feat: Add security-bootstrap-redis service #334

andresrinivasan · 2020-10-23T17:15:31Z

Signed-off-by: André Srinivasan [email protected]

PR Checklist

Please check if your PR fulfills the following requirements:

Tests for the changes have been added (for bug fixes / features)
Docs have been added / updated (for bug fixes / features)

If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/developer-scripts/blob/master/.github/Contributing.md.

What is the current behavior?

Issue Number:

Resolves #332

What is the new behavior?

Add new security-bootstrap-redis service

Does this PR introduce a breaking change?

Yes
No

This PR is dependent on actually adding the service to edgex-go. See edgex-go issue #2503

Specific Instructions

Other information

I'm creating this PR for the purposes of review. Please do not merge yet.

releases/nightly-build/compose-files/docker-compose-nexus-arm64.yml

releases/nightly-build/compose-files/source/docker-compose-nexus-add-security.yml

bnevis-i

Every database-consuming service needs to take a dependency on security-bootstrap-database. This new dependency needs to be added into add-security.yml. Otherwise there is no forcing function by any downstream service to ensure that the bootstrap is run.

bnevis-i · 2020-10-26T23:32:59Z

P.S. I've gotten into using git commit --fixup 572e5274509c0a81320af52d6ca236e946dfca4d -s -S so that when the time comes I can do a git rebase -i --autosquash without then having to go fixup the commit message.

lenny-goodell · 2020-10-26T18:35:07Z

releases/nightly-build/compose-files/docker-compose-nexus-dev.yml

@@ -0,0 +1,552 @@
+#  * Copyright 2020 Intel Corporation.


Did you mean to added the file to the PR?

Apologies. Removed and added this file to .gitignore.

lenny-goodell · 2020-10-27T00:03:47Z

Every database-consuming service needs to take a dependency on security-bootstrap-database. This new dependency needs to be added into add-security.yml. Otherwise there is no forcing function by any downstream service to ensure that the bootstrap is run.

@bnevis-i , good catch!

andresrinivasan · 2020-10-27T06:34:46Z

Latest push addresses issues raised in comments.

lenny-goodell

Looks good, but can not merge until edgex-go PR merged and image for service is being produced in nexus.

andresrinivasan · 2020-10-27T17:03:34Z

Squashed

lenny-goodell · 2020-10-27T20:38:33Z

@andresrinivasan, My compose-builder refactoring PR has been merged. Please rebase yours.

lenny-goodell · 2020-10-27T22:19:12Z

compose-builder/add-security.yml

  database:
-    env_file:
-      - database-security.env
-    command: |
-      /bin/sh -c "
-      until [ -r $${REDIS5_PASSWORD_PATHNAME} ] && [ -s $${REDIS5_PASSWORD_PATHNAME} ]; do sleep 1; done
-      exec /usr/local/bin/docker-entrypoint.sh --requirepass `cat $${REDIS5_PASSWORD_PATHNAME}` \
-        --dir /data \
-        --save 900 1 \
-        --save 300 10 \
-        --save 60 10000
-      "
-    volumes:
-      - /tmp/edgex/secrets/edgex-redis:/tmp/edgex/secrets/edgex-redis:z
    depends_on:
      - vault-worker


Do we need this database section at all. Only thin left is the depends_on which doesn't seem to be needed.

Agree with lenny. redis-bootstrap needs to depend on database and vault-worker. This can go.

lenny-goodell · 2020-10-27T22:21:51Z

@andresrinivasan , one more rebase needed for my pin versions PR. Last one for me for a bit.... ;-)

lenny-goodell

Looks good, but can't merge until docker image is being created in Nexus.

compose-builder/add-security.yml

lenny-goodell · 2020-10-29T01:06:52Z

@andresrinivasan , you also need to add the SECRETSTORE_TOKENFILE: /tmp/edgex/secrets/edgex-security-bootstrap-redis/secrets-token.json env override. I have tested that this with the name changes (see slack) all works.

andresrinivasan · 2020-10-29T01:46:47Z

@andresrinivasan , you also need to add the SECRETSTORE_TOKENFILE: /tmp/edgex/secrets/edgex-security-bootstrap-redis/secrets-token.json env override. I have tested that this with the name changes (see slack) all works.

