2a8d2638b3
This patch set implements the PKICatalog [0] requirements as well as PeglegManagedDocument [1] generation requirements outlined in the spec [2]. Included in this patch set: * New CLI entry point called "pegleg site secrets generate-pki" * PeglegManagedDocument generation logic in engine.cache.managed_document * Refactored PKICatalog logic in engine.cache.pki_catalog derived from the Promenade PKI implementation [3], responsible for generating certificates, CAs, and keypairs * Refactored PKIGenerator logic in engine.cache.pki_generator derived from Promenade Generator implementation [4], responsible for reading in pegleg/PKICatalog/v1 documents (as well as promenade/PKICatalog/v1 documents for backwards compatibility) and generating required secrets and storing them into the paths specified under [0] * Unit tests for all of the above [5] * Example pki-catalog.yaml document under pegleg/site_yamls * Validation schema for pki-catalog.yaml (TODO: implement validation logic here: [6]) * Updates to CLI documentation and inclusion of PKICatalog and PeglegManagedDocument documentation * Documentation updates with PKI information [7] TODO (in follow-up patch sets): * Expand on overview documentation to include new Pegleg responsibilities * Allow the original repository (not the copied one) to be the destination where the secrets are written to * Finish up cert expiry/revocation logic [0] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html#document-generation [1] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html#peglegmanageddocument [2] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html [3] https://github.com/openstack/airship-promenade/blob/master/promenade/pki.py [4] https://github.com/openstack/airship-promenade/blob/master/promenade/generator.py [5] https://review.openstack.org/#/c/611739/ [6] https://review.openstack.org/#/c/608159/ [7] https://review.openstack.org/#/c/611738/ Change-Id: I3010d04cac6d22c656d144f0dafeaa5e19a13068
23 lines
868 B
Docker
23 lines
868 B
Docker
ARG FROM=python:3.6
|
|
FROM ${FROM}
|
|
ARG CFSSLURL=https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
|
|
|
|
LABEL org.opencontainers.image.authors='airship-discuss@lists.airshipit.org, irc://#airshipit@freenode'
|
|
LABEL org.opencontainers.image.url='https://airshipit.org'
|
|
LABEL org.opencontainers.image.documentation='https://airship-pegleg.readthedocs.org'
|
|
LABEL org.opencontainers.image.source='https://git.openstack.org/openstack/airship-pegleg'
|
|
LABEL org.opencontainers.image.vendor='The Airship Authors'
|
|
LABEL org.opencontainers.image.licenses='Apache-2.0'
|
|
|
|
VOLUME /var/pegleg
|
|
WORKDIR /var/pegleg
|
|
|
|
COPY requirements.txt /opt/pegleg/requirements.txt
|
|
RUN pip3 install --no-cache-dir -r /opt/pegleg/requirements.txt
|
|
|
|
COPY tools/install-cfssl.sh /opt/pegleg/tools/install-cfssl.sh
|
|
RUN /opt/pegleg/tools/install-cfssl.sh ${CFSSLURL}
|
|
|
|
COPY . /opt/pegleg
|
|
RUN pip3 install -e /opt/pegleg
|