Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ENHANCEMENT] Add a custom trust store to Console #1850

Open
1 task
hamza-m-masood opened this issue May 23, 2024 · 5 comments · May be fixed by #2505
Open
1 task

[ENHANCEMENT] Add a custom trust store to Console #1850

hamza-m-masood opened this issue May 23, 2024 · 5 comments · May be fixed by #2505
Assignees
Labels
kind/enhancement New feature or request

Comments

@hamza-m-masood
Copy link
Contributor

hamza-m-masood commented May 23, 2024

Describe the use case:

Research and implement adding a trust store to Console. For example, a use-case for this feature would be to add self-signed certificates to Console.
Research is required since Console is not a Java application. It is made with Vue and javascript. The same functionality can't be replicated from other Java apps.
Related slack thread: https://camunda.slack.com/archives/C03UR0V2R2M/p1716362967508299

Describe the enhancement/feature:

Currently in other applications, it is possible to add a custom trust store through the use of the JAVA_TOOL_OPTIONS env var. Here is an excerpt from the optimize deployment template:

env:
  - name: JAVA_TOOL_OPTIONS
     value: -Djavax.net.ssl.trustStore=/optimize/certificates/externaldb.jks
volumeMounts:
  - name: keystore
     mountPath: /optimize/certificates/externaldb.jks
     subPath: externaldb.jks
volumes:
   - name: keystore
      secret:
      secretName: {{ .Values.global.elasticsearch.tls.existingSecret }}
      optional: false

It would be ideal to have a dedicated folder to store the file with the trust store. Just like there are dedicated folders in other Java based applications.

Desired outcome and acceptance tests:

  • Research how a trust store can be created in a nodejs based application
  • Have a dedicated folder where the file with the custom trust store can be mounted through a volume as a secret and referenced through an env var.
  • Create unit test(s) to make sure the file exists when it is referenced through the values.yaml

Tasks

  1. component/console
    hamza-m-masood
@hamza-m-masood
Copy link
Contributor Author

Please let me know if I have missed anything @theburi

@hamza-m-masood hamza-m-masood added kind/medic Tasks for the medic and removed kind/support labels May 30, 2024
@kam-uddin
Copy link

To workaround the issue, the user can set the environment variable NODE_EXTRA_CA_CERTS to the path of the root cert. This approach is already used by Identity here. This worked for a customer in SUPPORT-22029

@hamza-m-masood
Copy link
Contributor Author

hamza-m-masood commented Oct 24, 2024

I can add a console.tls.existingSecret value in the values.yaml and then use the existingSecret as a volume in the console component. The keys in the secret will be the filename, and the value of the key in the secret will be the content fo the cert file. For the NODE_EXTRA_CA_CERTS env var, I just reference the volumeMount.

@hamza-m-masood
Copy link
Contributor Author

i have asked some questions to console team to gain more insight: https://camunda.slack.com/archives/CKZK2E7RP/p1729760739706979

@hamza-m-masood
Copy link
Contributor Author

hamza-m-masood commented Oct 24, 2024

From talking to the console team, it seems like it is not possible to reference a folder of certificates in a single env var. So instead, I will introduce another value that also exists in the bitnami charts: certKeyFilename
This will reference the specific file in the certs folder

@hamza-m-masood hamza-m-masood self-assigned this Oct 24, 2024
@hamza-m-masood hamza-m-masood removed the kind/medic Tasks for the medic label Oct 24, 2024
@hamza-m-masood hamza-m-masood linked a pull request Oct 24, 2024 that will close this issue
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants