Skip to content

Commit f6b5b0e

Browse files
mirskifaGitHub Enterprise
mirskifa
authored and
GitHub Enterprise
committed
Continue to generate keystore with externally provided NativeHA ini (#730)
1 parent 9b42e08 commit f6b5b0e

23 files changed

+268
-211
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@
77
* Fix APAR IT46430
88
* Changed build Dockerfile to reduce file duplication across image layers
99
* Changed shutdown flow to continue reaping orphan processes during queue manager shutdown
10-
* Allow Native HA configuration to be externally provided rather than generated from template
10+
* Allow Native HA configuration to be externally provided rather than generated from template.
11+
* Deprecate use of environment variable configuration of Native HA (except `MQ_NATIVE_HA=true` which is still required).
12+
* Clarify behaviour of now deprecated environment variable configuration in IBM documentation
1113
* Clarified new minimum versions of Docker and Podman; new version required due to the move to UBI 9
1214

1315
## 9.4.0.0 (2024-06)

‎Dockerfile-server‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,15 +120,17 @@ RUN env \
120120
&& /opt/mqm/bin/security/amqpamcf
121121
COPY --chown=1001:root --from=builder $GO_WORKDIR/runmqserver /usr/local/bin/
122122
COPY --chown=1001:root --from=builder $GO_WORKDIR/chkmq* /usr/local/bin/
123-
COPY ha/native-ha.ini.tpl /etc/mqm/native-ha.ini.tpl
123+
COPY --chown=1001:root ha/*.ini.tpl /etc/mqm/
124124
# Copy web XML files
125125
COPY --chown=1001:root web /etc/mqm/web
126126
COPY --chown=1001:root etc/mqm/*.tpl /etc/mqm/
127127
RUN ln -s /run/mqwebcontainer.xml /etc/mqm/web/installations/Installation1/servers/mqweb/mqwebcontainer.xml \
128128
&& ln -s /run/tls.xml /etc/mqm/web/installations/Installation1/servers/mqweb/tls.xml \
129129
&& ln -s /run/jvm.options /etc/mqm/web/installations/Installation1/servers/mqweb/configDropins/defaults/jvm.options \
130130
&& ln -s /run/15-tls.mqsc /etc/mqm/15-tls.mqsc \
131-
&& ln -s /run/native-ha.ini /etc/mqm/native-ha.ini \
131+
&& ln -s /run/10-native-ha.ini /etc/mqm/10-native-ha.ini \
132+
&& ln -s /run/10-native-ha-instance.ini /etc/mqm/10-native-ha-instance.ini \
133+
&& ln -s /run/10-native-ha-keystore.ini /etc/mqm/10-native-ha-keystore.ini \
132134
&& chown -R 1001:root /etc/mqm/*
133135
RUN touch /run/termination-log \
134136
&& chown 1001:root /run/termination-log \

‎cmd/runmqserver/main.go‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"errors"
2323
"flag"
2424
"os"
25+
"path"
2526
"sync"
2627

2728
"github.com/ibm-messaging/mq-container/internal/copy"
@@ -164,12 +165,19 @@ func doMain() error {
164165
return err
165166
}
166167

167-
// Initialise native-ha.ini file on ephemeral volume
168-
// #nosec G306 - its a read by owner/s group, and pose no harm.
169-
err = os.WriteFile("/run/native-ha.ini", []byte(""), 0660)
170-
if err != nil {
171-
logTermination(err)
172-
return err
168+
// Initialise native-ha ini files file on ephemeral volume
169+
nativeHAINIs := []string{
170+
"10-native-ha.ini",
171+
"10-native-ha-instance.ini",
172+
"10-native-ha-keystore.ini",
173+
}
174+
for _, iniFile := range nativeHAINIs {
175+
// #nosec G306 - its a read by owner/s group, and pose no harm.
176+
err = os.WriteFile(path.Join("/run", iniFile), []byte(""), 0660)
177+
if err != nil {
178+
logTermination(err)
179+
return err
180+
}
173181
}
174182

175183
// Copy default mqwebcontainer.xml file to ephemeral volume

‎ha/10-native-ha-instance.ini.tpl‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
NativeHALocalInstance:
2+
Name={{ .Name }}
3+
{{ if .SSLFipsRequired }}
4+
SSLFipsRequired={{ .SSLFipsRequired }}
5+
{{- end}}

‎ha/10-native-ha-keystore.ini.tpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
NativeHALocalInstance:
2+
{{ if .CertificateLabel }}
3+
CertificateLabel={{ .CertificateLabel }}
4+
{{- end }}
5+
{{ if .Group.CertificateLabel }}
6+
GroupCertificateLabel={{ .Group.CertificateLabel}}
7+
{{- end }}
8+
KeyRepository={{ .KeyRepository }}

‎ha/native-ha.ini.tpl‎ renamed to ‎ha/10-native-ha.ini.tpl‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,11 @@
11
NativeHALocalInstance:
2-
Name={{ .Name }}
32
{{ if .ShouldConfigureTLS }}
4-
{{ if .CertificateLabel }}
5-
CertificateLabel={{ .CertificateLabel }}
6-
{{- end }}
73
{{ if .CipherSpec }}
84
CipherSpec={{ .CipherSpec }}
95
{{- end }}
106
{{ if .Group.Local.Name }}
117
GroupName={{ .Group.Local.Name }}
128
{{- end}}
13-
{{ if .Group.CertificateLabel }}
14-
GroupCertificateLabel={{ .Group.CertificateLabel}}
15-
{{- end }}
169
{{ if .Group.CipherSpec }}
1710
GroupCipherSpec={{ .Group.CipherSpec }}
1811
{{- end }}
@@ -22,10 +15,6 @@ NativeHALocalInstance:
2215
{{ if .Group.Local.Address }}
2316
GroupLocalAddress={{ .Group.Local.Address }}
2417
{{- end}}
25-
KeyRepository={{ .KeyRepository }}
26-
{{ if .SSLFipsRequired }}
27-
SSLFipsRequired={{ .SSLFipsRequired }}
28-
{{- end}}
2918
{{- end }}{{/* end if .ShouldConfigureTLS */}}
3019
{{- range $idx, $instance := .Instances}}
3120
NativeHAInstance:

