Examples with CertificateAuthority io.strimzi.api.kafka.model.CertificateAuthority used on opensource projects

Example 6 with CertificateAuthority

use of io.strimzi.api.kafka.model.CertificateAuthority in project strimzi by strimzi.

the class CertificateRenewalTest method testGenerateTruststoreFromOldSecrets.

@Test
public void testGenerateTruststoreFromOldSecrets(Vertx vertx, VertxTestContext context) throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException {
    CertificateAuthority certificateAuthority = new CertificateAuthorityBuilder().withValidityDays(100).withRenewalDays(10).withGenerateCertificateAuthority(true).build();
    List<Secret> clusterCaSecrets = initialClusterCaSecrets(certificateAuthority);
    Secret initialClusterCaKeySecret = clusterCaSecrets.get(0);
    Secret initialClusterCaCertSecret = clusterCaSecrets.get(1);
    // remove truststore and password to simulate Secrets coming from an older version
    initialClusterCaCertSecret.getData().remove(CA_STORE);
    initialClusterCaCertSecret.getData().remove(CA_STORE_PASSWORD);
    List<Secret> clientsCaSecrets = initialClientsCaSecrets(certificateAuthority);
    Secret initialClientsCaKeySecret = clientsCaSecrets.get(0);
    Secret initialClientsCaCertSecret = clientsCaSecrets.get(1);
    // remove truststore and password to simulate Secrets coming from an older version
    initialClientsCaCertSecret.getData().remove(CA_STORE);
    initialClientsCaCertSecret.getData().remove(CA_STORE_PASSWORD);
    secrets.add(initialClusterCaCertSecret);
    secrets.add(initialClusterCaKeySecret);
    secrets.add(initialClientsCaCertSecret);
    secrets.add(initialClientsCaKeySecret);
    Checkpoint async = context.checkpoint();
    reconcileCa(vertx, certificateAuthority, certificateAuthority).onComplete(context.succeeding(c -> context.verify(() -> {
        assertThat(c.getAllValues(), hasSize(4));
        Map<String, String> clusterCaCertData = c.getAllValues().get(0).getData();
        assertThat(clusterCaCertData.keySet(), is(set(CA_CRT, CA_STORE, CA_STORE_PASSWORD)));
        X509Certificate newX509ClusterCaCertStore = getCertificateFromTrustStore(CA_CRT, clusterCaCertData);
        String newClusterCaCert = clusterCaCertData.remove(CA_CRT);
        String newClusterCaCertStore = clusterCaCertData.remove(CA_STORE);
        String newClusterCaCertStorePassword = clusterCaCertData.remove(CA_STORE_PASSWORD);
        assertThat(newClusterCaCert, is(notNullValue()));
        assertThat(newClusterCaCertStore, is(notNullValue()));
        assertThat(newClusterCaCertStorePassword, is(notNullValue()));
        assertThat(newClusterCaCert, is(initialClusterCaCertSecret.getData().get(CA_CRT)));
        assertThat(newX509ClusterCaCertStore, is(x509Certificate(newClusterCaCert)));
        Map<String, String> clusterCaKeyData = c.getAllValues().get(1).getData();
        assertThat(clusterCaKeyData.keySet(), is(singleton(CA_KEY)));
        String newClusterCaKey = clusterCaKeyData.remove(CA_KEY);
        assertThat(newClusterCaKey, is(notNullValue()));
        assertThat(newClusterCaKey, is(initialClusterCaKeySecret.getData().get(CA_KEY)));
        Map<String, String> clientsCaCertData = c.getAllValues().get(2).getData();
        assertThat(clientsCaCertData.keySet(), is(set(CA_CRT, CA_STORE, CA_STORE_PASSWORD)));
        X509Certificate newX509ClientsCaCertStore = getCertificateFromTrustStore(CA_CRT, clientsCaCertData);
        String newClientsCaCert = clientsCaCertData.remove(CA_CRT);
        String newClientsCaCertStore = clientsCaCertData.remove(CA_STORE);
        String newClientsCaCertStorePassword = clientsCaCertData.remove(CA_STORE_PASSWORD);
        assertThat(newClientsCaCert, is(notNullValue()));
        assertThat(newClientsCaCertStore, is(notNullValue()));
        assertThat(newClientsCaCertStorePassword, is(notNullValue()));
        assertThat(newClientsCaCert, is(initialClientsCaCertSecret.getData().get(CA_CRT)));
        assertThat(newX509ClientsCaCertStore, is(x509Certificate(newClientsCaCert)));
        Map<String, String> clientsCaKeyData = c.getAllValues().get(3).getData();
        assertThat(clientsCaKeyData.keySet(), is(singleton(CA_KEY)));
        String newClientsCaKey = clientsCaKeyData.remove(CA_KEY);
        assertThat(newClientsCaKey, is(notNullValue()));
        assertThat(newClientsCaKey, is(initialClientsCaKeySecret.getData().get(CA_KEY)));
        async.flag();
    })));
}

