Skip to content

Commit fa5d00a

Browse files
rcernichrcernich
committed
CLOUD-2249 secure routes for basic EAP, JWS and Java templates using TLS edge
 replace passthrough TLS with edge TLS for ephemeral templates remove HTTP/S_NAME parameters from basic and ephemeral templates Signed-off-by: rcernich <[email protected]>
1 parent 225f292 commit fa5d00a

40 files changed

+128
-2436
lines changed

‎eap/eap64-amq-persistent-s2i.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
"iconClass": "icon-eap",
77
"tags": "eap,javaee,java,jboss",
88
"version": "1.4.14",
9-
"openshift.io/display-name": "JBoss EAP 6.4 + A-MQ (with https)",
9+
"openshift.io/display-name": "JBoss EAP 6.4 + A-MQ (Persistent)",
1010
"openshift.io/provider-display-name": "Red Hat, Inc.",
1111
"description": "An example EAP 6 A-MQ application. For more information about using this template, see https://github.com/jboss-openshift/application-templates.",
12-
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration, using Red Hat JBoss A-MQ with persistence and secure communication using https.",
12+
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration, using Red Hat JBoss A-MQ with persistence and secure communication using passthrough TLS.",
1313
"template.openshift.io/documentation-url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/",
1414
"template.openshift.io/support-url": "https://access.redhat.com"
1515
},

