Securing Connection Between Pods in Openshift with SSL
On this post, im trying to create a simple microservices application on top of Openshift 3.11 and each services will do a simple secure connection between it by using a self-sign SSL which are managed by Openshift.
The goal of why Openshift are managing SSL certificate thru Openshift Secret is to have a rolling or rotating certificate feature on each services but can be triggered by Openshift without have to replace SSL on each services manually.
First is generate a p12 certificate by using keytool
cert>keytool -genkey -alias edw -keystore edw.p12 -storetype PKCS12 -keyalg RSA -storepass password -validity 730 -keysize 4096 What is your first and last name? [Unknown]: Edwin What is the name of your organizational unit? [Unknown]: Company 01 What is the name of your organization? [Unknown]: IT What is the name of your City or Locality? [Unknown]: Jakarta What is the name of your State or Province? [Unknown]: Jakarta What is the two-letter country code for this unit? [Unknown]: ID Is CN=Edwin, OU=Company 01, O=IT, L=Jakarta, ST=Jakarta, C=ID correct? [no]: yes
Next is creating two java projects which are connected one and another,
https://github.com/edwin/ssl-pods-example
https://github.com/edwin/ssl-pods-example-2
There are several part of the code that need mentioning,
First is making sure https option is active on application.properties, include our p12 certificate and make certificate password as parameterized. This parameter later on will be injected as environment variables on Openshift.
server.ssl.key-store-type=PKCS12
server.ssl.key-store=cert/edw.p12
server.ssl.key-store-password=${SSLPASSWORD}
server.ssl.key-alias=edw
server.port=8443
server.ssl.enabled=true
And the next is because we are using a custom certificate, dont forget to include it on RestTemplate.
@Configuration
public class MyRestTemplate {
@Value("${server.ssl.key-store}")
private String sslKeyStore;
@Value("${server.ssl.key-store-password}")
private String sslPassword;
@Bean
public RestTemplate restTemplate() throws Exception {
KeyStore clientStore = KeyStore.getInstance("PKCS12");
clientStore.load(new FileInputStream(sslKeyStore), sslPassword.toCharArray());
SSLContext sslContext = SSLContextBuilder
.create()
.loadTrustMaterial(clientStore, new TrustSelfSignedStrategy())
.build();
SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
HttpClient httpClient = HttpClients.custom()
.setSSLSocketFactory(socketFactory)
.build();
HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);
return new RestTemplate(factory);
}
}
Deploy those two application to Openshift,
oc new-app registry.access.redhat.com/openjdk/openjdk-11-rhel7~https://github.com/edwin/ssl-pods-example oc new-app registry.access.redhat.com/openjdk/openjdk-11-rhel7~https://github.com/edwin/ssl-pods-example-2
Deploy certificate as OCP Secret and mount it as a volume on our application,
oc create secret generic cert --from-file=cert\edw.p12 oc set volume dc ssl-pods-example --add -t secret -m /deployments/cert --name cert --secret-name cert oc set volume dc ssl-pods-example-2 --add -t secret -m /deployments/cert --name cert --secret-name cert
And our certificate password as OCP Secret and inject it as environment variable to our application
oc create secret generic sslpassword --from-literal=SSLPASSWORD=password oc set env dc ssl-pods-example --from=secret/sslpassword oc set env dc ssl-pods-example-2 --from=secret/sslpassword
After all deployed on OCP, next is give a route for our application. Im using re-encrypt method for ensuring an end to end encryption within the app. In order to do so, we need to include our application CA certificate as our route’s destination certificate. We can do so by exporting our certificate from p12 file using this command,
keytool -exportcert -keystore edw.p12 -storetype PKCS12 -storepass password -alias edw -file edw.crt -rfc
And paste the certificate on our route,
The end result would be like below image,
And as you can see, we are using certificate from end to end for securing our connection.