Example 7 with CertificateAuthority

use of io.strimzi.api.kafka.model.CertificateAuthority in project strimzi by strimzi.

the class KafkaAssemblyOperatorNonParametrizedTest method testClientsCASecretsWithoutOwnerReference.

@Test
public void testClientsCASecretsWithoutOwnerReference(VertxTestContext context) {
    OwnerReference ownerReference = new OwnerReferenceBuilder().withKind("Kafka").withName(NAME).withBlockOwnerDeletion(false).withController(false).build();
    CertificateAuthority caConfig = new CertificateAuthority();
    caConfig.setGenerateSecretOwnerReference(false);
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(NAME).withNamespace(NAMESPACE).endMetadata().withNewSpec().withNewKafka().withReplicas(3).withNewEphemeralStorage().endEphemeralStorage().endKafka().withClientsCa(caConfig).withNewZookeeper().withReplicas(3).withNewEphemeralStorage().endEphemeralStorage().endZookeeper().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    SecretOperator secretOps = supplier.secretOperations;
    ArgumentCaptor<Secret> clusterCaCert = ArgumentCaptor.forClass(Secret.class);
    ArgumentCaptor<Secret> clusterCaKey = ArgumentCaptor.forClass(Secret.class);
    ArgumentCaptor<Secret> clientsCaCert = ArgumentCaptor.forClass(Secret.class);
    ArgumentCaptor<Secret> clientsCaKey = ArgumentCaptor.forClass(Secret.class);
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(AbstractModel.clusterCaCertSecretName(NAME)), clusterCaCert.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(AbstractModel.clusterCaKeySecretName(NAME)), clusterCaKey.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(KafkaCluster.clientsCaCertSecretName(NAME)), clientsCaCert.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(KafkaCluster.clientsCaKeySecretName(NAME)), clientsCaKey.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    KafkaAssemblyOperator op = new KafkaAssemblyOperator(vertx, new PlatformFeaturesAvailability(false, KubernetesVersion.V1_16), certManager, passwordGenerator, supplier, ResourceUtils.dummyClusterOperatorConfig(1L));
    Reconciliation reconciliation = new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, NAMESPACE, NAME);
    Checkpoint async = context.checkpoint();
    op.new ReconciliationState(reconciliation, kafka).reconcileCas(() -> new Date()).onComplete(context.succeeding(c -> context.verify(() -> {
        assertThat(clusterCaCert.getAllValues(), hasSize(1));
        assertThat(clusterCaKey.getAllValues(), hasSize(1));
        assertThat(clientsCaCert.getAllValues(), hasSize(1));
        assertThat(clientsCaKey.getAllValues(), hasSize(1));
        Secret clusterCaCertSecret = clusterCaCert.getValue();
        Secret clusterCaKeySecret = clusterCaKey.getValue();
        Secret clientsCaCertSecret = clientsCaCert.getValue();
        Secret clientsCaKeySecret = clientsCaKey.getValue();
        assertThat(clusterCaCertSecret.getMetadata().getOwnerReferences(), hasSize(1));
        assertThat(clusterCaKeySecret.getMetadata().getOwnerReferences(), hasSize(1));
        assertThat(clientsCaCertSecret.getMetadata().getOwnerReferences(), hasSize(0));
        assertThat(clientsCaKeySecret.getMetadata().getOwnerReferences(), hasSize(0));
        assertThat(clusterCaCertSecret.getMetadata().getOwnerReferences().get(0), is(ownerReference));
        assertThat(clusterCaKeySecret.getMetadata().getOwnerReferences().get(0), is(ownerReference));
        async.flag();
    })));
}

