DRAFT - This page contains information about the default certs in A1 Policy Management Service and how to update/replace them using Docker and Kubernetes.

General

The A1 Policy Management Service and , the Enrichment Information Coordinator Service and the DMaap Adapter has a default keystores and truststores that are built into the containers. The paths and passwords for these stores are located in a yaml file:
            config/application.yaml

...

By default, trust validation is not enabled (which means that a peer with any cert can connect/be connected to the components).

A1 Policy Management Service, configuration of SSL in Kubernetes

The keystore and truststore can be configured in Kubernetes.  In the source code repository, the default files are located.  Updating this in a running cluster can be done in more than one way, but this is probably the simplest.
First you need to create a directory with three files.

config/
  application.yaml
  keystore.jks
  truststore.jks

The default application.yaml can be taken from the source code repository or by using command "kubectl describe configmap policymanagementservice-configmap -n nonrtric"
Then you need to create the keystore.jks and (if used, this is not used by default) a truststore.jks .
There is a README file in the source code repository that describes how the default keystore and truststore are created. This involves creating a CA cert used for signing.

...

The three files file be placed in the configuration directory for the service. A POD restart is needed for the changes to take effect.

Enrichment Coordinator Service, configuration of SSL in Kubernetes

Configuration of the SSL for the ECS is done in the same was as for the A1 Policy Management Service (see above). There are two differences:

...

kubectl create configmap  enrichmentservice-configmap --from-file=./config --dry-run=client -n nonrtric -o yaml | kubectl apply -f -

DMaaP Adapter Service, configuration of SSL in Kubernetes

Configuration of the SSL is done in the same was as for the A1 Policy Management Service and the ECS  (see above). There are two differences:

1. The name of the config map is dmaapadapterservice-configmap-config.
2. The file paths for the config directory for this component (where the config map is mounted) is /opt/app/enrichment-coordinator-service/config.
   

So the application.yaml paths will then be:

trust-store: /opt/app/dmaap-adaptor-service/config/truststore.jks
key-store:/opt/app/dmaap-adaptor-service/config/keystore.jks 

The command for updating the config map is:

kubectl create configmap  dmaapadapterservice-configmap-config --from-file=./config --dry-run=client -n nonrtric -o yaml | kubectl apply -f -

A1 Policy Management Service, configuration of SSL in Docker

The default keystore, truststore, and application.yaml files can be overridden by mounting new files using the "volumes" field of docker-compose or docker run command.

...