Configure Secure connectivity between Core Mojaloop Service and Backends (Tracking)

[mdebarros]

Goal:

As a Hub Operator

I want to configure TLS/Authentication for Mojaloop Backend services

so that communication is secure & authenticated between Mojaloop and Backend Services

Acceptance Criteria:

• [ ] Central-Ledger supports TLS/Authentication configs for:
  • [ ] Kafka
  • [ ] MySQL
  • [ ] MongoDB
• [ ] ML-API-Adapter supports TLS/Authentication configs for:
  • [ ] Kafka
• [ ] Bulk-API-Adapter supports TLS/Authentication configs for:
  • [ ] Kafka
  • [ ] MongoDB
• [ ] Central-Settlements supports TLS/Authentication configs for:
  • [ ] Kafka
  • [ ] MySQL
• [ ] Account-Lookup-Service supports TLS/Authentication configs for:
  • [ ] MySQL
• [ ] Quoting-Service supports TLS/Authentication configs for:
  • [ ] MySQL
  • [ ] Redis
• [ ] Mojaloop-Simulators supports TLS/Authentication configs for:
  • [ ] Redis
• [ ] Event-sidecar supports TLS/Authentication configs for:
  • [ ] Kafka
• [ ] Event-Stream-Processor supports TLS/Authentication configs for:
  • [ ] Kafka
  • [ ] ElasticSearch supports TLS/Authentication configs for:
  • [ ] APM
• [ ] Schema-Adapter supports TLS/Authentication configs for:
  • [ ] Redis
• [ ] Email-Notifier supports TLS/Authentication configs for:
  • [ ] Kafka
• [ ] Finance-Portal supports TLS/Authentication configs for:
  • [ ] MySQL
• [ ] Settlement-Management supports TLS/Authentication configs for:
  • [ ] MySQL

Complexity: Medium

Uncertainty: Low

---

Tasks:

• [ ] Update Central-Services-Database to support config for TLS & Authentication [#?] ~ 3
• [ ] Update Central-Services-Stream to support config for TLS & Authentication [#?] ~ 3
• [ ] Update Central-Object-Store to support config for TLS & Authentication [#?] ~ 3
  • In review - I simply allowed us to pass in config objects to Mongoose
• Central-Ledger [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
  • [ ] integration tests
• ML-API-Adapter [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Bulk-API-Adapter [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Central-Settlements [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Account-Lookup-Service [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Quoting-Service [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Mojaloop-Simulators [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Event-sidecar [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Event-Stream-Processor [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Schema-Adapter [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Email-Notifier [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Finance-Portal [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Settlement-Management [#?] ~ 3
  • [ ] config files
  • [ ] setup/config for backends
• Helm Support for TLS & Authentication Secrets [#?] ~ 5
  • [ ] Central-Ledger
  • [ ] ML-API-Adapter
  • [ ] Bulk-API-Adapter
  • [ ] Central-Settlements
  • [ ] Account-Lookup-Service
  • [ ] Quoting-Service
  • [ ] Mojaloop-Simulators
  • [ ] Event-sidecar
  • [ ] Event-Stream-Processor
  • [ ] Schema-Adapter
  • [ ] Email-Notifier
  • [ ] Finance-Portal
  • [ ] Settlement-Management

Done

• [ ] Acceptance Criteria pass
• [ ] Designs are up-to date
• [ ] Unit Tests pass
• [ ] Integration Tests pass
• [ ] Code Style & Coverage meets standards
• [ ] Changes made to config (default.json) are broadcast to team and follow-up tasks added to update helm charts and other deployment config.
• [ ] TBD

Pull Requests:

• [ ] https://github.com/mojaloop/central-object-store/pull/21
• [ ] https://github.com/mojaloop/central-ledger/pull/831

Follow-up:

• N/A

Dependencies:

• N/A

Accountability:

• Owner: TBC
• QA/Review: TBC

[lewisdaly]

MongoDB support for TLS doesn't look all that difficult:

https://github.com/Automattic/mongoose/blob/c25169702ccc2a8f8123853453ed755f17278ce7/docs/tutorials/ssl.md

We will probably want to expose some options around specifying a CA file, and turning off and on the sslValidate option.

[lewisdaly]

@mdebarros maybe we can convert this into an Epic? Seems pretty epic to me.

[elnyry-sam-k]

yep @lewisdaly , @mdebarros - this is epic :-)