Example 8 with CertificateAuthority

use of io.strimzi.api.kafka.model.CertificateAuthority in project strimzi by strimzi.

the class KafkaAssemblyOperatorNonParametrizedTest method testClusterCASecretsWithoutOwnerReference.

@Test
public void testClusterCASecretsWithoutOwnerReference(VertxTestContext context) {
    OwnerReference ownerReference = new OwnerReferenceBuilder().withKind("Kafka").withName(NAME).withBlockOwnerDeletion(false).withController(false).build();
    CertificateAuthority caConfig = new CertificateAuthority();
    caConfig.setGenerateSecretOwnerReference(false);
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(NAME).withNamespace(NAMESPACE).endMetadata().withNewSpec().withNewKafka().withReplicas(3).withNewEphemeralStorage().endEphemeralStorage().endKafka().withClusterCa(caConfig).withNewZookeeper().withReplicas(3).withNewEphemeralStorage().endEphemeralStorage().endZookeeper().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    SecretOperator secretOps = supplier.secretOperations;
    ArgumentCaptor<Secret> clusterCaCert = ArgumentCaptor.forClass(Secret.class);
    ArgumentCaptor<Secret> clusterCaKey = ArgumentCaptor.forClass(Secret.class);
    ArgumentCaptor<Secret> clientsCaCert = ArgumentCaptor.forClass(Secret.class);
    ArgumentCaptor<Secret> clientsCaKey = ArgumentCaptor.forClass(Secret.class);
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(AbstractModel.clusterCaCertSecretName(NAME)), clusterCaCert.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(AbstractModel.clusterCaKeySecretName(NAME)), clusterCaKey.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(KafkaCluster.clientsCaCertSecretName(NAME)), clientsCaCert.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    when(secretOps.reconcile(any(), eq(NAMESPACE), eq(KafkaCluster.clientsCaKeySecretName(NAME)), clientsCaKey.capture())).thenAnswer(i -> Future.succeededFuture(ReconcileResult.created(i.getArgument(0))));
    KafkaAssemblyOperator op = new KafkaAssemblyOperator(vertx, new PlatformFeaturesAvailability(false, KubernetesVersion.V1_16), certManager, passwordGenerator, supplier, ResourceUtils.dummyClusterOperatorConfig(1L));
    Reconciliation reconciliation = new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, NAMESPACE, NAME);
    Checkpoint async = context.checkpoint();
    op.new ReconciliationState(reconciliation, kafka).reconcileCas(() -> new Date()).onComplete(context.succeeding(c -> context.verify(() -> {
        assertThat(clusterCaCert.getAllValues(), hasSize(1));
        assertThat(clusterCaKey.getAllValues(), hasSize(1));
        assertThat(clientsCaCert.getAllValues(), hasSize(1));
        assertThat(clientsCaKey.getAllValues(), hasSize(1));
        Secret clusterCaCertSecret = clusterCaCert.getValue();
        Secret clusterCaKeySecret = clusterCaKey.getValue();
        Secret clientsCaCertSecret = clientsCaCert.getValue();
        Secret clientsCaKeySecret = clientsCaKey.getValue();
        assertThat(clusterCaCertSecret.getMetadata().getOwnerReferences(), hasSize(0));
        assertThat(clusterCaKeySecret.getMetadata().getOwnerReferences(), hasSize(0));
        assertThat(clientsCaCertSecret.getMetadata().getOwnerReferences(), hasSize(1));
        assertThat(clientsCaKeySecret.getMetadata().getOwnerReferences(), hasSize(1));
        assertThat(clientsCaCertSecret.getMetadata().getOwnerReferences().get(0), is(ownerReference));
        assertThat(clientsCaKeySecret.getMetadata().getOwnerReferences().get(0), is(ownerReference));
        async.flag();
    })));
}

