-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[PLAT-12732] toggle tls and cert rotation v2 apis
Summary: implement toggling of node to node and client to node encryption, along with rotating certs for both encryptions. Test Plan: new unit test Reviewers: sneelakantan, #yba-api-review Reviewed By: sneelakantan, #yba-api-review Subscribers: yugaware Differential Revision: https://phorge.dev.yugabyte.com/D36486
- Loading branch information
Showing
14 changed files
with
627 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
managed/src/main/java/api/v2/mappers/UniverseCertsRotateParamsMapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| package api.v2.mappers; | ||
|
|
||
| import api.v2.models.UniverseCertRotateSpec; | ||
| import com.yugabyte.yw.forms.CertsRotateParams; | ||
| import com.yugabyte.yw.forms.SoftwareUpgradeParams; | ||
| import org.mapstruct.Mapper; | ||
| import org.mapstruct.Mapping; | ||
| import org.mapstruct.MappingTarget; | ||
| import org.mapstruct.factory.Mappers; | ||
|
|
||
| @Mapper(config = CentralConfig.class) | ||
| public interface UniverseCertsRotateParamsMapper { | ||
| UniverseCertsRotateParamsMapper INSTANCE = | ||
| Mappers.getMapper(UniverseCertsRotateParamsMapper.class); | ||
|
|
||
| @Mapping(target = "upgradeOption", source = "source") | ||
| @Mapping(target = "rootAndClientRootCASame", source = "source") | ||
| @Mapping(target = "sleepAfterTServerRestartMillis", source = "sleepAfterTserverRestartMillis") | ||
| @Mapping(target = "rootCA", source = "rootCa") | ||
| @Mapping(target = "clientRootCA", source = "clientRootCa") | ||
| CertsRotateParams copyToV1CertsRotateParams( | ||
| UniverseCertRotateSpec source, @MappingTarget CertsRotateParams target); | ||
|
|
||
| default SoftwareUpgradeParams.UpgradeOption mapUpgradeOption(UniverseCertRotateSpec source) { | ||
| return source.getRollingUpgrade() | ||
| ? SoftwareUpgradeParams.UpgradeOption.ROLLING_UPGRADE | ||
| : SoftwareUpgradeParams.UpgradeOption.NON_ROLLING_UPGRADE; | ||
| } | ||
|
|
||
| default boolean mapRootAndClientRootCASame(UniverseCertRotateSpec spec) { | ||
| if (spec.getRootCa() == null) { | ||
| return false; | ||
| } | ||
| return spec.getRootCa().equals(spec.getClientRootCa()); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38 changes: 38 additions & 0 deletions
38
managed/src/main/java/api/v2/mappers/UniverseTlsToggleParamsMapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package api.v2.mappers; | ||
|
|
||
| import api.v2.models.UniverseEditEncryptionInTransit; | ||
| import com.yugabyte.yw.forms.SoftwareUpgradeParams; | ||
| import com.yugabyte.yw.forms.TlsToggleParams; | ||
| import org.mapstruct.Mapper; | ||
| import org.mapstruct.Mapping; | ||
| import org.mapstruct.MappingTarget; | ||
| import org.mapstruct.factory.Mappers; | ||
|
|
||
| @Mapper(config = CentralConfig.class) | ||
| public interface UniverseTlsToggleParamsMapper { | ||
| UniverseTlsToggleParamsMapper INSTANCE = Mappers.getMapper(UniverseTlsToggleParamsMapper.class); | ||
|
|
||
| @Mapping(target = "upgradeOption", source = "source") | ||
| @Mapping(target = "rootAndClientRootCASame", source = "source") | ||
| @Mapping(target = "enableNodeToNodeEncrypt", source = "nodeToNode") | ||
| @Mapping(target = "enableClientToNodeEncrypt", source = "clientToNode") | ||
| @Mapping(target = "sleepAfterTServerRestartMillis", source = "sleepAfterTserverRestartMillis") | ||
| @Mapping(target = "rootCA", source = "rootCa") | ||
| @Mapping(target = "clientRootCA", source = "clientRootCa") | ||
| TlsToggleParams copyToV1TlsToggleParams( | ||
| UniverseEditEncryptionInTransit source, @MappingTarget TlsToggleParams target); | ||
|
|
||
| default SoftwareUpgradeParams.UpgradeOption mapUpgradeOption( | ||
| UniverseEditEncryptionInTransit source) { | ||
| return source.getRollingUpgrade() | ||
| ? SoftwareUpgradeParams.UpgradeOption.ROLLING_UPGRADE | ||
| : SoftwareUpgradeParams.UpgradeOption.NON_ROLLING_UPGRADE; | ||
| } | ||
|
|
||
| default boolean mapRootAndClientRootCASame(UniverseEditEncryptionInTransit spec) { | ||
| if (spec.getRootCa() == null) { | ||
| return false; | ||
| } | ||
| return spec.getRootCa().equals(spec.getClientRootCa()); | ||
| } | ||
| } |
5 changes: 5 additions & 0 deletions
5
managed/src/main/resources/openapi/components/requestBodies/UniverseCertRotateReq.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| required: true | ||
| content: | ||
| application/json: | ||
| schema: | ||
| $ref: "../schemas/UniverseCertRotateSpec.yaml" |
5 changes: 5 additions & 0 deletions
5
...d/src/main/resources/openapi/components/requestBodies/UniverseEncryptionInTransitReq.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| required: true | ||
| content: | ||
| application/json: | ||
| schema: | ||
| $ref: "../schemas/UniverseEditEncryptionInTransit.yaml" |
22 changes: 22 additions & 0 deletions
22
managed/src/main/resources/openapi/components/schemas/UniverseCertRotateSpec.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| title: UniverseCertRotateSpec | ||
| description: | | ||
| UniverseCertRotateSpec | ||
| Request payload to rotate the certs used for encryption | ||
| in transit. Part of UniverseCertRotateReq. | ||
| type: object | ||
| allOf: | ||
| - $ref: "./SleepAfterRestartSchema.yaml" | ||
| - $ref: "./UniverseUpgradeOptionRolling.yaml" | ||
| - type: object | ||
| properties: | ||
| self_signed_server_cert_rotate: | ||
| type: boolean | ||
| self_signed_client_cert_rotate: | ||
| type: boolean | ||
| root_ca: | ||
| type: string | ||
| format: uuid | ||
| client_root_ca: | ||
| type: string | ||
| format: uuid |
27 changes: 27 additions & 0 deletions
27
managed/src/main/resources/openapi/components/schemas/UniverseEditEncryptionInTransit.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| title: UniverseEditEncryptionInTransit | ||
| description: | | ||
| UniverseEditEncryptionInTransit | ||
| Request Payload to enable or disable encryption in transit. Encryption in transit can be | ||
| toggled for either node to node traffic or node to client traffic. Part of | ||
| UniverseEncryptionInTransitReq | ||
| type: object | ||
| allOf: | ||
| - $ref: "./SleepAfterRestartSchema.yaml" | ||
| - $ref: "./UniverseUpgradeOptionRolling.yaml" | ||
| - type: object | ||
| properties: | ||
| node_to_node: | ||
| description: Control encryption in transit between YugabyteDB nodes | ||
| type: boolean | ||
| client_to_node: | ||
| description: Control encryption in transit between YugabyteDB nodes and clients | ||
| type: boolean | ||
| root_ca: | ||
| description: Root CA cert for node to node encryption. Required if node_to_node is true | ||
| type: string | ||
| format: uuid | ||
| client_root_ca: | ||
| description: Root CA used for node to client encryption. Required if client_to_node is true | ||
| type: string | ||
| format: uuid |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.