_flags} ${bbs_sec_flags} \
6577
-activeKeyLabel='<%= p("diego.bbs.active_key_label") %>' \
66-
-advertiseURL=<%= "http://#{name.gsub('_', '-')}-#{spec.index}.bbs.service.cf.internal:#{p("diego.bbs.listen_addr").split(':')[1]}" %> \
78+
-advertiseURL=${ad_url_scheme}<%="://#{name.gsub('_', '-')}-#{spec.index}.bbs.service.cf.internal:#{p("diego.bbs.listen_addr").split(':')[1]}" %> \
6779
-auctioneerAddress=<%= p("diego.bbs.auctioneer.api_url") %> \
6880
-consulCluster=http://127.0.0.1:8500 \
6981
-debugAddr=<%= p("diego.bbs.debug_addr") %> \
@@ -73,6 +85,7 @@ case $1 in
7385
-etcdCluster=<%= p("diego.bbs.etcd.machines").map{|addr| "\"#{p("diego.bbs.etcd.require_ssl") ? "https" : "http"}://#{addr}:4001\""}.join(",")%> \
7486
-listenAddress=<%= p("diego.bbs.listen_addr") %> \
7587
-logLevel=<%= p("diego.bbs.log_level") %> \
88+
-requireSSL=<%= p("diego.bbs.etcd.require_ssl") %> \
7689
2> >(tee -a $LOG_DIR/bbs.stderr.log | logger -p user.error -t vcap.bbs) \
7790
1> >(tee -a $LOG_DIR/bbs.stdout.log | logger -p user.info -t vcap.bbs)
7891

‎jobs/bbs/templates/bbs_server.crt.erb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<%= p("diego.bbs.server_cert") %>
2+

‎jobs/bbs/templates/bbs_server.key.erb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<%= p("diego.bbs.server_key") %>
2+

0 commit comments

Comments
 (0)