[yugabyte] certificates management

.gitignore

@@ -64,6 +64,8 @@ build/cockroachdb.yaml
 build/values.yaml
 build/dss.yaml
 
+deploy/operations/certificates-management/workspace/
+
 temp
 
 # Django stuff:
@@ -131,4 +133,4 @@ go
 .vscode
 
 # terraform
-.terraform*
+.terraform*

deploy/operations/certificates-management/README.md

@@ -0,0 +1,131 @@
+# Certificates management
+
+## Introduction
+
+The `dss-certs.py` helps you manage the set of certificates used for your DSS deployment.
+
+Should this DSS beeing part of a pool, the script also provide some helpers to manage the set of CA certificates in the pool.
+
+To run the script, just run `./dss-certs.py`. The python script don't require any dependencies, just a recent version of python 3.
+
+## Quick start guide
+
+### Single DSS instance in minikube`
+
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default init`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default apply`
+
+### Pool of 3 DSS instances in minikube, in namespace `default`, `ns2` and `ns3`
+
+* Creation of the 3 DSS instances certificates
+* `./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace default init`
+* `./dss-certs.py --name dss-instance-2 --cluster-context dss-local-cluster --namespace ns2 init`
+* `./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace ns3 init`
+* Copy instance 2 and 3 CA certificates to the instance 1
+* `./dss-certs.py --name dss-instance-2 --cluster-context dss-local-cluster --namespace ns2 get-ca | ./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace default add-pool-ca`
+* `./dss-certs.py --name dss-instance-3 --cluster-context dss-local-cluster --namespace ns3 get-ca | ./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace default add-pool-ca`
+* Reuse instance compiled 1 CA and copy it to instance 2 and 3.
+* `./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace default get-pool-ca | ./dss-certs.py --name dss-instance-2 --cluster-context dss-local-cluster --namespace ns2 add-pool-ca`
+* `./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace default get-pool-ca | ./dss-certs.py --name dss-instance-3 --cluster-context dss-local-cluster --namespace ns3 add-pool-ca`
+* Application of certificates in respective clusters
+* `./dss-certs.py --name dss-instance-1 --cluster-context dss-local-cluster --namespace default apply`
+* `./dss-certs.py --name dss-instance-2 --cluster-context dss-local-cluster --namespace ns2 apply`
+* `./dss-certs.py --name dss-instance-3 --cluster-context dss-local-cluster --namespace ns3 apply`
+
+## Operations
+
+### Common parameters
+
+#### `--name`
+
+The name of your DSS instance, that should identify it in a unique way. Used as main identifier for the set of certificates and in certificates.
+
+Example: `dss-west-1`
+
+#### `--organization`
+
+The name of the organization managing the DSS Instance. Used in certificates generation. The combination of (name, organization) shall be unique in a cluster.
+
+Example: `Interuss`
+
+#### `--cluster-context`
+
+The kubernetes context the script should use.
+
+Example: `dss-local-cluster`
+
+#### `--namespace`
+
+The kubernetes namespace to use.
+
+Example: `default`
+
+#### `--nodes-count`
+
+The number of yugabyte nodes of your DSS instance. Default to `3`.
+
+### `init`
+
+Initializes the certificates for a new DSS instance including a CA, a client certificate and a certificate for each yugabyte node.
+
+### `apply`
+
+Apply the current set of certificates to the kubernetes cluster. Shall be ran after each modification of the certificates, like addition / removal of CA in the pool, new `nodes-count` parameter.
+
+### `regenerate-nodes`
+
+Generate missing nodes certificates. Useful if you want to add new nodes in your DSS Instance. Don't forget to set the `nodes-count` parameters.
+
+### `add-pool-ca`
+
+Add a CA certificate(s) of another(s) DSS Instance to the set of trusted certificates.
+Existing certificates are not added again.
+
+You can set the file with certificate(s) with `--ca-file` or use stdin.
+
+Don't forget to use the `apply` command to update certificate on your kubernetes cluster.
+
+Examples:
+
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default add-pool-ca < /tmp/new-dss-ca`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default --ca-file /tmp/new-dss-ca add-pool-ca`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default get-pool-ca | ./dss-certs.py --name test2 --cluster-context dss-local-cluster --namespace namespace2 add-pool-ca`
+
+### `remove-pool-ca`
+
+Remove CA certificate(s) of DSS Instance(s) from the set of trusted certificates.
+Unknown certificates are not removed again.
+
+You can set the file with certificate(s) with `--ca-file`, use stdin or use `--ca-serial` to specify the serial / name of the certificate you want to remove.
+
+Don't forget to use the `apply` command to update certificate on your kubernetes cluster.
+
+Example:
+
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default remove-pool-ca < /tmp/old-dss-ca`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default --ca-file /tmp/old-dss-ca remove-pool-ca`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default remove-pool-ca --ca-serial="SN=830ECFB0, O=generic-dss-organization, CN=CA.test"`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default remove-pool-ca --ca-serial="830ECFB0`
+* `./dss-certs.py --name test --cluster-context dss-local-cluster --namespace default remove-pool-ca --ca-serial="46548B7CC9699A7CFA54FF8FA85A619E830ECFB0`
+
+### `list-pool-ca`
+
+List the set of accepted CA certificates.
+
+Also display a 'hash' of CA serial, that you may use to compare other DSS Instances list of CA certificates easily.
+
+### `get-pool-ca`
+
+Return all CA certificate in the current pool.
+
+Can be used for debugging or to synchronize the set of CA certificates in a pool with others USS.
+
+### `get-ca`
+
+Return your own CA certificate .
+
+Display the compiled CA certificate. Can be used for debugging or to synchronize the set of CA certificates in a pool with others USS.
+
+### `destroy`
+
+Destroy a certificate set. Be careful, there are no way to undo the command.