Done

lenny-goodell · 2020-10-29T16:01:38Z

compose-builder/add-security.yml

@@ -68,11 +68,9 @@ services:
      - security-secrets-setup

  security-secrets-setup:
-    image: ${CORE_EDGEX_REPOSITORY}/docker-edgex-secrets-setup-go${ARCH}:${CORE_EDGEX_VERSION}${DEV}
+    image: ${CORE_EDGEX_REPOSITORY}/docker-secrets-setup-go${ARCH}:${CORE_EDGEX_VERSION}${DEV}


Almost, but missing security in the name. Needs to be docker-security-secrets-setup-go

lenny-goodell

Please run make build on your latest changes.

releases/nightly-build/compose-files/docker-compose-nexus-arm64.yml

lenny-goodell · 2020-10-29T18:45:02Z

compose-builder/add-security.yml

@@ -196,7 +215,7 @@ services:
      - kong-migrations

  edgex-proxy:
-    image: ${CORE_EDGEX_REPOSITORY}/docker-edgex-security-proxy-setup-go${ARCH}:${CORE_EDGEX_VERSION}${DEV}
+    image: ${CORE_EDGEX_REPOSITORY}/docker-security-security-proxy-setup-go${ARCH}:${CORE_EDGEX_VERSION}${DEV}


Wrong name. Extra security. Change to docker-security-proxy-setup-go

Signed-off-by: André Srinivasan <[email protected]>

fixed

lenny-goodell suggested changes Oct 23, 2020

View reviewed changes

releases/nightly-build/compose-files/docker-compose-nexus-arm64.yml Outdated Show resolved Hide resolved

releases/nightly-build/compose-files/source/docker-compose-nexus-add-security.yml Outdated Show resolved Hide resolved

bnevis-i previously requested changes Oct 26, 2020

View reviewed changes

lenny-goodell reviewed Oct 27, 2020

View reviewed changes

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from fe1c964 to 97cf0b8 Compare October 27, 2020 17:03

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from 97cf0b8 to 8cf134d Compare October 27, 2020 22:00

lenny-goodell suggested changes Oct 27, 2020

View reviewed changes

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from 8cf134d to 66591ae Compare October 27, 2020 22:39

lenny-goodell reviewed Oct 27, 2020

View reviewed changes

lenny-goodell reviewed Oct 28, 2020

View reviewed changes

compose-builder/add-security.yml Outdated Show resolved Hide resolved

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from 76ed8b6 to 75998a5 Compare October 29, 2020 01:40

lenny-goodell reviewed Oct 29, 2020

View reviewed changes

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from 75998a5 to 0af12d2 Compare October 29, 2020 16:14

lenny-goodell approved these changes Oct 29, 2020

View reviewed changes

lenny-goodell suggested changes Oct 29, 2020

View reviewed changes

releases/nightly-build/compose-files/docker-compose-nexus-arm64.yml Outdated Show resolved Hide resolved

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from 0af12d2 to 98b7d27 Compare October 29, 2020 17:46

lenny-goodell suggested changes Oct 29, 2020

View reviewed changes

feat(security): Add security-redis-bootstrap service

dda617f

Signed-off-by: André Srinivasan <[email protected]>

andresrinivasan force-pushed the issue-332-add-security-bootstrap-service branch from 98b7d27 to dda617f Compare October 29, 2020 19:22

lenny-goodell approved these changes Oct 29, 2020

View reviewed changes

lenny-goodell merged commit 5674044 into edgexfoundry:master Oct 29, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add security-bootstrap-redis service #334

feat: Add security-bootstrap-redis service #334

andresrinivasan commented Oct 23, 2020

bnevis-i left a comment

bnevis-i commented Oct 26, 2020

lenny-goodell Oct 26, 2020

andresrinivasan Oct 27, 2020

lenny-goodell commented Oct 27, 2020

andresrinivasan commented Oct 27, 2020

lenny-goodell left a comment

andresrinivasan commented Oct 27, 2020

lenny-goodell commented Oct 27, 2020

lenny-goodell Oct 27, 2020

bnevis-i Oct 27, 2020

andresrinivasan Oct 27, 2020

lenny-goodell commented Oct 27, 2020

lenny-goodell left a comment

lenny-goodell commented Oct 29, 2020

andresrinivasan commented Oct 29, 2020

lenny-goodell Oct 29, 2020

andresrinivasan Oct 29, 2020

lenny-goodell left a comment •

edited

Loading

lenny-goodell Oct 29, 2020

andresrinivasan Oct 29, 2020

feat: Add security-bootstrap-redis service #334

feat: Add security-bootstrap-redis service #334

Conversation

andresrinivasan commented Oct 23, 2020

PR Checklist

What is the current behavior?

Issue Number:

What is the new behavior?

Does this PR introduce a breaking change?

Specific Instructions

Other information

bnevis-i left a comment

Choose a reason for hiding this comment

bnevis-i commented Oct 26, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lenny-goodell commented Oct 27, 2020

andresrinivasan commented Oct 27, 2020

lenny-goodell left a comment

Choose a reason for hiding this comment

andresrinivasan commented Oct 27, 2020

lenny-goodell commented Oct 27, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lenny-goodell commented Oct 27, 2020

lenny-goodell left a comment

Choose a reason for hiding this comment

lenny-goodell commented Oct 29, 2020

andresrinivasan commented Oct 29, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lenny-goodell left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lenny-goodell left a comment •

edited

Loading