Enable mTLS configuration on all HTTP servers

.tool-versions

@@ -6,7 +6,7 @@ concourse 7.11.0
 direnv 2.32.3
 gcloud 454.0.0
 ginkgo 2.13.0
-golang 1.21.4
+golang 1.20.6
 golangci-lint 1.55.2
 java temurin-17.0.9+9
 make 4.4

jobs/eventgenerator/spec

@@ -8,6 +8,9 @@ templates:
   eventgenerator_ca.crt.erb: config/certs/eventgenerator/ca.crt
   eventgenerator_server.crt.erb: config/certs/eventgenerator/server.crt
   eventgenerator_server.key.erb: config/certs/eventgenerator/server.key
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
   metricscollector_ca.crt.erb: config/certs/metricscollector/ca.crt
   metricscollector_client.crt.erb: config/certs/metricscollector/client.crt
   metricscollector_client.key.erb: config/certs/metricscollector/client.key
@@ -227,6 +230,13 @@ properties:
   autoscaler.eventgenerator.health.port:
     description: "the listening port of health endpoint"
     default: 6204
+  autoscaler.eventgenerator.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.eventgenerator.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.eventgenerator.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
+
   autoscaler.eventgenerator.health.username:
     description: "the username for the health endpoint"
     default: ''

jobs/eventgenerator/templates/eventgenerator.yml.erb

@@ -76,6 +76,13 @@ health:
   port: <%= p("autoscaler.eventgenerator.health.port") %>
   username: <%= p("autoscaler.eventgenerator.health.username") %>
   password: <%= p("autoscaler.eventgenerator.health.password") %>
+  <% if_p("autoscaler.eventgenerator.health.ca_cert", "autoscaler.eventgenerator.health.server_cert", "autoscaler.eventgenerator.health.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/eventgenerator/config/certs/healthendpoint/ca.crt
+    cert_file: /var/vcap/jobs/eventgenerator/config/certs/healthendpoint/server.crt
+    key_file: /var/vcap/jobs/eventgenerator/config/certs/healthendpoint/server.key
+  <% end %>
+
 db:
   policy_db:
     url: <%= policy_db_url %>

jobs/eventgenerator/templates/healthendpoint.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.eventgenerator.health.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/eventgenerator/templates/healthendpoint.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.eventgenerator.health.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/eventgenerator/templates/healthendpoint_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.eventgenerator.health.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/golangapiserver/spec

@@ -12,6 +12,9 @@ templates:
   brokerserver_ca.crt.erb: config/certs/brokerserver/ca.crt
   brokerserver.crt.erb: config/certs/brokerserver/server.crt
   brokerserver.key.erb: config/certs/brokerserver/server.key
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
   scalingengine_ca.crt.erb: config/certs/scalingengine/ca.crt
   scalingengine_client.crt.erb: config/certs/scalingengine/client.crt
   scalingengine_client.key.erb: config/certs/scalingengine/client.key
@@ -78,6 +81,12 @@ properties:
     description: "PEM-encoded server key"
   autoscaler.apiserver.health.port:
     default: 1080
+  autoscaler.apiserver.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.apiserver.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.apiserver.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
   autoscaler.apiserver.use_buildin_mode:
     default: true
     description: ""

jobs/golangapiserver/templates/apiserver.yml.erb

@@ -96,6 +96,12 @@ use_buildin_mode: <%= p("autoscaler.apiserver.use_buildin_mode") %>
 
 health:
   port: <%= p("autoscaler.apiserver.health.port") %>
+  <% if_p("autoscaler.apiserver.health.ca_cert", "autoscaler.apiserver.health.server_cert", "autoscaler.apiserver.health.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/golangapiserver/config/certs/healthendpoint/ca.crt
+    cert_file: /var/vcap/jobs/golangapiserver/config/certs/healthendpoint/server.crt
+    key_file: /var/vcap/jobs/golangapiserver/config/certs/healthendpoint/server.key
+  <% end %>
 
 db:
   policy_db:

jobs/golangapiserver/templates/healthendpoint.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.apiserver.health.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/golangapiserver/templates/healthendpoint.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.apiserver.health.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/golangapiserver/templates/healthendpoint_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.apiserver.health.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsforwarder/spec

