WIFI-1319: Updating charts to add TLS related properties in ssl.properties.

Since these are only relevant to microK8s environment, we only enable them in it.

tip-wlan/charts/nginx-ingress-controller/templates/controller-configmap.yaml

@@ -7,4 +7,5 @@ metadata:
     {{- include "common.labels" . | nindent 4 }}
 data:
     external-status-address: {{ .Values.controller.config.externalStatusAddress }}
-    client-max-body-size: {{ .Values.controller.config.clientMaxBodySize }}
+    client-max-body-size: {{ .Values.controller.config.clientMaxBodySize }}
+    error-log-level: {{ .Values.controller.config.errorLogLevel }}

tip-wlan/charts/nginx-ingress-controller/values.yaml

@@ -56,6 +56,8 @@ controller:
     ## Max message size coming from the Client
     clientMaxBodySize: "20m"
 
+    ## Error 
+    errorLogLevel: "error"
   ## It is recommended to use your own TLS certificates and keys
   defaultTLS:
     ## The base64-encoded TLS certificate for the default HTTPS server. If not specified, a pre-generated self-signed certificate is used.

tip-wlan/charts/wlan-portal-service/resources/config/logback.xml

@@ -7,7 +7,7 @@
 <!-- For professional support please see                            -->
 <!--    http://www.qos.ch/shop/products/professionalSupport         -->
 <!--                                                                -->
-<configuration>
+<configuration scan="true" scanPeriod="30 seconds">
   <conversionRule conversionWord="filteredStack"
                   converterClass="com.telecominfraproject.wlan.server.exceptions.logback.ExceptionCompressingConverter" />
 

tip-wlan/charts/wlan-portal-service/templates/secret.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.disableTLSv13.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "common.fullname" . }}-ssl-config
+  namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+  ssl.properties: |-
+    {{ (.Files.Glob "resources/certs/ssl.properties").AsSecrets | indent 4 }}
+    sslEnabledProtocols=TLSv1.2,TLSv1.1,TLSv1
+    sslCiphers=TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+{{- end }}

tip-wlan/charts/wlan-portal-service/templates/statefulset.yaml

@@ -113,9 +113,12 @@ spec:
           - mountPath: /opt/tip-wlan/certs/server.pkcs12
             name: certificates
             subPath: server.pkcs12
-          - mountPath: /app/portal/logback.xml
+          - mountPath: /app/portal/log
             name: logback-config
-            subPath: logback.xml
+          {{- if .Values.disableTLSv13.enabled }}
+          - mountPath: /app/portal/certs
+            name: ssl-config
+          {{- end }}
           - mountPath: {{ $file_store_path }}
             name: file-store-data
           {{- include "jmxPrometheus.configVolumeMount" . | nindent 10 }}
@@ -155,6 +158,11 @@ spec:
       - name: logback-config
         configMap:
             name: {{ include "common.fullname" . }}-log-config
+      {{- if .Values.disableTLSv13.enabled }}
+      - name: ssl-config
+        secret:
+          secretName: {{ include "common.fullname" . }}-ssl-config
+      {{- end }}
       {{- if not .Values.persistence.enabled }}
       - name: file-store-data
         emptyDir: {}

tip-wlan/charts/wlan-portal-service/values.yaml

@@ -153,3 +153,6 @@ env:
 # on the PV
 filestore:
   internal: "/tmp/filestore"
+
+disableTLSv13:
+  enabled: false

tip-wlan/charts/wlan-prov-service/values.yaml

@@ -128,7 +128,7 @@ affinity: {}
 
 postgresql:
   url: postgresql
-  image: postgres:latest
+  image: postgres:11
 
 env:
   protocol: https

tip-wlan/example-values/microk8s-basic/values.yaml

@@ -31,6 +31,8 @@ wlan-cloud-graphql-gw:
   enabled: true
   env:
     portalsvc: tip-wlan-wlan-portal-service:9051
+  service:
+    type: ClusterIP
   ingress:
     hosts:
       - host: wlan-ui-graphql.wlan.local
@@ -45,8 +47,6 @@ wlan-cloud-static-portal:
   enabled: true
   env:
     graphql: https://wlan-ui-graphql.wlan.local
-  service:
-    type: NodePort
   ingress:
     hosts:
       - host: wlan-ui.wlan.local
@@ -67,6 +67,8 @@ wlan-portal-service:
     type: LoadBalancer
     annotations:
       metallb.universe.tf/allow-shared-ip: default
+  disableTLSv13:
+    enabled: true
 
 wlan-prov-service:
   enabled: true