| .. This work is licensed under a Creative Commons Attribution 4.0 International License. |
| .. http://creativecommons.org/licenses/by/4.0 |
| .. Copyright © 2017 AT&T Intellectual Property. All rights reserved. |
| |
| ======================================== |
| Automated Configuration and Certificates |
| ======================================== |
| |
| *Note: this document assumes UNIX Bash Shell. Being Java, AAF works in Windows, but you will have to create your own script/instruction conversions.* |
| |
| -------- |
| Strategy |
| -------- |
| |
| ONAP is deployed in Docker Containers or Kubernetes managed Docker Containers. Therefore, this instruction utilizes a Docker Container as a standalone Utility... (This means that this container will stop as soon as it is done with its work... it is not a long running daemon) |
| |
| Given that all ONAP entities are also in Docker Containers, they all can access Persistent Volumes. |
| |
| This tool creates all the Configurations, including Certificates, onto a declared Volume on the directories starting with "/opt/app/osaaf" |
| |
| ------------------ |
| Prerequisites |
| ------------------ |
| * Docker |
| * Note: it does NOT have to be the SAME Docker that AAF is deployed on... |
| | but it DOES have be accessible to the AAF Instance. |
| * For ONAP, this means |
| |
| * Windriver VPN |
| * include "10.12.6.214 aaf-onap-test.osaaf.org" in your /etc/hosts or DNS |
| |
| ----------------------- |
| Obtain the Agent Script |
| ----------------------- |
| Choose the directory you wish to start in... |
| |
| If you don't want to clone all of AAF, just get the "agent.sh" from a Browser: |
| |
| https://gerrit.onap.org/r/gitweb?p=aaf/authz.git;a=blob_plain;f=auth/docker/agent.sh;hb=HEAD |
| |
| rename file "auth-docker-agent.sh" to "agent.sh" (named because of subdirectory in which it is found) |
| |
| Note: curl/wget returns an html, instead of text. This cannot be used! |
| | You have to mv, and rename it to "agent.sh", but avoids full clone... |
| |
| ------------------------- |
| Run Script |
| ------------------------- |
| |
| In your chosen directory :: |
| |
| $ bash agent.sh |
| |
| The Agent will look for "aaf.props", and if it doesn't exist, or is missing information, it will ask for it. |
| |
| This file is available to reuse for multiple calls. More importantly, you should use it as a template for auto-configuration. (In ONAP, these are HEAT templates and OOM Helm Charts) |
| |
| --------------------- |
| 'aaf.prop' Properties |
| --------------------- |
| |
| =================== =============== ============ |
| Query Tag Description |
| =================== =============== ============ |
| CADI Version VERSION Defaults to CADI version of this |
| AAF's FQDN AAF_FQDN PUBLIC Name for AAF. For ONAP Test, it is 'aaf-onap-test.osaaf.org' |
| Deployer's FQI DEPLOY_FQI In a REAL system, this would be a person or process. For ONAP Testing, the id is deployer@people.osaaf.org, password (see Dynamic Properties) is 'demo123456!' |
| App's Root FQDN APP_FQDN This will show up in the Cert Subject, and should be the name given by Docker. i.e. clamp.onap |
| App's FQI APP_FQI Fully Qualified ID given by Organization and with AAF NS/domain. ex: clamp@clamp.onap.org |
| App's Volume VOLUME Volume to put the data, see above. ex: clamp_aaf |
| DRIVER DRIVER Docker Volume type... See Docker Volume documentation |
| LATITUDE of Node LATITUDE Global latitude coordinate of Node (best guess in Kubernetes) |
| LONGITUDE of Node LONGITUDE Global longitude coordinate of Node (best guess in Kubernetes) |
| =================== =============== ============ |
| |
| --------------------- |
| Dynamic Properties |
| --------------------- |
| |
| These Properties do not automatically save in 'aaf.props', because... |
| |
| | Passwords should not be stored clear text, with the possible exception of constant Environment Recreation, where it is impractical. |
| | The IP of the AAF's FQDN is looked up, if possible. It can be set, however, when lookup isn't available. |