@@ -4,6 +4,14 @@ templates:
   bpm.yml.erb: config/bpm.yml
   metricsforwarder.yml.erb: config/metricsforwarder.yml
 
+  metricsforwarder_ca.crt.erb: config/certs/metricsforwarder/ca.crt
+  metricsforwarder_server.crt.erb: config/certs/metricsforwarder/server.crt
+  metricsforwarder_server.key.erb: config/certs/metricsforwarder/server.key
+
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
+
   metron_client_ca.crt.erb: config/certs/metron_client/ca.crt
   metron_client.crt.erb: config/certs/metron_client/client.crt
   metron_client.key.erb: config/certs/metron_client/client.key
@@ -28,6 +36,13 @@ properties:
   autoscaler.metricsforwarder.server.port:
     description: "Port on which the metricsforwarder server will listen"
     default: 6201
+  autoscaler.metricsforwarder.server.ca_cert:
+    description: "PEM-encoded CA certificate for the metricsforwarder server"
+  autoscaler.metricsforwarder.server.server_cert:
+    description: "PEM-encoded server certificate for the metricsforwarder server"
+  autoscaler.metricsforwarder.server.server_key:
+    description: "PEM-encoded server key for the metricsforwarder server"
+
   autoscaler.metricsforwarder.loggregator.metron_address:
     description: "IP address and port where the metron agent is running"
     default: "127.0.0.1:3458"
@@ -137,6 +152,12 @@ properties:
   autoscaler.metricsforwarder.health.port:
     description: "The listening port of health endpoint"
     default: 6403
+  autoscaler.metricsforwarder.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.metricsforwarder.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.metricsforwarder.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
   autoscaler.metricsforwarder.health.username:
     description: "the username of health endpoint"
     default: ''

jobs/metricsforwarder/templates/healthendpoint.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsforwarder.health.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsforwarder/templates/healthendpoint.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsforwarder.health.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsforwarder/templates/healthendpoint_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsforwarder.health.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsforwarder/templates/metricsforwarder.yml.erb

@@ -46,6 +46,13 @@ end
 
 server:
   port: <%= p("autoscaler.metricsforwarder.server.port") %>
+  <% if_p("autoscaler.metricsforwarder.server.ca_cert", "autoscaler.metricsforwarder.server.server_cert", "autoscaler.metricsforwarder.server.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/metricsforwarder/config/certs/metricsforwarder/ca.crt
+    cert_file: /var/vcap/jobs/metricsforwarder/config/certs/metricsforwarder/server.crt
+    key_file: /var/vcap/jobs/metricsforwarder/config/certs/metricsforwarder/server.key
+  <% end %>
+
 logging:
   level: <%= p("autoscaler.metricsforwarder.logging.level") %>
 loggregator:
@@ -74,6 +81,12 @@ health:
   port:  <%= p("autoscaler.metricsforwarder.health.port") %>
   username: <%= p("autoscaler.metricsforwarder.health.username") %>
   password: <%= p("autoscaler.metricsforwarder.health.password") %>
+  <% if_p("autoscaler.metricsforwarder.health.ca_cert", "autoscaler.metricsforwarder.health.server_cert", "autoscaler.metricsforwarder.health.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/metricsforwarder/config/certs/healthendpoint/ca.crt
+    cert_file: /var/vcap/jobs/metricsforwarder/config/certs/healthendpoint/server.crt
+    key_file: /var/vcap/jobs/metricsforwarder/config/certs/healthendpoint/server.key
+  <% end %>
 
 rate_limit:
   valid_duration: <%= p("autoscaler.metricsforwarder.rate_limit.valid_duration") %>

jobs/metricsforwarder/templates/metricsforwarder_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsforwarder.server.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsforwarder/templates/metricsforwarder_server.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsforwarder.server.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsforwarder/templates/metricsforwarder_server.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsforwarder.server.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsgateway/spec