Example 9 with CertificateAuthority

use of io.strimzi.api.kafka.model.CertificateAuthority in project strimzi by strimzi.

the class SecurityST method checkClientsCACertRenew.

void checkClientsCACertRenew(ExtensionContext extensionContext, boolean customCA) {
    final String namespaceName = StUtils.getNamespaceBasedOnRbac(namespace, extensionContext);
    final String clusterName = mapWithClusterNames.get(extensionContext.getDisplayName());
    if (customCA) {
        generateAndDeployCustomStrimziCA(namespaceName, clusterName);
        checkCustomCAsCorrectness(namespaceName, clusterName);
        resourceManager.createResource(extensionContext, KafkaTemplates.kafkaEphemeral(clusterName, 3).editOrNewSpec().withNewClientsCa().withRenewalDays(15).withValidityDays(20).withGenerateCertificateAuthority(false).endClientsCa().endSpec().build());
    } else {
        resourceManager.createResource(extensionContext, KafkaTemplates.kafkaEphemeral(clusterName, 3).editOrNewSpec().withNewClientsCa().withRenewalDays(15).withValidityDays(20).endClientsCa().endSpec().build());
    }
    String username = "strimzi-tls-user-" + new Random().nextInt(Integer.MAX_VALUE);
    resourceManager.createResource(extensionContext, KafkaUserTemplates.tlsUser(clusterName, username).build());
    Map<String, String> entityPods = DeploymentUtils.depSnapshot(namespaceName, KafkaResources.entityOperatorDeploymentName(clusterName));
    // Check initial clientsCA validity days
    Secret clientsCASecret = kubeClient(namespaceName).getSecret(namespaceName, KafkaResources.clientsCaCertificateSecretName(clusterName));
    X509Certificate cacert = SecretUtils.getCertificateFromSecret(clientsCASecret, "ca.crt");
    Date initialCertStartTime = cacert.getNotBefore();
    Date initialCertEndTime = cacert.getNotAfter();
    // Check initial kafkauser validity days
    X509Certificate userCert = SecretUtils.getCertificateFromSecret(kubeClient(namespaceName).getSecret(namespaceName, username), "user.crt");
    Date initialKafkaUserCertStartTime = userCert.getNotBefore();
    Date initialKafkaUserCertEndTime = userCert.getNotAfter();
    LOGGER.info("Change of kafka validity and renewal days - reconciliation should start.");
    CertificateAuthority newClientsCA = new CertificateAuthority();
    newClientsCA.setRenewalDays(150);
    newClientsCA.setValidityDays(200);
    if (customCA) {
        newClientsCA.setGenerateCertificateAuthority(false);
    }
    KafkaResource.replaceKafkaResourceInSpecificNamespace(clusterName, k -> k.getSpec().setClientsCa(newClientsCA), namespaceName);
    // Wait for reconciliation and verify certs have been updated
    DeploymentUtils.waitTillDepHasRolled(namespaceName, KafkaResources.entityOperatorDeploymentName(clusterName), 1, entityPods);
    // Read renewed secret/certs again
    clientsCASecret = kubeClient(namespaceName).getSecret(namespaceName, KafkaResources.clientsCaCertificateSecretName(clusterName));
    cacert = SecretUtils.getCertificateFromSecret(clientsCASecret, "ca.crt");
    Date changedCertStartTime = cacert.getNotBefore();
    Date changedCertEndTime = cacert.getNotAfter();
    userCert = SecretUtils.getCertificateFromSecret(kubeClient(namespaceName).getSecret(namespaceName, username), "user.crt");
    Date changedKafkaUserCertStartTime = userCert.getNotBefore();
    Date changedKafkaUserCertEndTime = userCert.getNotAfter();
    LOGGER.info("Initial ClientsCA cert dates: " + initialCertStartTime + " --> " + initialCertEndTime);
    LOGGER.info("Changed ClientsCA cert dates: " + changedCertStartTime + " --> " + changedCertEndTime);
    LOGGER.info("Initial userCert dates: " + initialKafkaUserCertStartTime + " --> " + initialKafkaUserCertEndTime);
    LOGGER.info("Changed userCert dates: " + changedKafkaUserCertStartTime + " --> " + changedKafkaUserCertEndTime);
    if (customCA) {
        assertThat("ClientsCA cert should not have changed.", initialCertEndTime.compareTo(changedCertEndTime) == 0);
    } else {
        String msg = "Error: original cert-end date: '" + initialCertEndTime + "' ends sooner than changed (prolonged) cert date '" + changedCertEndTime + "'";
        assertThat(msg, initialCertEndTime.compareTo(changedCertEndTime) < 0);
    }
    assertThat("UserCert start date has been renewed", initialKafkaUserCertStartTime.compareTo(changedKafkaUserCertStartTime) < 0);
    assertThat("UserCert end date has been renewed", initialKafkaUserCertEndTime.compareTo(changedKafkaUserCertEndTime) < 0);
}