| |
| =================== =============== ============ |
| Query Tag Description |
| =================== =============== ============ |
| Deployer's Password DEPLOY_PASSWORD Password for the Deployer. Avoids storing, except where impossible otherwise. |
| IP of <AAF_FQDN> AAF_FQDN_IP IP for Name of AAF FQDN, if not available by normal lookup means |
| =================== =============== ============ |
| |
| ------------------------------- |
| Typical ONAP Entity Info in AAF |
| ------------------------------- |
| *This is not intended to be a comprehensive list, but a short list of main entities* |
| |
| ============================= =========================== ======================= ============================================== |
| ONAP Namespaces APP FQI APP FQDN OOM APP FQDN HEAT |
| ============================= =========================== ======================= ============================================== |
| org.osaaf.aaf aaf@aaf.osaaf.org aaf.onap aaf.api.simpledemo.onap.org |
| org.onap.aaf-sms aaf-sms@aaf-sms.onap.org aaf-sms.onap aaf-sms.api.simpledemo.onap.org |
| org.onap.aai aai@aai.onap.org aai.onap aai.api.simpledemo.onap.org |
| org.onap.appc appc@appc.onap.org appc.onap appc.api.simpledemo.onap.org |
| org.onap.clamp clamp@clamp.onap.org clamp.onap clamp.api.simpledemo.onap.org |
| org.onap.dcae dcae@dcae.onap.org dcae.onap dcae.api.simpledemo.onap.org |
| org.onap.dmaap dmaap@dmaap.onap.org dmaap.onap dmaap.api.simpledemo.onap.org |
| org.onap.dmaap-bc dmaap-bc@dmaap-bc.onap.org dmaap-bc.onap dmaap-bc.api.simpledemo.onap.org |
| org.onap.dmaap-dr dmaap-bc@dmaap-dr.onap.org dmaap-dr.onap dmaap-dr.api.simpledemo.onap.org |
| org.onap.dmaap-mr dmaap-mr@dmaap-mr.onap.org dmaap-mr.onap dmaap-mr.api.simpledemo.onap.org |
| org.onap.oof oof@oof.onap.org oof.onap oof.api.simpledemo.onap.org |
| org.onap.policy policy@policy.onap.org policy.onap policy.api.simpledemo.onap.org |
| org.onap.pomba pomba@pomba.onap.org pomba.onap pomba.api.simpledemo.onap.org |
| org.onap.portal portal@portal.onap.org portal.onap portal.api.simpledemo.onap.org |
| org.onap.sdc sdc@sdc.onap.org sdc.onap sdc.api.simpledemo.onap.org |
| org.onap.sdnc sdnc@sdnc.onap.org sdnc.onap sdnc.api.simpledemo.onap.org |
| org.onap.so so@so.onap.org so.onap so.api.simpledemo.onap.org |
| org.onap.vfc vfc@vfc.onap.org vfc.onap vfc.api.simpledemo.onap.org |
| org.onap.vid vid@vid.onap.org vid.onap vid.api.simpledemo.onap.org |
| ============================= =========================== ======================= ============================================== |
| |
| *Note 1: FQDNs are set in AAF's Credential Artifact data, accessible in "Cred Details" from Namespace Page* |
| |
| *Note 2: Also, AAF itself is different, as it is not an ONAP only component... It is also expected to be used outside of ONAP.* |
| |
| If something goes wrong, and Certificate is not created, you can adjust the data, remove the data from the Container's /opt/app/osaaf/local dir, and it will generate again. :: |
| |
| root@77777:/opt/app/osaaf/local# rm * |
| root@77777:/opt/app/osaaf/local# exit |
| $ bash agent.sh bash |
| |
| ------------- |
| Informational |
| ------------- |
| |
| There are two sets of Credentials at play here. The ability to create the Certificate belongs to one of |
| |
| * The person responsible for the ID in the Organization |
| * A delegated deployer |
| |
| It is expected in large organizations that Individual Employees are given the responsibility of an ID for an APP they are responsible for. |
| |
| In ONAP test, to simplify create/tear-down environment... |
| | The **Owner** is always "mmanager@people.osaaf.org". |
| | The **Sponsor** is always "aaf_admin@people.osaaf.org". |
| |
| In a large org, there are probably many Operations teams to support many different apps. |
| |
| In ONAP test, |
| The **Deployer** is always set to "deployer@people.osaaf.org" for all Apps. |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |