-
Notifications
You must be signed in to change notification settings - Fork 211
Add certificates configuration script #1369
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
5c892e2
Add certificates configuration script
vcerenu 83bd6f2
Delete chmod statements
vcerenu fdee048
Delete root-ca.key references and ensure required files
vcerenu 1bb8030
Add initContainer tasks and securityContext options
vcerenu 7c76809
Add changelog
vcerenu 079c40d
Merge branch 'main' of github.com:wazuh/wazuh-kubernetes into change/…
vcerenu File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Path configuration (adjust according to your folder structure) | ||
| CERT_TOOL="./wazuh-certs-tool.sh" | ||
| CONFIG_FILE="./config.yml" | ||
| OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default | ||
|
|
||
|
vcerenu marked this conversation as resolved.
|
||
| # Parse arguments | ||
| DO_CERT=false | ||
| DO_COPY=false | ||
| DO_PRIV=false | ||
|
|
||
| for arg in "$@"; do | ||
| case $arg in | ||
| --cert) DO_CERT=true ;; | ||
| --copy) DO_COPY=true ;; | ||
| --priv) DO_PRIV=true ;; | ||
| *) | ||
| echo "Unknown option: $arg" | ||
| echo "Usage: $0 [--cert] [--copy] [--priv]" | ||
| exit 1 | ||
| ;; | ||
| esac | ||
| done | ||
|
|
||
| # If no flags provided, show usage | ||
| if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then | ||
| echo "Usage: $0 [--cert] [--copy] [--priv]" | ||
| echo " --cert Generate certificates using wazuh-certs-tool.sh" | ||
| echo " --copy Copy certificates to the corresponding config directories" | ||
| echo " --priv Set ownership and permissions on the certificate files" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # --------------------------------------------------------------------------- | ||
| # Parse config.yml to extract node names per section (indexer, manager, dashboard) | ||
| # --------------------------------------------------------------------------- | ||
| parse_config() { | ||
| local section="" | ||
| INDEXER_NODES=() | ||
| MANAGER_NODES=() | ||
| DASHBOARD_NODES=() | ||
|
|
||
| while IFS= read -r line; do | ||
| # Detect section headers (e.g., " indexer:", " manager:", " dashboard:") | ||
| if echo "$line" | grep -qE '^\s+indexer:\s*$'; then | ||
| section="indexer" | ||
| continue | ||
| elif echo "$line" | grep -qE '^\s+manager:\s*$'; then | ||
| section="manager" | ||
| continue | ||
| elif echo "$line" | grep -qE '^\s+dashboard:\s*$'; then | ||
| section="dashboard" | ||
| continue | ||
| fi | ||
|
|
||
| # Extract node name from "- name: <value>" lines | ||
| if echo "$line" | grep -qE '^\s+-\s+name:'; then | ||
| local name | ||
| name=$(echo "$line" | sed 's/.*name:\s*//' | tr -d ' "'\''') | ||
| case $section in | ||
| indexer) INDEXER_NODES+=("$name") ;; | ||
| manager) MANAGER_NODES+=("$name") ;; | ||
| dashboard) DASHBOARD_NODES+=("$name") ;; | ||
| esac | ||
| fi | ||
| done < "$CONFIG_FILE" | ||
| } | ||
|
|
||
| # Convert node name to directory name (replace . with _) | ||
| node_to_dir() { | ||
| echo "$1" | tr '.' '_' | ||
| } | ||
|
|
||
| # --------------------------------------------------------------------------- | ||
| # Main logic | ||
| # --------------------------------------------------------------------------- | ||
|
|
||
| # Parse config.yml | ||
| if $DO_COPY || $DO_PRIV; then | ||
| if [ ! -f "$CONFIG_FILE" ]; then | ||
| echo "Error: Configuration file $CONFIG_FILE not found." | ||
| exit 1 | ||
| fi | ||
| parse_config | ||
| echo "Detected indexer nodes: ${INDEXER_NODES[*]}" | ||
| echo "Detected manager nodes: ${MANAGER_NODES[*]}" | ||
| echo "Detected dashboard nodes: ${DASHBOARD_NODES[*]}" | ||
| fi | ||
|
|
||
| # 1. Generate certificates | ||
| if $DO_CERT; then | ||
| # Ensure required files exist before proceeding | ||
| if [[ ! -f "$CERT_TOOL" ]]; then | ||
| echo "Error: Certificate tool '$CERT_TOOL' not found or not executable." >&2 | ||
| exit 1 | ||
| fi | ||
| if [[ ! -f "$CONFIG_FILE" ]]; then | ||
| echo "Error: Configuration file '$CONFIG_FILE' not found." >&2 | ||
| exit 1 | ||
| fi | ||
| echo "Generating certificates" | ||
| bash $CERT_TOOL -A | ||
|
vcerenu marked this conversation as resolved.
|
||
| fi | ||
|
|
||
| # 2. Copy certificates to config directories | ||
| if $DO_COPY; then | ||
| FIRST_INDEXER=true | ||
| for node in "${INDEXER_NODES[@]}"; do | ||
| dir_name=$(node_to_dir "$node") | ||
| echo "Copying certificates for indexer: $node -> config/$dir_name/certs/" | ||
| mkdir -p "./config/$dir_name/certs" | ||
| cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" | ||
| cp "$OUTPUT_DIR"/root-ca.pem "./config/$dir_name/certs/" | ||
| if $FIRST_INDEXER; then | ||
| cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/" | ||
|
vcerenu marked this conversation as resolved.
|
||
| FIRST_INDEXER=false | ||
| fi | ||
| done | ||
|
|
||
| for node in "${MANAGER_NODES[@]}"; do | ||
| dir_name=$(node_to_dir "$node") | ||
| echo "Copying certificates for manager: $node -> config/$dir_name/certs/" | ||
| mkdir -p "./config/$dir_name/certs" | ||
| cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" | ||
| cp "$OUTPUT_DIR"/root-ca.pem "./config/$dir_name/certs/" | ||
| done | ||
|
|
||
| for node in "${DASHBOARD_NODES[@]}"; do | ||
| dir_name=$(node_to_dir "$node") | ||
| echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/" | ||
| mkdir -p "./config/$dir_name/certs" | ||
| cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" | ||
| cp "$OUTPUT_DIR"/root-ca.pem "./config/$dir_name/certs/" | ||
| done | ||
| fi | ||
|
|
||
| # 3. Set ownership and permissions | ||
| if $DO_PRIV; then | ||
| for node in "${INDEXER_NODES[@]}"; do | ||
| dir_name=$(node_to_dir "$node") | ||
| echo "Setting permissions for indexer $node (1000:1000)" | ||
| chown -R 1000:1000 "./config/$dir_name/certs" | ||
| done | ||
|
|
||
| for node in "${MANAGER_NODES[@]}"; do | ||
| dir_name=$(node_to_dir "$node") | ||
| echo "Setting permissions for manager $node (999:999)" | ||
| chown -R 999:999 "./config/$dir_name/certs" | ||
| done | ||
|
|
||
| for node in "${DASHBOARD_NODES[@]}"; do | ||
| dir_name=$(node_to_dir "$node") | ||
| echo "Setting permissions for dashboard $node (1000:1000)" | ||
| chown -R 1000:1000 "./config/$dir_name/certs" | ||
| done | ||
| fi | ||
|
|
||
| echo "Process completed." | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.