feature/SP-7400, swarm-db secure connection

src/Dockerfile

@@ -258,16 +258,27 @@ RUN mkdir -p "${OUTPUTDIR}/usr/local/bin";
 
 # copy pki-authority service files
 ADD rootfs/files/scripts/install_lxc_deps.sh /buildroot/files/scripts/
-ADD rootfs/files/configs/pki-service/pki-authority.service "${OUTPUTDIR}/etc/systemd/system"
-RUN ln -s /etc/systemd/system/pki-authority.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-authority.service"
-ADD rootfs/files/configs/pki-service/create-and-configure-pki.sh "${OUTPUTDIR}/usr/local/bin"
-RUN mkdir -p "${OUTPUTDIR}/root/containers"
-COPY --from=ghcr.io/super-protocol/tee-pki-authority-service-lxc:build-18725490828 /pki-authority.tar "${OUTPUTDIR}/root/containers/pki-authority.tar"
-ADD rootfs/files/configs/pki-service/lxc-template.yaml "${OUTPUTDIR}/root/containers/lxc-template.yaml"
-ADD rootfs/files/configs/pki-service/dnsmasq.conf "${OUTPUTDIR}/etc/lxc/dnsmasq.conf"
-ADD rootfs/files/configs/pki-service/lxc-net "${OUTPUTDIR}/etc/default/lxc-net"
 RUN --security=insecure /buildroot/files/scripts/install_lxc_deps.sh
 
+ARG PKI_AUTHORITY_SERVICE_LXC_TAG=build-21720130629
+RUN mkdir -p "${OUTPUTDIR}/etc/super/containers/pki-authority"
+COPY --from=ghcr.io/super-protocol/tee-pki-authority-service-lxc:build-21875562504 /pki-authority.tar "${OUTPUTDIR}/etc/super/containers/pki-authority/pki-authority.tar"
+ADD rootfs/files/configs/pki-service/conf/lxc-swarm-template.yaml "${OUTPUTDIR}/etc/super/containers/pki-authority/lxc-swarm-template.yaml"
+ADD rootfs/files/configs/pki-service/conf/dnsmasq.conf "${OUTPUTDIR}/etc/lxc/dnsmasq.conf"
+ADD rootfs/files/configs/pki-service/conf/lxc-net "${OUTPUTDIR}/etc/default/lxc-net"
+RUN mkdir -p "${OUTPUTDIR}/usr/local/bin/pki-authority"
+ADD rootfs/files/configs/pki-service/scripts/*.py "${OUTPUTDIR}/usr/local/bin/pki-authority/"
+ADD rootfs/files/configs/pki-service/scripts/*.sh "${OUTPUTDIR}/usr/local/bin/pki-authority/"
+ADD rootfs/files/configs/pki-service/systemd/pki-authority-init.service "${OUTPUTDIR}/etc/systemd/system"
+ADD rootfs/files/configs/pki-service/systemd/pki-authority.service "${OUTPUTDIR}/etc/systemd/system"
+ADD rootfs/files/configs/pki-service/systemd/pki-authority-sync.service "${OUTPUTDIR}/etc/systemd/system"
+RUN mkdir -p "${OUTPUTDIR}/etc/super/pki-authority-sync"
+ADD rootfs/files/configs/pki-service/conf/secrets-config.yaml "${OUTPUTDIR}/etc/super/pki-authority-sync/secrets-config.yaml"
+RUN chmod +x "${OUTPUTDIR}"/usr/local/bin/pki-authority/*.py
+RUN ln -s /etc/systemd/system/pki-authority-init.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-authority-init.service"
+RUN ln -s /etc/systemd/system/pki-authority.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-authority.service"
+RUN ln -s /etc/systemd/system/pki-authority-sync.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/pki-authority-sync.service"
+
 ADD rootfs/files/configs/etc/multipath.conf.append /buildroot/files/configs/etc/multipath.conf.append
 ADD rootfs/files/configs/etc/sysctl.conf.append /buildroot/files/configs/etc/sysctl.conf.append
 
