search

cyberark / conjur-service-broker

Implementation of the Open Service Broker API for Conjur
Apache License 2.0
4 stars 4 forks source link

Add support for unique master and follower certificates #183

Open izgeri opened 4 years ago

izgeri commented 4 years ago

Is your feature request related to a problem? Please describe.

Migrated from https://github.com/pivotal-cf/docs-cyberark-conjur-service-broker/issues/21 as reported by @whip113

Currently, the tile config only has one field for importing the SSL certificate. The recommendations for certificates is to use one certificate for the master VIP and a different certificate for the follower VIP. The tile config allows us to configure both the master URL and the follower URL, but when using different certs for each the lack of a field to store the follower certificate means you can't actually use the follower URL.

The configuration for the tile relates to this service broker. At current, the service broker supports specifying the DAP master URL and a (read-only) follower URL - but it only allows specifying one certificate, when (as noted above):

The recommendations for certificates is to use one certificate for the master VIP and a different certificate for the follower VIP.

Describe the solution you would like

At current the service broker supports supplying the following relevant configuration environment variables:

We could add another parameter

And if set, we could use this alternate certificate when we instantiate the read-only API: https://github.com/cyberark/conjur-service-broker/blob/c5ee095a07bef17af5cd129327fc6fab1bb85e51/lib/conjur_client.rb#L17

Additional context

Once this change is made, we will also need to update the VMWare Tanzu tile definition to accept this parameter and properly configure the service broker with the CONJUR_FOLLOWER_SSL_CERTIFICATE env var.

tarnowsc commented 1 year ago

fixed in the new version