‎eap/eap64-amq-s2i.json

Lines changed: 3 additions & 197 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"iconClass": "icon-eap",
77
"tags": "eap,javaee,java,jboss,hidden",
88
"version": "1.4.14",
9-
"openshift.io/display-name": "JBoss EAP 6.4 + A-MQ (Ephemeral with https)",
9+
"openshift.io/display-name": "JBoss EAP 6.4 + A-MQ (Ephemeral)",
1010
"openshift.io/provider-display-name": "Red Hat, Inc.",
1111
"description": "An example EAP 6 A-MQ application. For more information about using this template, see https://github.com/jboss-openshift/application-templates.",
1212
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration, using Red Hat JBoss A-MQ and secure communication using https.",
@@ -19,7 +19,7 @@
1919
"template": "eap64-amq-s2i",
2020
"xpaas": "1.4.14"
2121
},
22-
"message": "A new EAP 6 and A-MQ based application with SSL support has been created in your project. The username/password for accessing the A-MQ service is ${MQ_USERNAME}/${MQ_PASSWORD}. Please be sure to create the following secrets: \"${HTTPS_SECRET}\" containing the ${HTTPS_KEYSTORE} file used for serving secure content; \"${JGROUPS_ENCRYPT_SECRET}\" containing the ${JGROUPS_ENCRYPT_KEYSTORE} file used for securing JGroups communications.",
22+
"message": "A new EAP 6 and A-MQ based application has been created in your project. The username/password for accessing the A-MQ service is ${MQ_USERNAME}/${MQ_PASSWORD}.",
2323
"parameters": [
2424
{
2525
"displayName": "Application Name",
@@ -28,20 +28,6 @@
2828
"value": "eap-app",
2929
"required": true
3030
},
31-
{
32-
"displayName": "Custom http Route Hostname",
33-
"description": "Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-<project>.<default-domain-suffix>",
34-
"name": "HOSTNAME_HTTP",
35-
"value": "",
36-
"required": false
37-
},
38-
{
39-
"displayName": "Custom https Route Hostname",
40-
"description": "Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-<project>.<default-domain-suffix>",
41-
"name": "HOSTNAME_HTTPS",
42-
"value": "",
43-
"required": false
44-
},
4531
{
4632
"displayName": "Git Repository URL",
4733
"description": "Git source URI for application",
@@ -98,41 +84,6 @@
9884
"value": "",
9985
"required": false
10086
},
101-
{
102-
"displayName": "Server Keystore Secret Name",
103-
"description": "The name of the secret containing the keystore file",
104-
"name": "HTTPS_SECRET",
105-
"value": "eap-app-secret",
106-
"required": false
107-
},
108-
{
109-
"displayName": "Server Keystore Filename",
110-
"description": "The name of the keystore file within the secret",
111-
"name": "HTTPS_KEYSTORE",
112-
"value": "keystore.jks",
113-
"required": false
114-
},
115-
{
116-
"displayName": "Server Keystore Type",
117-
"description": "The type of the keystore file (JKS or JCEKS)",
118-
"name": "HTTPS_KEYSTORE_TYPE",
119-
"value": "",
120-
"required": false
121-
},
122-
{
123-
"displayName": "Server Certificate Name",
124-
"description": "The name associated with the server certificate",
125-
"name": "HTTPS_NAME",
126-
"value": "",
127-
"required": false
128-
},
129-
{
130-
"displayName": "Server Keystore Password",
131-
"description": "The password for the keystore and certificate",
132-
"name": "HTTPS_PASSWORD",
133-
"value": "",
134-
"required": false
135-
},
13687
{
13788
"displayName": "A-MQ Username",
13889
"description": "User name for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.",
@@ -186,34 +137,6 @@
186137
"value": "openshift",
187138
"required": true
188139
},
189-
{
190-
"displayName": "JGroups Secret Name",
191-
"description": "The name of the secret containing the keystore file",
192-
"name": "JGROUPS_ENCRYPT_SECRET",
193-
"value": "eap-app-secret",
194-
"required": false
195-
},
196-
{
197-
"displayName": "JGroups Keystore Filename",
198-
"description": "The name of the keystore file within the secret",
199-
"name": "JGROUPS_ENCRYPT_KEYSTORE",
200-
"value": "jgroups.jceks",
201-
"required": false
202-
},
203-
{
204-
"displayName": "JGroups Certificate Name",
205-
"description": "The name associated with the server certificate",
206-
"name": "JGROUPS_ENCRYPT_NAME",
207-
"value": "",
208-
"required": false
209-
},
210-
{
211-
"displayName": "JGroups Keystore Password",
212-
"description": "The password for the keystore and certificate",
213-
"name": "JGROUPS_ENCRYPT_PASSWORD",
214-
"value": "",
215-
"required": false
216-
},
217140
{
218141
"displayName": "JGroups Cluster Password",
219142
"description": "JGroups cluster password",
@@ -275,31 +198,6 @@
275198
}
276199
}
277200
},
278-
{
279-
"kind": "Service",
280-
"apiVersion": "v1",
281-
"spec": {
282-
"ports": [
283-
{
284-
"port": 8443,
285-
"targetPort": 8443
286-
}
287-
],
288-
"selector": {
289-
"deploymentConfig": "${APPLICATION_NAME}"
290-
}
291-
},
292-
"metadata": {
293-
"name": "secure-${APPLICATION_NAME}",
294-
"labels": {
295-
"application": "${APPLICATION_NAME}"
296-
},
297-
"annotations": {
298-
"description": "The web server's HTTPS port.",
299-
"service.alpha.openshift.io/dependencies": "[{\"name\": \"${APPLICATION_NAME}-amq-tcp\", \"kind\": \"Service\"}]"
300-
}
301-
}
302-
},
303201
{
304202
"kind": "Service",
305203
"apiVersion": "v1",
@@ -390,32 +288,11 @@
390288
}
391289
},
392290
"spec": {
393-
"host": "${HOSTNAME_HTTP}",
394291
"to": {
395292
"name": "${APPLICATION_NAME}"
396-
}
397-
}
398-
},
399-
{
400-
"kind": "Route",
401-
"apiVersion": "v1",
402-
"id": "${APPLICATION_NAME}-https",
403-
"metadata": {
404-
"name": "secure-${APPLICATION_NAME}",
405-
"labels": {
406-
"application": "${APPLICATION_NAME}"
407-
},
408-
"annotations": {
409-
"description": "Route for application's HTTPS service."
410-
}
411-
},
412-
"spec": {
413-
"host": "${HOSTNAME_HTTPS}",
414-
"to": {
415-
"name": "secure-${APPLICATION_NAME}"
416293
},
417294
"tls": {
418-
"termination": "passthrough"
295+
"termination": "edge"
419296
}
420297
}
421298
},
@@ -552,18 +429,6 @@
552429
"memory": "${MEMORY_LIMIT}"
553430
}
554431
},
555-
"volumeMounts": [
556-
{
557-
"name": "eap-keystore-volume",
558-
"mountPath": "/etc/eap-secret-volume",
559-
"readOnly": true
560-
},
561-
{
562-
"name": "eap-jgroups-keystore-volume",
563-
"mountPath": "/etc/jgroups-encrypt-secret-volume",
564-
"readOnly": true
565-
}
566-
],
567432
"livenessProbe": {
568433
"exec": {
569434
"command": [
@@ -594,11 +459,6 @@
594459
"containerPort": 8080,
595460
"protocol": "TCP"
596461
},
597-
{
598-
"name": "https",
599-
"containerPort": 8443,
600-
"protocol": "TCP"
601-
},
602462
{
603463
"name": "ping",
604464
"containerPort": 8888,
@@ -650,46 +510,6 @@
650510
"name": "OPENSHIFT_DNS_PING_SERVICE_PORT",
651511
"value": "8888"
652512
},
653-
{
654-
"name": "HTTPS_KEYSTORE_DIR",
655-
"value": "/etc/eap-secret-volume"
656-
},
657-
{
658-
"name": "HTTPS_KEYSTORE",
659-
"value": "${HTTPS_KEYSTORE}"
660-
},
661-
{
662-
"name": "HTTPS_KEYSTORE_TYPE",
663-
"value": "${HTTPS_KEYSTORE_TYPE}"
664-
},
665-
{
666-
"name": "HTTPS_NAME",
667-
"value": "${HTTPS_NAME}"
668-
},
669-
{
670-
"name": "HTTPS_PASSWORD",
671-
"value": "${HTTPS_PASSWORD}"
672-
},
673-
{
674-
"name": "JGROUPS_ENCRYPT_SECRET",
675-
"value": "${JGROUPS_ENCRYPT_SECRET}"
676-
},
677-
{
678-
"name": "JGROUPS_ENCRYPT_KEYSTORE_DIR",
679-
"value": "/etc/jgroups-encrypt-secret-volume"
680-
},
681-
{
682-
"name": "JGROUPS_ENCRYPT_KEYSTORE",
683-
"value": "${JGROUPS_ENCRYPT_KEYSTORE}"
684-
},
685-
{
686-
"name": "JGROUPS_ENCRYPT_NAME",
687-
"value": "${JGROUPS_ENCRYPT_NAME}"
688-
},
689-
{
690-
"name": "JGROUPS_ENCRYPT_PASSWORD",
691-
"value": "${JGROUPS_ENCRYPT_PASSWORD}"
692-
},
693513
{
694514
"name": "JGROUPS_CLUSTER_PASSWORD",
695515
"value": "${JGROUPS_CLUSTER_PASSWORD}"
@@ -700,20 +520,6 @@
700520
}
701521
]
702522
}
703-
],
704-
"volumes": [
705-
{
706-
"name": "eap-keystore-volume",
707-
"secret": {
708-
"secretName": "${HTTPS_SECRET}"
709-
}
710-
},
711-
{
712-
"name": "eap-jgroups-keystore-volume",
713-
"secret": {
714-
"secretName": "${JGROUPS_ENCRYPT_SECRET}"
715-
}
716-
}
717523
]
718524
}
719525
}