@@ -5,6 +5,10 @@ templates:
   bpm.yml.erb: config/bpm.yml
   metricsgateway.yml.erb: config/metricsgateway.yml
 
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
+
   metricsserver_client_ca.crt.erb: config/certs/metricsserver_client/ca.crt
   metricsserver_client.crt.erb: config/certs/metricsserver_client/server.crt
   metricsserver_client.key.erb: config/certs/metricsserver_client/server.key
@@ -111,6 +115,12 @@ properties:
   autoscaler.metricsgateway.health.port:
     description: "The listening port of health endpoint"
     default: 6503
+  autoscaler.metricsgateway.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.metricsgateway.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.metricsgateway.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
   autoscaler.metricsgateway.health.username:
     description: "the username of health endpoint"
     default: ''

jobs/metricsgateway/templates/healthendpoint.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsgateway.health.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsgateway/templates/healthendpoint.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsgateway.health.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsgateway/templates/healthendpoint_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsgateway.health.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsgateway/templates/metricsgateway.yml.erb

@@ -80,3 +80,9 @@ health:
   port: <%= p("autoscaler.metricsgateway.health.port") %>
   username: <%= p("autoscaler.metricsgateway.health.username") %>
   password: <%= p("autoscaler.metricsgateway.health.password") %>
+  <% if_p("autoscaler.metricsgateway.health.ca_cert", "autoscaler.metricsgateway.health.server_cert", "autoscaler.metricsgateway.health.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/metricsgateway/config/certs/healthendpoint/ca.crt
+    cert_file: /var/vcap/jobs/metricsgateway/config/certs/healthendpoint/server.crt
+    key_file: /var/vcap/jobs/metricsgateway/config/certs/healthendpoint/server.key
+  <% end %>

jobs/metricsserver/spec

@@ -10,6 +10,10 @@ templates:
   metricsserver_server.crt.erb: config/certs/metricsserver/server.crt
   metricsserver_server.key.erb: config/certs/metricsserver/server.key
 
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
+
   policy_db_ca.crt.erb: config/certs/policy_db/ca.crt
   policy_db.crt.erb: config/certs/policy_db/crt
   policy_db.key.erb: config/certs/policy_db/key
@@ -150,6 +154,12 @@ properties:
   autoscaler.metricsserver.health.port:
     description: "The listening port of health endpoint"
     default: 6303
+  autoscaler.metricsserver.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.metricsserver.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.metricsserver.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
   autoscaler.metricsserver.health.username:
     description: "the username of health endpoint"
     default: ''

jobs/metricsserver/templates/healthendpoint.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsserver.health.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsserver/templates/healthendpoint.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsserver.health.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsserver/templates/healthendpoint_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.metricsserver.health.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/metricsserver/templates/metricsserver.yml.erb

@@ -89,6 +89,12 @@ health:
   port: <%= p("autoscaler.metricsserver.health.port") %>
   username: <%= p("autoscaler.metricsserver.health.username") %>
   password: <%= p("autoscaler.metricsserver.health.password") %>
+  <% if_p("autoscaler.metricsserver.health.ca_cert", "autoscaler.metricsserver.health.server_cert", "autoscaler.metricsserver.health.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/metricsserver/config/certs/healthendpoint/ca.crt
+    cert_file: /var/vcap/jobs/metricsserver/config/certs/healthendpoint/server.crt
+    key_file: /var/vcap/jobs/metricsserver/config/certs/healthendpoint/server.key
+  <% end %>
 
 
 

jobs/operator/spec

@@ -6,6 +6,10 @@ templates:
   operator.yml.erb: config/operator.yml
   liquibase.properties: bin/liquibase.properties
 