deploy/operations/certificates-management/apply.py

@@ -0,0 +1,51 @@
+import subprocess
+import os
+
+import logging
+l = logging.getLogger(__name__)
+
+def do_apply(cluster):
+
+    l.debug("Applying kubernetes configuration")
+
+    l.debug(f"Creating namespace {cluster.namespace}")
+
+    try:
+        subprocess.check_call(
+            ["kubectl", "create", "namespace", cluster.namespace, "--context", cluster.cluster_context],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+
+        l.info(f"Created namespace {cluster.namespace}")
+
+    except subprocess.CalledProcessError:  # We do assume everything else works
+        l.debug(f"Namespace {cluster.namespace} already exists")
+
+    for secret_name in ["yb-master-yugabyte-tls-cert", "yb-tserver-yugabyte-tls-cert", "yugabyte-tls-client-cert", "dss.public.certs"]:
+
+        try:
+            subprocess.check_call(
+                ["kubectl", "delete", "secret", secret_name, "--namespace", cluster.namespace, "--context", cluster.cluster_context],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+
+            l.info(f"Deleted old secret '{secret_name}'")
+
+        except subprocess.CalledProcessError:  # We do assume everything else works
+            l.debug(f"Secret '{secret_name}' not present on the cluster")
+
+    for secret_name, folder in [
+        ("yb-master-yugabyte-tls-cert", cluster.master_certs_dir),
+        ("yb-tserver-yugabyte-tls-cert", cluster.tserver_certs_dir),
+        ("yugabyte-tls-client-cert", cluster.client_certs_dir),
+        ("dss.public.certs", os.path.join("..", "..", "..", "build", "jwt-public-certs")),
+    ]:
+
+        subprocess.check_call(
+            ["kubectl", "create", "secret", "generic", secret_name, "--namespace", cluster.namespace, "--context", cluster.cluster_context, "--from-file", folder],
+            stdout=subprocess.DEVNULL,
+        )
+
+        l.info(f"Created secret '{secret_name}'")

