smolnar82 commented on code in PR #1197:
URL: https://github.com/apache/knox/pull/1197#discussion_r3086266845
##########
gateway-docker/src/main/resources/docker/gateway-entrypoint.sh:
##########
@@ -187,45 +188,35 @@ then
importMultipleCerts "$CUSTOM_CERT"
fi
-# Add Amazon Root CA 1
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-1 \
- -file /home/knox/cacrts/AmazonRootCA1.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add Amazon Root CA 2
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-2 \
- -file /home/knox/cacrts/AmazonRootCA2.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add Amazon Root CA 3
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-3 \
- -file /home/knox/cacrts/AmazonRootCA3.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add Amazon Root CA 4
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-4 \
- -file /home/knox/cacrts/AmazonRootCA4.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add letsencrypt staging root CA
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias letsencrypt-stg-root \
- -file /home/knox/cacrts/letsencrypt-stg-root-x1.pem \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
+# This default was set to emulate the existing behaviour
+# Customer should be able to override this by specifying this via Docker
environment settings
+if [[ -z ${TRUSTSTORE_IMPORTS} ]]
+then
+ TRUSTSTORE_IMPORTS="
+ amazon-ca-1:/home/knox/cacrts/AmazonRootCA1.cer
+ amazon-ca-2:/home/knox/cacrts/AmazonRootCA2.cer
+ amazon-ca-3:/home/knox/cacrts/AmazonRootCA3.cer
+ amazon-ca-4:/home/knox/cacrts/AmazonRootCA4.cer
+ letsencrypt-stg-root:/home/knox/cacrts/letsencrypt-stg-root-x1.pem"
+fi
+
+for certinfo in ${TRUSTSTORE_IMPORTS}
Review Comment:
I might be wrong, but the new logic mimic what we had before: adding the
Amazon and Lets
Encrypt certificates to `${KEYSTORE_DIR}"/truststore.jks`. Nothing more,
nothing less.
The only difference is that you can now overide that with your own certs if
you want. But the change - IMO - is fully backward compatible and preserves the
previous behavior.
##########
gateway-docker/src/main/resources/docker/gateway-entrypoint.sh:
##########
@@ -187,45 +188,35 @@ then
importMultipleCerts "$CUSTOM_CERT"
fi
-# Add Amazon Root CA 1
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-1 \
- -file /home/knox/cacrts/AmazonRootCA1.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add Amazon Root CA 2
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-2 \
- -file /home/knox/cacrts/AmazonRootCA2.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add Amazon Root CA 3
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-3 \
- -file /home/knox/cacrts/AmazonRootCA3.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add Amazon Root CA 4
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias amazon-ca-4 \
- -file /home/knox/cacrts/AmazonRootCA4.cer \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
-
-# Add letsencrypt staging root CA
-/usr/bin/keytool -importcert \
- -keystore "${KEYSTORE_DIR}"/truststore.jks \
- -alias letsencrypt-stg-root \
- -file /home/knox/cacrts/letsencrypt-stg-root-x1.pem \
- -storepass "${ALIAS_PASSPHRASE}" \
- -noprompt || true
+# This default was set to emulate the existing behaviour
+# Customer should be able to override this by specifying this via Docker
environment settings
+if [[ -z ${TRUSTSTORE_IMPORTS} ]]
+then
+ TRUSTSTORE_IMPORTS="
+ amazon-ca-1:/home/knox/cacrts/AmazonRootCA1.cer
+ amazon-ca-2:/home/knox/cacrts/AmazonRootCA2.cer
+ amazon-ca-3:/home/knox/cacrts/AmazonRootCA3.cer
+ amazon-ca-4:/home/knox/cacrts/AmazonRootCA4.cer
+ letsencrypt-stg-root:/home/knox/cacrts/letsencrypt-stg-root-x1.pem"
+fi
+
+for certinfo in ${TRUSTSTORE_IMPORTS}
Review Comment:
I might be wrong, but the new logic mimics what we had before: adding the
Amazon and Lets
Encrypt certificates to `${KEYSTORE_DIR}"/truststore.jks`. Nothing more,
nothing less.
The only difference is that you can now overide that with your own certs if
you want. But the change - IMO - is fully backward compatible and preserves the
previous behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