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
+
   scalingengine_ca.crt.erb: config/certs/scalingengine/ca.crt
   scalingengine_client.crt.erb: config/certs/scalingengine/client.crt
   scalingengine_client.key.erb: config/certs/scalingengine/client.key
@@ -311,6 +315,12 @@ properties:
   autoscaler.operator.health.port:
     description: "the listening port of health endpoint"
     default: 6208
+  autoscaler.operator.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.operator.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.operator.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
   autoscaler.operator.health.username:
     description: "the username of health endpoint"
     default: ''

jobs/operator/templates/healthendpoint.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.operator.health.server_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/operator/templates/healthendpoint.key.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.operator.health.server_key") do |value| %>
+<%= value %>
+<% end %>

jobs/operator/templates/healthendpoint_ca.crt.erb

@@ -0,0 +1,3 @@
+<% if_p("autoscaler.operator.health.ca_cert") do |value| %>
+<%= value %>
+<% end %>

jobs/operator/templates/operator.yml.erb

@@ -62,6 +62,13 @@ health:
   port: <%= p("autoscaler.operator.health.port") %>
   username: <%= p("autoscaler.operator.health.username") %>
   password: <%= p("autoscaler.operator.health.password") %>
+  <% if_p("autoscaler.operator.health.ca_cert", "autoscaler.operator.health.server_cert", "autoscaler.operator.health.server_key") do %>
+  tls:
+    ca_file: /var/vcap/jobs/operator/config/certs/healthendpoint/ca.crt
+    cert_file: /var/vcap/jobs/operator/config/certs/healthendpoint/server.crt
+    key_file: /var/vcap/jobs/operator/config/certs/healthendpoint/server.key
+  <% end %>
+
 http_client_timeout: <%= p("autoscaler.operator.http_client_timeout") %>
 instance_metrics_db:
   db:

jobs/scalingengine/spec

@@ -10,14 +10,18 @@ templates:
   policy_db.key.erb: config/certs/policy_db/key
   policy_db_ca.crt.erb: config/certs/policy_db/ca.crt
 
-  scalingengine_ca.crt.erb: config/certs/scalingengine/ca.crt
+  scalingengine_db_ca.crt.erb: config/certs/scalingengine_db/ca.crt
   scalingengine_db.crt.erb: config/certs/scalingengine_db/crt
   scalingengine_db.key.erb: config/certs/scalingengine_db/key
 
-  scalingengine_db_ca.crt.erb: config/certs/scalingengine_db/ca.crt
+  scalingengine_ca.crt.erb: config/certs/scalingengine/ca.crt
   scalingengine_server.crt.erb: config/certs/scalingengine/server.crt
   scalingengine_server.key.erb: config/certs/scalingengine/server.key
 
+  healthendpoint_ca.crt.erb: config/certs/healthendpoint/ca.crt
+  healthendpoint.crt.erb: config/certs/healthendpoint/server.crt
+  healthendpoint.key.erb: config/certs/healthendpoint/server.key
+
   scheduler_db.crt.erb: config/certs/scheduler_db/crt
   scheduler_db.key.erb: config/certs/scheduler_db/key
   scheduler_db_ca.crt.erb: config/certs/scheduler_db/ca.crt
@@ -169,6 +173,12 @@ properties:
   autoscaler.scalingengine.health.port:
     description: "the listening port of health endpoint"
     default: 6204
+  autoscaler.scalingengine.health.ca_cert:
+    description: "PEM-encoded CA certificate for the health endpoint"
+  autoscaler.scalingengine.health.server_cert:
+    description: "PEM-encoded server certificate for the health endpoint"
+  autoscaler.scalingengine.health.server_key:
+    description: "PEM-encoded server key for the health endpoint"
   autoscaler.scalingengine.health.username:
     description: "the username of health endpoint"
     default: ''