Skip to content

Commit 3ef4831

Browse files
mriccellmriccell
authored
Merge pull request #13 from galiacheng/signed-ca
Add CA certificate to application gateway trusted root certificates
2 parents 4f0849f + 484fd04 commit 3ef4831

File tree

9 files changed

+199
-34
lines changed

9 files changed

+199
-34
lines changed

‎weblogic-azure-aks/src/main/arm/createUiDefinition.json‎

Lines changed: 38 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1095,7 +1095,7 @@
10951095
"type": "Microsoft.Common.TextBlock",
10961096
"visible": "[steps('section_appGateway').appgwIngress.enableAppGateway]",
10971097
"options": {
1098-
"text": "    ⁃ Generate a self-signed certificate: generate a self-signed certificate and apply it during deployment.",
1098+
"text": "    ⁃ Generate a self-signed frontend certificate: generate a self-signed frontend certificate and apply it during deployment.",
10991099
"link": {
11001100
"label": "Learn more",
11011101
"uri": "https://aka.ms/arm-oraclelinux-wls-cluster-app-gateway-key-vault"
@@ -1106,7 +1106,7 @@
11061106
"name": "certificateOption",
11071107
"type": "Microsoft.Common.OptionsGroup",
11081108
"label": "Select desired TLS/SSL certificate option",
1109-
"defaultValue": "Generate a self-signed certificate",
1109+
"defaultValue": "Upload a TLS/SSL certificate",
11101110
"toolTip": "Select desired TLS/SSL certificate option",
11111111
"constraints": {
11121112
"allowedValues": [
@@ -1119,7 +1119,7 @@
11191119
"value": "haveKeyVault"
11201120
},
11211121
{
1122-
"label": "Generate a self-signed certificate",
1122+
"label": "Generate a self-signed frontend certificate",
11231123
"value": "generateCert"
11241124
}
11251125
],
@@ -1130,7 +1130,7 @@
11301130
{
11311131
"name": "keyVaultSSLCertData",
11321132
"type": "Microsoft.Common.FileUpload",
1133-
"label": "TLS/SSL certificate(.pfx)",
1133+
"label": "Frontend TLS/SSL certificate(.pfx)",
11341134
"toolTip": "TLS/SSL certificate used for App Gateway",
11351135
"constraints": {
11361136
"required": true,
@@ -1150,7 +1150,7 @@
11501150
"password": "Password",
11511151
"confirmPassword": "Confirm password"
11521152
},
1153-
"toolTip": "TLS/SSL certificate password",
1153+
"toolTip": "Frontend TLS/SSL certificate password",
11541154
"constraints": {
11551155
"required": "[equals(steps('section_appGateway').appgwIngress.certificateOption, 'haveCert')]",
11561156
"regex": "^((?=.*[0-9])(?=.*[a-z])|(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])|(?=.*[0-9])(?=.*[a-z])(?=.*[!@#$%^&*])|(?=.*[0-9])(?=.*[A-Z])(?=.*[!@#$%^&*])|(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%^&*])).{6,128}$",
@@ -1161,6 +1161,22 @@
11611161
},
11621162
"visible": "[equals(steps('section_appGateway').appgwIngress.certificateOption, 'haveCert')]"
11631163
},
1164+
{
1165+
"name": "keyVaultBackendSSLCertData",
1166+
"type": "Microsoft.Common.FileUpload",
1167+
"label": "Trusted root certificate(.cer, cert)",
1168+
"toolTip": "Trusted root certificate (CA certificate) used to set up end to end TLS/SSL",
1169+
"constraints": {
1170+
"required": true,
1171+
"accept": ".cer, cert"
1172+
},
1173+
"options": {
1174+
"multiple": false,
1175+
"uploadMode": "file",
1176+
"openMode": "binary"
1177+
},
1178+
"visible": "[and(steps('section_appGateway').appgwIngress.enableAppGateway, steps('section_sslConfiguration').enableCustomSSL, not(equals(steps('section_appGateway').appgwIngress.certificateOption, 'haveKeyVault')))]"
1179+
},
11641180
{
11651181
"name": "keyVaultResourceGroup",
11661182
"type": "Microsoft.Common.TextBox",
@@ -1190,7 +1206,7 @@
11901206
{
11911207
"name": "keyVaultSSLCertDataSecretName",
11921208
"type": "Microsoft.Common.TextBox",
1193-
"label": "The name of the secret in the specified Key Vault whose value is the TLS/SSL certificate data",
1209+
"label": "The name of the secret in the specified Key Vault whose value is the frontend TLS/SSL certificate data",
11941210
"defaultValue": "",
11951211
"toolTip": "Use only letters and numbers",
11961212
"constraints": {
@@ -1203,7 +1219,7 @@
12031219
{
12041220
"name": "keyVaultSSLCertPasswordSecretName",
12051221
"type": "Microsoft.Common.TextBox",
1206-
"label": "The name of the secret in the specified Key Vault whose value is the password for the TLS/SSL certificate",
1222+
"label": "The name of the secret in the specified Key Vault whose value is the password for the frontend TLS/SSL certificate",
12071223
"defaultValue": "",
12081224
"toolTip": "Use only letters and numbers",
12091225
"constraints": {
@@ -1213,6 +1229,19 @@
12131229
},
12141230
"visible": "[equals(steps('section_appGateway').appgwIngress.certificateOption, 'haveKeyVault')]"
12151231
},
1232+
{
1233+
"name": "keyVaultBackendSSLCertDataSecretName",
1234+
"type": "Microsoft.Common.TextBox",
1235+
"label": "The name of the secret in the specified Key Vault whose value is the trusted root certificate data",
1236+
"defaultValue": "",
1237+
"toolTip": "Use only letters and numbers",
1238+
"constraints": {
1239+
"required": true,
1240+
"regex": "^[a-z0-9A-Z]{1,30}$",
1241+
"validationMessage": "The value must be 1-30 characters long and must only contain letters and numbers."
1242+
},
1243+
"visible": "[and(steps('section_sslConfiguration').enableCustomSSL, equals(steps('section_appGateway').appgwIngress.certificateOption, 'haveKeyVault'))]"
1244+
},
12161245
{
12171246
"name": "servicePrincipal",
12181247
"type": "Microsoft.Common.PasswordBox",
@@ -1533,6 +1562,7 @@
15331562
"aksClusterName": "[last(split(steps('section_aks').clusterInfo.aksClusterSelector.id, '/'))]",
15341563
"aksClusterRGName": "[last(take(split(steps('section_aks').clusterInfo.aksClusterSelector.id, '/'), 5))]",
15351564
"appGatewayCertificateOption": "[steps('section_appGateway').appgwIngress.certificateOption]",
1565+
"appGatewaySSLBackendRootCertData": "[steps('section_appGateway').appgwIngress.keyVaultBackendSSLCertData]",
15361566
"appGatewaySSLCertData": "[steps('section_appGateway').appgwIngress.keyVaultSSLCertData]",
15371567
"appGatewaySSLCertPassword": "[steps('section_appGateway').appgwIngress.appGatewaySSLCertPassword]",
15381568
"appgwForAdminServer": "[steps('section_appGateway').appgwIngress.appgwForAdminServer]",
@@ -1563,6 +1593,7 @@
15631593
"location": "[location()]",
15641594
"keyVaultName": "[steps('section_appGateway').appgwIngress.keyVaultName]",
15651595
"keyVaultResourceGroup": "[steps('section_appGateway').appgwIngress.keyVaultResourceGroup]",
1596+
"keyVaultSSLBackendRootCertDataSecretName": "[steps('section_appGateway').appgwIngress.keyVaultBackendSSLCertDataSecretName]",
15661597
"keyVaultSSLCertDataSecretName": "[steps('section_appGateway').appgwIngress.keyVaultSSLCertDataSecretName]",
15671598
"keyVaultSSLCertPasswordSecretName": "[steps('section_appGateway').appgwIngress.keyVaultSSLCertPasswordSecretName]",
15681599
"managedServerPrefix": "[basics('basicsOptional').managedServerPrefix]",

‎weblogic-azure-aks/src/main/arm/scripts/setupNetworking.sh‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -905,16 +905,12 @@ function create_appgw_ingress() {
905905

906906

907907
if [[ "${enableCustomSSL,,}" == "true" ]];then
908-
# create backend tls secret
909-
rootcertPath=${scriptDir}/root.cert
910-
kubectl cp -n ${wlsDomainNS} ${wlsDomainUID}-${adminServerName}:${appgwBackendCertPath} ${rootcertPath}
911-
validate_status "Copy public key from fileshare."
912-
913-
az network application-gateway root-cert create \
914-
--gateway-name $appgwName \
908+
az network application-gateway root-cert list \
909+
--gateway-name $appgwName \
915910
--resource-group $curRGName \
916-
--name ${appgwBackendSecretName} \
917-
--cert-file ${rootcertPath}
911+
| jq '.[] | .name' | grep "${appgwBackendSecretName}"
912+
913+
validate_status "check if backend cert exists."
918914
fi
919915

920916
# generate ingress svc config for cluster
@@ -1002,7 +998,6 @@ export sharedPath="/shared"
1002998
export svcAdminServer="${wlsDomainUID}-${adminServerName}"
1003999
export svcCluster="${wlsDomainUID}-cluster-${clusterName}"
10041000
export wlsDomainNS="${wlsDomainUID}-ns"
1005-
export appgwBackendCertPath="${sharedPath}/security/root.cert"
10061001

10071002
read_sensitive_parameters_from_stdin
10081003

‎weblogic-azure-aks/src/main/arm/scripts/setupWLSDomain.sh‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -427,20 +427,12 @@ function output_ssl_keystore() {
427427
else
428428
rm -f ${mntPath}/$wlsIdentityKeyStoreFileName
429429
rm -f ${mntPath}/$wlsTrustKeyStoreFileName
430-
rm -f ${mntPath}/${wlsIdentityRootCertFileName}
431430
rm -f ${mntPath}/${wlsTrustKeyStoreJKSFileName}
432431
fi
433432

434433
#decode cert data once again as it would got base64 encoded
435434
echo "$wlsIdentityData" | base64 -d >${mntPath}/$wlsIdentityKeyStoreFileName
436435
echo "$wlsTrustData" | base64 -d >${mntPath}/$wlsTrustKeyStoreFileName
437-
# export root cert. Used as gateway backend certificate
438-
${JAVA_HOME}/bin/keytool -export \
439-
-alias ${wlsIdentityAlias} \
440-
-noprompt \
441-
-file ${mntPath}/${wlsIdentityRootCertFileName} \
442-
-keystore ${mntPath}/$wlsIdentityKeyStoreFileName \
443-
-storepass ${wlsIdentityPsw}
444436

445437
# export jks file
446438
# -Dweblogic.security.SSL.trustedCAKeyStorePassPhrase for PKCS12 is not working correctly
@@ -744,7 +736,6 @@ export wlsOptVersion="3.2.5"
744736
export wlsIdentityKeyStoreFileName="security/identity.keystore"
745737
export wlsTrustKeyStoreFileName="security/trust.keystore"
746738
export wlsTrustKeyStoreJKSFileName="security/trust.jks"
747-
export wlsIdentityRootCertFileName="security/root.cert"
748739

749740
read_sensitive_parameters_from_stdin
750741

‎weblogic-azure-aks/src/main/arm/scripts/uploadAppGatewayTrutedRootCert.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Copyright (c) 2021, Oracle Corporation and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
# This script runs on Azure Container Instance with Alpine Linux that Azure Deployment script creates.
4+
5+
# upload trusted root certificate to Azure Application Gateway
6+
# $1: resource group name
7+
# $2: Application Gateway name
8+
# $3: one line based64 string of the certificate data
9+
10+
# The value is used in setupNetworking.sh, please do not change it.
11+
export appgwBackendSecretName='backend-tls'
12+
13+
echo "output certificate data to backend-cert.cer"
14+
echo "$3" | base64 -d >backend-cert.cer
15+
16+
az network application-gateway root-cert create \
17+
--gateway-name $2 \
18+
--resource-group $1 \
19+
--name ${appgwBackendSecretName} \
20+
--cert-file backend-cert.cer
21+
22+
if [ $? -ne 0 ]; then
23+
echo "Failed to upload trusted root certificate to Application Gateway ${2}"
24+
exit 1
25+
fi

‎weblogic-azure-aks/src/main/bicep/mainTemplate.bicep‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ param aksVersion string = 'default'
5353
param appGatewayCertificateOption string = 'haveCert'
5454
@description('Public IP Name for the Application Gateway')
5555
param appGatewayPublicIPAddressName string = 'gwip'
56+
@description('The one-line, base64 string of the backend SSL root certificate data.')
57+
param appGatewaySSLBackendRootCertData string = 'appgw-ssl-backend-data'
5658
@description('The one-line, base64 string of the SSL certificate data.')
5759
param appGatewaySSLCertData string = 'appgw-ssl-data'
5860
@secure()
@@ -120,6 +122,8 @@ param keyVaultName string = 'kv-contoso'
120122
param keyVaultResourceGroup string = 'kv-contoso-rg'
121123
@description('Price tier for Key Vault.')
122124
param keyVaultSku string = 'Standard'
125+
@description('The name of the secret in the specified KeyVault whose value is the SSL Root Certificate Data for Appliation Gateway backend TLS/SSL.')
126+
param keyVaultSSLBackendRootCertDataSecretName string = 'kv-ssl-backend-data'
123127
@description('The name of the secret in the specified KeyVault whose value is the SSL Certificate Data for Appliation Gateway frontend TLS/SSL.')
124128
param keyVaultSSLCertDataSecretName string = 'kv-ssl-data'
125129
@description('The name of the secret in the specified KeyVault whose value is the password for the SSL Certificate of Appliation Gateway frontend TLS/SSL')
@@ -421,11 +425,13 @@ module wlsDomainWithCustomSSLDeployment 'modules/setupWebLogicCluster.bicep' = i
421425
]
422426
}
423427

424-
module appgwSecretDeployment 'modules/_azure-resoruces/_keyvaultAdapter.bicep' = if (enableAppGWIngress && (appGatewayCertificateOption != const_appGatewaySSLCertOptionHaveKeyVault)) {
428+
module appgwSecretDeployment 'modules/_azure-resoruces/_keyvaultForGateway.bicep' = if (enableAppGWIngress && (appGatewayCertificateOption != const_appGatewaySSLCertOptionHaveKeyVault)) {
425429
name: 'appgateway-certificates-secrets-deployment'
426430
params: {
431+
backendCertificateDataValue: appGatewaySSLBackendRootCertData
427432
certificateDataValue: appGatewaySSLCertData
428433
certificatePasswordValue: appGatewaySSLCertPassword
434+
enableCustomSSL: enableCustomSSL
429435
identity: identity
430436
sku: keyVaultSku
431437
subjectName: format('CN={0}', enableDNSConfiguration ? format('{0}.{1}', dnsNameforApplicationGateway, dnszoneName) : const_azureSubjectName)
@@ -482,6 +488,7 @@ module networkingDeployment 'modules/networking.bicep' = if (const_enableNetwork
482488
identity: identity
483489
keyVaultName: (!enableAppGWIngress || (appGatewayCertificateOption == const_appGatewaySSLCertOptionHaveKeyVault)) ? keyVaultName : appgwSecretDeployment.outputs.keyVaultName
484490
keyVaultResourceGroup: (!enableAppGWIngress || (appGatewayCertificateOption == const_appGatewaySSLCertOptionHaveKeyVault)) ? keyVaultResourceGroup : resourceGroup().name
491+
keyvaultBackendCertDataSecretName: (!enableAppGWIngress || (appGatewayCertificateOption == const_appGatewaySSLCertOptionHaveKeyVault)) ? keyVaultSSLBackendRootCertDataSecretName : appgwSecretDeployment.outputs.sslBackendCertDataSecretName
485492
keyVaultSSLCertDataSecretName: (!enableAppGWIngress || (appGatewayCertificateOption == const_appGatewaySSLCertOptionHaveKeyVault)) ? keyVaultSSLCertDataSecretName : appgwSecretDeployment.outputs.sslCertDataSecretName
486493
keyVaultSSLCertPasswordSecretName: (!enableAppGWIngress || (appGatewayCertificateOption == const_appGatewaySSLCertOptionHaveKeyVault)) ? keyVaultSSLCertPasswordSecretName : appgwSecretDeployment.outputs.sslCertPwdSecretName
487494
location: location