‎eap/eap64-basic-s2i.json

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
"iconClass": "icon-eap",
77
"tags": "eap,javaee,java,jboss",
88
"version": "1.4.14",
9-
"openshift.io/display-name": "JBoss EAP 6.4 (no https)",
9+
"openshift.io/display-name": "JBoss EAP 6.4",
1010
"openshift.io/provider-display-name": "Red Hat, Inc.",
1111
"description": "An example EAP 6 application. For more information about using this template, see https://github.com/jboss-openshift/application-templates.",
12-
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration and insecure communication using http.",
12+
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration and secure communication using https.",
1313
"template.openshift.io/documentation-url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/",
1414
"template.openshift.io/support-url": "https://access.redhat.com"
1515
},
@@ -28,13 +28,6 @@
2828
"value": "eap-app",
2929
"required": true
3030
},
31-
{
32-
"displayName": "Custom http Route Hostname",
33-
"description": "Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-<project>.<default-domain-suffix>",
34-
"name": "HOSTNAME_HTTP",
35-
"value": "",
36-
"required": false
37-
},
3831
{
3932
"displayName": "Git Repository URL",
4033
"description": "Git source URI for application",
@@ -201,9 +194,11 @@
201194
}
202195
},
203196
"spec": {
204-
"host": "${HOSTNAME_HTTP}",
205197
"to": {
206198
"name": "${APPLICATION_NAME}"
199+
},
200+
"tls": {
201+
"termination": "edge"
207202
}
208203
}
209204
},

‎eap/eap64-https-s2i.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
"iconClass": "icon-eap",
77
"tags": "eap,javaee,java,jboss,hidden",
88
"version": "1.4.14",
9-
"openshift.io/display-name": "JBoss EAP 6.4 (with https)",
9+
"openshift.io/display-name": "JBoss EAP 6.4 (Passthrough TLS)",
1010
"openshift.io/provider-display-name": "Red Hat, Inc.",
1111
"description": "An example EAP 6 application. For more information about using this template, see https://github.com/jboss-openshift/application-templates.",
12-
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration and secure communication using https.",
12+
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration and secure communication using passthrough TLS.",
1313
"template.openshift.io/documentation-url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/",
1414
"template.openshift.io/support-url": "https://access.redhat.com"
1515
},

‎eap/eap64-mongodb-persistent-s2i.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
"iconClass": "icon-eap",
77
"tags": "eap,javaee,java,jboss,hidden",
88
"version": "1.4.14",
9-
"openshift.io/display-name": "JBoss EAP 6.4 + MongoDB (with https)",
9+
"openshift.io/display-name": "JBoss EAP 6.4 + MongoDB (Persistent)",
1010
"openshift.io/provider-display-name": "Red Hat, Inc.",
1111
"description": "An example EAP 6 application with a MongoDB database. For more information about using this template, see https://github.com/jboss-openshift/application-templates.",
12-
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration, database deployment configuration for MongoDB using persistence and secure communication using https.",
12+
"template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Enterprise Application Server 6.4 based application, including a build configuration, application deployment configuration, database deployment configuration for MongoDB using persistence and secure communication using passthrough TLS.",
1313
"template.openshift.io/documentation-url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/",
1414
"template.openshift.io/support-url": "https://access.redhat.com"
1515
},

0 commit comments

Comments
 (0)