OSFUSE-867: end-to-end TLS using re-encryption termination

jboss-fuse · May 24, 2018 · 9c22d65 · 9c22d65
1 parent 1f413c4
commit 9c22d65
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 10 deletions.
diff --git a/fis-console-cluster-template.json b/fis-console-cluster-template.json
@@ -91,7 +91,7 @@
           },
           "tls": {
             "insecureEdgeTerminationPolicy": "Redirect",
-            "termination": "edge"
+            "termination": "reencrypt"
           }
         }
       },
@@ -105,12 +105,15 @@
             "group": "console",
             "app": "${APP_NAME}",
             "version": "${APP_VERSION}"
+          },
+          "annotations": {
+            "service.alpha.openshift.io/serving-cert-secret-name": "${APP_NAME}-tls"
           }
         },
         "spec": {
           "ports": [
             {
-            "port": 80,
+            "port": 443,
             "protocol": "TCP",
             "targetPort": "nginx"
             }
@@ -192,21 +195,23 @@
                   "readinessProbe" : {
                     "httpGet" : {
                       "path" : "/online",
-                      "port" : "nginx"
+                      "port" : "nginx",
+                      "scheme": "HTTPS"
                     },
                     "initialDelaySeconds" : 5
                   },
                   "livenessProbe" : {
                     "httpGet" : {
                       "path" : "/online",
-                      "port" : "nginx"
+                      "port" : "nginx",
+                      "scheme": "HTTPS"
                     },
                     "initialDelaySeconds" : 10,
                     "periodSeconds": 10
                   },
                   "ports": [
                     {
-                      "containerPort": 8080,
+                      "containerPort": 8443,
                       "name": "nginx"
                     }
                   ],
@@ -220,6 +225,12 @@
                       "value": "${APP_NAME}-oauth-client"
                     }
                   ],
+                  "volumeMounts": [
+                    {
+                      "mountPath": "/etc/tls/private",
+                      "name": "${APP_NAME}-tls"
+                    }
+                  ],
                   "resources": {
                     "requests": {
                       "cpu": "${CPU_REQUEST}",
@@ -231,6 +242,14 @@
                     }
                   }
                 }
+              ],
+              "volumes": [
+                {
+                  "name": "${APP_NAME}-tls",
+                  "secret": {
+                    "secretName": "${APP_NAME}-tls"
+                  }
+                }
               ]
             }
           }

diff --git a/fis-console-namespace-template.json b/fis-console-namespace-template.json
@@ -90,7 +90,7 @@
           },
           "tls": {
             "insecureEdgeTerminationPolicy": "Redirect",
-            "termination": "edge"
+            "termination": "reencrypt"
           }
         }
       },
@@ -104,12 +104,15 @@
             "group": "console",
             "app": "${APP_NAME}",
             "version": "${APP_VERSION}"
+          },
+          "annotations": {
+            "service.alpha.openshift.io/serving-cert-secret-name": "${APP_NAME}-tls"
           }
         },
         "spec": {
           "ports": [
             {
-            "port": 80,
+            "port": 443,
             "protocol": "TCP",
             "targetPort": "nginx"
             }
@@ -198,21 +201,23 @@
                   "readinessProbe" : {
                     "httpGet" : {
                       "path" : "/online",
-                      "port" : "nginx"
+                      "port" : "nginx",
+                      "scheme": "HTTPS"
                     },
                     "initialDelaySeconds" : 5
                   },
                   "livenessProbe" : {
                     "httpGet" : {
                       "path" : "/online",
-                      "port" : "nginx"
+                      "port" : "nginx",
+                      "scheme": "HTTPS"
                     },
                     "initialDelaySeconds" : 10,
                     "periodSeconds": 10
                   },
                   "ports": [
                     {
-                      "containerPort": 8080,
+                      "containerPort": 8443,
                       "name": "nginx"
                     }
                   ],
@@ -234,6 +239,12 @@
                       "value": "${APP_NAME}-service-account"
                     }
                   ],
+                  "volumeMounts": [
+                    {
+                      "mountPath": "/etc/tls/private",
+                      "name": "${APP_NAME}-tls"
+                    }
+                  ],
                   "resources": {
                     "requests": {
                       "cpu": "${CPU_REQUEST}",
@@ -245,6 +256,14 @@
                     }
                   }
                 }
+              ],
+              "volumes": [
+                {
+                  "name": "${APP_NAME}-tls",
+                  "secret": {
+                    "secretName": "${APP_NAME}-tls"
+                  }
+                }
               ]
             }
           }