@@ -283,6 +294,8 @@ RUN ln -sf /etc/systemd/system/hardening-vm.service "${OUTPUTDIR}/etc/systemd/sy
 # swarm services
 ADD rootfs/files/configs/etc/systemd/system/swarm-db.service ${OUTPUTDIR}/etc/systemd/system/swarm-db.service
 RUN ln -sf /etc/systemd/system/swarm-db.service "${OUTPUTDIR}/etc/systemd/system/multi-user.target.wants/swarm-db.service"
+ADD rootfs/files/scripts/prepare_swarm_db_config.py ${OUTPUTDIR}/usr/local/bin/prepare_swarm_db_config.py
+RUN chmod +x ${OUTPUTDIR}/usr/local/bin/prepare_swarm_db_config.py
 ADD rootfs/files/configs/usr/local/bin/swarm-cloud-api.sh ${OUTPUTDIR}/usr/local/bin/swarm-cloud-api.sh
 ADD rootfs/files/configs/etc/systemd/system/swarm-node.service ${OUTPUTDIR}/etc/systemd/system/swarm-node.service
 ADD rootfs/files/configs/usr/local/bin/swarm-node.sh ${OUTPUTDIR}/usr/local/bin/swarm-node.sh
@@ -368,6 +381,13 @@ RUN chmod +x ${OUTPUTDIR}/etc/swarm-cloud/services/*/main.py
 ADD rootfs/files/scripts/setup_runtime_tools.sh /buildroot/files/scripts/
 RUN chmod +x /buildroot/files/scripts/setup_runtime_tools.sh
 RUN --security=insecure /buildroot/files/scripts/setup_runtime_tools.sh
+
+# install pki-sync-client npm package globally (requires python3-venv from setup_runtime_tools)
+ARG PKI_SYNC_CLIENT_VERSION=2.0.6
+ADD rootfs/files/scripts/install_sync_client.sh /buildroot/files/scripts/
+RUN chmod +x /buildroot/files/scripts/install_sync_client.sh
+RUN --security=insecure /buildroot/files/scripts/install_sync_client.sh "${PKI_SYNC_CLIENT_VERSION}"
+
 # MongoDB (install official mongodb-org 7.0 via Jammy repository inside VM rootfs)
 ADD rootfs/files/scripts/install_mongodb.sh /buildroot/files/scripts/
 RUN --security=insecure bash /buildroot/files/scripts/install_mongodb.sh

src/rootfs/files/configs/etc/systemd/system/swarm-db.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=Swarm DB service
-After=network-online.target local-fs.target
-Wants=network-online.target
+After=network-online.target local-fs.target pki-authority.service
+Wants=network-online.target pki-authority.service
 RequiresMountsFor=/var /var/lib /var/lib/swarm-db
 ConditionPathExists=/usr/local/bin/swarm-db-linux-amd64
 ConditionPathExists=/sp/swarm/node-db.yaml
@@ -10,7 +10,11 @@ ConditionPathExists=/sp/swarm/node-db.yaml
 Type=simple
 WorkingDirectory=/
 ExecStartPre=mkdir -p /var/lib/swarm-db/data
-ExecStart=/usr/local/bin/swarm-db-linux-amd64 -config /sp/swarm/node-db.yaml
+ExecStartPre=/usr/local/bin/prepare_swarm_db_config.py \
+    --base-config /sp/swarm/node-db.yaml \
+    --key-file /etc/swarm/swarm.key \
+    --output-config /etc/swarm/swarm-db-config.yaml
+ExecStart=/usr/local/bin/swarm-db-linux-amd64 -config /etc/swarm/swarm-db-config.yaml
 StandardOutput=append:/var/log/swarm-db.log
 StandardError=append:/var/log/swarm-db-err.log
 Restart=always

src/rootfs/files/configs/pki-service/conf/lxc-swarm-template.yaml

@@ -0,0 +1,46 @@
+api:
+    httpsPort: 443
+    httpPort: 80
+    enabledApis:
+    - secrets
+    - pki
+pki:
+  allowedChallenges:
+    - token
+    - tdx
+    - sev-snp
+  validateParamRules:
+    - type: tdx
+      signatureVerification: github
+    - type: sev-snp
+      signatureVerification: github
+  tokenStorage:
+    storageType: file
+    storageFolder: /app/swarm-storage
+  ownDomain: ca-subroot.super-protocol.svc.cluster.local
+  ownChallenge:
+    type: tdx
+  certParams:
+    ocspUrl: ''
+  keyStorage:
+    type: trusted
+    storage:
+      type: super
+      keysPath: /app/keys
+  mode:
+    role: swarm
+    swarmMode: init
+    storage:
+        storageType: file
+        storageFolder: /app/swarm-storage
+    networkSettings:
+      networkType: trusted
+secretsStorage:
+  static:
+    swarmKey: dummy-swarm-key
+  storage:
+    storageType: file
+    storageFolder: /app/swarm-storage
+  validationCaBundle:
+    type: pki
+

src/rootfs/files/configs/pki-service/conf/secrets-config.yaml

@@ -0,0 +1,12 @@
+# PKI Sync Client - Secrets Configuration
+secrets:
+  - secretName: basic_certificate
+    saveTo: /var/lib/lxc/pki-authority/rootfs/app/swarm-storage/basic_certificate
+  - secretName: basic_privateKey
+    saveTo: /var/lib/lxc/pki-authority/rootfs/app/swarm-storage/basic_privateKey
+  - secretName: lite_certificate
+    saveTo: /var/lib/lxc/pki-authority/rootfs/app/swarm-storage/lite_certificate
+  - secretName: lite_privateKey
+    saveTo: /var/lib/lxc/pki-authority/rootfs/app/swarm-storage/lite_privateKey
+  - secretName: swarmKey
+    saveTo: /etc/swarm/swarm.key