deploy/operations/certificates-management/ca_pool.py

@@ -0,0 +1,145 @@
+import base64
+import hashlib
+import logging
+import os
+import re
+import shutil
+import tempfile
+
+from utils import get_cert_display_name, get_cert_serial
+
+l = logging.getLogger(__name__)
+
+
+def build_pool_hash(cluster):
+
+    CAs = []
+    for f in os.listdir(cluster.ca_pool_dir):
+
+        if f.endswith(".crt") and f != "ca.crt":
+            CAs.append(f.lower())
+
+    CAs = sorted(CAs)
+
+    h = hashlib.sha256()
+    h.update((",".join(CAs)).encode("utf-8"))
+
+    # Create an hash without special chars (replaced by 'Aa')
+    hashed = base64.b64encode(h.digest(), b"Aa").decode("utf-8")
+
+    return f"{hashed[:5]}-{hashed[-10:-5]}"
+
+
+def add_cas(cluster, certificate):
+
+    folder = cluster.ca_pool_dir
+
+    l.debug("Getting new CA metadata")
+
+    with tempfile.NamedTemporaryFile(delete_on_close=False) as tf:
+        tf.write(certificate.encode("utf-8"))
+        tf.close()
+
+        serial = get_cert_serial(tf.name)
+        name = get_cert_display_name(tf.name)
+
+        filename = f"{serial}.crt"
+
+        target_file = os.path.join(folder, filename)
+
+        if os.path.exists(target_file):
+            l.info(f"CA {name} already present in the pool")
+            return
+
+        l.info(f"Adding CA {name} in the pool")
+
+        with open(target_file, "w") as f:
+            f.write(certificate)
+
+
+def regenerate_ca_files(cluster):
+
+    l.debug("Regenerating CA files from all CA in the pool")
+
+    CAs = []
+    for filename in os.listdir(cluster.ca_pool_dir):
+
+        if filename.endswith(".crt") and filename != "ca.crt":
+            with open(os.path.join(cluster.ca_pool_dir, filename), "r") as f:
+                CAs.append(f.read())
+
+    CAs = sorted(CAs)
+
+    with open(cluster.ca_pool_ca, "w") as f:
+        f.write("\n\n".join(CAs))
+
+    shutil.copy(cluster.ca_pool_ca, cluster.client_ca)
+
+    for node_type in ["master", "tserver"]:
+        shutil.copy(cluster.ca_pool_ca, getattr(cluster, f"{node_type}_ca"))
+
+    h = build_pool_hash(cluster)
+
+    l.info(f"Regenerated CA files from the CA pool. Current pool hash: {h}")
+
+
+def do_add_cas(cluster, certificates):
+    pattern = re.compile(
+        r"-----BEGIN CERTIFICATE-----\s*.+?\s*-----END CERTIFICATE-----", re.DOTALL
+    )
+    for cert in pattern.findall(certificates):
+        add_cas(cluster, cert)
+
+    regenerate_ca_files(cluster)
+
+
+def do_remove_cas(cluster, certificates_or_serial):
+    pattern = re.compile(
+        r"-----BEGIN CERTIFICATE-----\s*.+?\s*-----END CERTIFICATE-----", re.DOTALL
+    )
+    for cert in pattern.findall(certificates_or_serial):
+        with tempfile.NamedTemporaryFile(delete_on_close=False) as tf:
+            tf.write(cert.encode("utf-8"))
+            tf.close()
+            serial = get_cert_serial(tf.name)
+            name = get_cert_display_name(tf.name)
+
+            filename = f"{serial}.crt"
+
+            target = os.path.join(cluster.ca_pool_dir, filename)
+
+            if os.path.isfile(target):
+                os.unlink(target)
+                l.info(f"Removed certificate {name}")
+            else:
+                l.info(f"Certificate {name} not present in pool")
+
+    for filename in sorted(os.listdir(cluster.ca_pool_dir)):
+        if filename.endswith(".crt") and filename != "ca.crt":
+
+            serial = get_cert_serial(os.path.join(cluster.ca_pool_dir, filename))
+            name = get_cert_display_name(os.path.join(cluster.ca_pool_dir, filename))
+
+            if certificates_or_serial == name or certificates_or_serial == serial or f"SN={certificates_or_serial}, " in name or name.startswith(certificates_or_serial):
+                os.unlink(os.path.join(cluster.ca_pool_dir, filename))
+                l.info(f"Removed certificate {name}")
+
+    regenerate_ca_files(cluster)
+
+def do_get_ca(cluster):
+    with open(cluster.ca_cert_file, "r") as f:
+        print(f.read())
+
+def do_get_pool_ca(cluster):
+    with open(cluster.ca_pool_ca, "r") as f:
+        print(f.read())
+
+def do_list_pool_ca(cluster):
+
+    h = build_pool_hash(cluster)
+
+    print(f"Current CA pool hash: {h}")
+
+    for filename in sorted(os.listdir(cluster.ca_pool_dir)):
+        if filename.endswith(".crt") and filename != "ca.crt":
+            print(get_cert_display_name(os.path.join(cluster.ca_pool_dir, filename)))