‎weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvault/_keyvaultForGatewayBackendCert.bicep‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Copyright (c) 2021, Oracle Corporation and/or its affiliates.
2+
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
4+
@description('Secret name of certificate data.')
5+
param certificateDataName string
6+
7+
@description('Certificate data to store in the secret')
8+
param certificateDataValue string
9+
10+
@description('Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.')
11+
param enabledForTemplateDeployment bool = true
12+
13+
@description('Name of the vault')
14+
param keyVaultName string
15+
16+
@description('Price tier for Key Vault.')
17+
param sku string
18+
19+
param utcValue string = utcNow()
20+
21+
resource keyvault 'Microsoft.KeyVault/vaults@2019-09-01' = {
22+
name: keyVaultName
23+
location: resourceGroup().location
24+
properties: {
25+
enabledForTemplateDeployment: enabledForTemplateDeployment
26+
sku: {
27+
name: sku
28+
family: 'A'
29+
}
30+
accessPolicies: []
31+
tenantId: subscription().tenantId
32+
}
33+
tags:{
34+
'managed-by-azure-weblogic': utcValue
35+
}
36+
}
37+
38+
resource secretForCertificate 'Microsoft.KeyVault/vaults/secrets@2019-09-01' = {
39+
name: '${keyVaultName}/${certificateDataName}'
40+
properties: {
41+
value: certificateDataValue
42+
}
43+
dependsOn: [
44+
keyvault
45+
]
46+
}
47+
48+
output keyVaultName string = keyVaultName
49+
output sslBackendCertDataSecretName string = certificateDataName

‎weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvaultAdapter.bicep‎ renamed to ‎weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvaultForGateway.bicep‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,18 @@
22
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
33
// Deploy Application Gateway certificate secrets.
44

5+
@description('Backend certificate data to store in the secret')
6+
param backendCertificateDataValue string
7+
58
@description('Certificate data to store in the secret')
69
param certificateDataValue string
710

811
@description('Certificate password to store in the secret')
912
param certificatePasswordValue string
1013

14+
@description('true to upload trusted root certificate')
15+
param enableCustomSSL bool = false
16+
1117
@description('Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.')
1218
param enabledForTemplateDeployment bool = true
1319

@@ -33,6 +39,7 @@ param useExistingAppGatewaySSLCertificate bool = false
3339
@description('Current deployment time. Used as a tag in deployment script.')
3440
param keyVaultName string = 'GEN_UNIQUE'
3541

42+
var name_sslBackendCertSercretName= 'myAppGatewaySSLBackendRootCert'
3643
var name_sslCertSecretName = 'myAppGatewaySSLCert'
3744
var name_sslCertPasswordSecretName = 'myAppGatewaySSLCertPassword'
3845

@@ -60,6 +67,19 @@ module keyVaultwithExistingAppGatewaySSLCert '_keyvault/_keyvaultWithExistingCer
6067
}
6168
}
6269

70+
module keyvaultBackendRootCert '_keyvault/_keyvaultForGatewayBackendCert.bicep' = if (enableCustomSSL) {
71+
name: 'kv-appgw-e2e-ssl-backend-certificate'
72+
params:{
73+
certificateDataName: name_sslBackendCertSercretName
74+
certificateDataValue: backendCertificateDataValue
75+
enabledForTemplateDeployment: enabledForTemplateDeployment
76+
keyVaultName: keyVaultName
77+
sku: sku
78+
}
79+
}
80+
6381
output keyVaultName string = (useExistingAppGatewaySSLCertificate ? keyVaultwithExistingAppGatewaySSLCert.outputs.keyVaultName : keyVaultwithSelfSignedAppGatewaySSLCert.outputs.keyVaultName)
6482
output sslCertDataSecretName string = (useExistingAppGatewaySSLCertificate ? keyVaultwithExistingAppGatewaySSLCert.outputs.sslCertDataSecretName : keyVaultwithSelfSignedAppGatewaySSLCert.outputs.secretName)
6583
output sslCertPwdSecretName string = (useExistingAppGatewaySSLCertificate ? keyVaultwithExistingAppGatewaySSLCert.outputs.sslCertPwdSecretName: '')
84+
output sslBackendCertDataSecretName string = (enableCustomSSL) ? keyvaultBackendRootCert.outputs.sslBackendCertDataSecretName : ''
85+

0 commit comments

Comments
 (0)