Example 10 with CertificateAuthority

use of io.strimzi.api.kafka.model.CertificateAuthority in project strimzi-kafka-operator by strimzi.

the class CertificateRenewalTest method testCustomCertsNotReconciled.

@Test
public void testCustomCertsNotReconciled(Vertx vertx, VertxTestContext context) throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException {
    CertificateAuthority certificateAuthority = new CertificateAuthorityBuilder().withValidityDays(2).withRenewalDays(3).withGenerateCertificateAuthority(false).build();
    List<Secret> clusterCaSecrets = initialClusterCaSecrets(certificateAuthority);
    Secret initialClusterCaKeySecret = clusterCaSecrets.get(0);
    Secret initialClusterCaCertSecret = clusterCaSecrets.get(1);
    assertThat(initialClusterCaCertSecret.getData().keySet(), is(set(CA_CRT, CA_STORE, CA_STORE_PASSWORD)));
    assertThat(initialClusterCaCertSecret.getData().get(CA_CRT), is(notNullValue()));
    assertThat(initialClusterCaCertSecret.getData().get(CA_STORE), is(notNullValue()));
    assertThat(initialClusterCaCertSecret.getData().get(CA_STORE_PASSWORD), is(notNullValue()));
    assertThat(isCertInTrustStore(CA_CRT, initialClusterCaCertSecret.getData()), is(true));
    assertThat(initialClusterCaKeySecret.getData().keySet(), is(singleton(CA_KEY)));
    assertThat(initialClusterCaKeySecret.getData().get(CA_KEY), is(notNullValue()));
    List<Secret> clientsCaSecrets = initialClientsCaSecrets(certificateAuthority);
    Secret initialClientsCaKeySecret = clientsCaSecrets.get(0);
    Secret initialClientsCaCertSecret = clientsCaSecrets.get(1);
    assertThat(initialClientsCaCertSecret.getData().keySet(), is(set(CA_CRT, CA_STORE, CA_STORE_PASSWORD)));
    assertThat(initialClientsCaCertSecret.getData().get(CA_CRT), is(notNullValue()));
    assertThat(initialClientsCaCertSecret.getData().get(CA_STORE), is(notNullValue()));
    assertThat(initialClientsCaCertSecret.getData().get(CA_STORE_PASSWORD), is(notNullValue()));
    assertThat(isCertInTrustStore(CA_CRT, initialClientsCaCertSecret.getData()), is(true));
    assertThat(initialClientsCaKeySecret.getData().keySet(), is(singleton(CA_KEY)));
    assertThat(initialClientsCaKeySecret.getData().get(CA_KEY), is(notNullValue()));
    secrets.add(initialClusterCaCertSecret);
    secrets.add(initialClusterCaKeySecret);
    secrets.add(initialClientsCaCertSecret);
    secrets.add(initialClientsCaKeySecret);
    Checkpoint async = context.checkpoint();
    reconcileCa(vertx, certificateAuthority, certificateAuthority).onComplete(context.succeeding(c -> context.verify(() -> {
        assertThat(c.getAllValues(), hasSize(0));
        async.flag();
    })));
}