‎internal/ha/ha.go‎

Lines changed: 36 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ limitations under the License.
1818
package ha
1919

2020
import (
21+
"fmt"
2122
"os"
2223

2324
"github.com/ibm-messaging/mq-container/internal/fips"
@@ -28,27 +29,45 @@ import (
2829

2930
// ConfigureNativeHA configures native high availability
3031
func ConfigureNativeHA(log *logger.Logger) error {
31-
if !envConfigPresent() {
32+
if os.Getenv("MQ_NATIVE_HA") != "true" {
3233
return nil
3334
}
34-
log.Println("Configuring Native HA using values provided in environment variables")
35-
fileLink := "/run/native-ha.ini"
36-
templateFile := "/etc/mqm/native-ha.ini.tpl"
3735
fipsAvailable := fips.IsFIPSEnabled()
38-
return loadConfigAndGenerate(templateFile, fileLink, fipsAvailable, log)
36+
37+
haCertLabel, haGroupCertLabel, _, _, err := tls.ConfigureHATLSKeystore()
38+
if err != nil {
39+
return fmt.Errorf("error loading tls keys: %w", err)
40+
}
41+
42+
configFiles := map[string]string{
43+
"/run/10-native-ha-instance.ini": "/etc/mqm/10-native-ha-instance.ini.tpl",
44+
}
45+
if haCertLabel != "" || haGroupCertLabel != "" {
46+
configFiles["/run/10-native-ha-keystore.ini"] = "/etc/mqm/10-native-ha-keystore.ini.tpl"
47+
}
48+
if envConfigPresent() {
49+
log.Println("Configuring Native HA using values provided in environment variables")
50+
configFiles["/run/10-native-ha.ini"] = "/etc/mqm/10-native-ha.ini.tpl"
51+
}
52+
return loadConfigAndGenerate(configFiles, fipsAvailable, haCertLabel, haGroupCertLabel, log)
3953
}
4054

41-
func loadConfigAndGenerate(templatePath string, outputPath string, fipsAvailable bool, log *logger.Logger) error {
55+
func loadConfigAndGenerate(templateConfigs map[string]string, fipsAvailable bool, haCertLabel, haGroupCertLabel string, log *logger.Logger) error {
4256
cfg, err := loadConfigFromEnv(log)
4357
if err != nil {
4458
return err
4559
}
46-
err = cfg.updateTLS()
60+
err = cfg.updateTLS(fipsAvailable, haCertLabel, haGroupCertLabel)
4761
if err != nil {
4862
return err
4963
}
50-
51-
return cfg.generate(templatePath, outputPath, log)
64+
for outputPath, templateFile := range templateConfigs {
65+
err := cfg.generate(templateFile, outputPath, log)
66+
if err != nil {
67+
return err
68+
}
69+
}
70+
return nil
5271
}
5372

5473
func envConfigPresent() bool {
@@ -61,7 +80,6 @@ func envConfigPresent() bool {
6180
"MQ_NATIVE_HA_INSTANCE_2_REPLICATION_ADDRESS",
6281
"MQ_NATIVE_HA_TLS",
6382
"MQ_NATIVE_HA_CIPHERSPEC",
64-
"MQ_NATIVE_HA_KEY_REPOSITORY",
6583
}
6684
for _, checkVar := range checkVars {
6785
if os.Getenv(checkVar) != "" {
@@ -101,7 +119,6 @@ func loadConfigFromEnv(log *logger.Logger) (*haConfig, error) {
101119
},
102120
CipherSpec: os.Getenv("MQ_NATIVE_HA_GROUP_CIPHERSPEC"),
103121
},
104-
haTLSEnabled: os.Getenv("MQ_NATIVE_HA_TLS") == "true",
105122
CipherSpec: os.Getenv("MQ_NATIVE_HA_CIPHERSPEC"),
106123
keyRepository: os.Getenv("MQ_NATIVE_HA_KEY_REPOSITORY"),
107124
}
@@ -136,43 +153,20 @@ func (h haConfig) ShouldConfigureTLS() bool {
136153
}
137154

138155
func (h haConfig) SSLFipsRequired() string {
139-
if !h.haTLSEnabled {
140-
return ""
141-
}
142156
return yesNo(h.fipsAvailable).String()
143157
}
144158

145-
func (h *haConfig) updateTLS() error {
146-
if !h.ShouldConfigureTLS() {
147-
return nil
148-
}
149-
150-
var err error
151-
var keyStore, trustStore tls.KeyStoreData
152-
153-
if h.haTLSEnabled {
154-
var keyLabel string
155-
keyLabel, keyStore, trustStore, err = tls.ConfigureHATLSKeystore()
156-
if err != nil {
157-
return err
158-
}
159-
h.CertificateLabel = keyLabel
159+
func (h *haConfig) updateTLS(fipsAvailable bool, haCertLabel, haGroupCertLabel string) error {
160+
if haCertLabel != "" {
161+
h.CertificateLabel = haCertLabel
162+
h.haTLSEnabled = true
160163
}
161-
162-
if h.Group.Local.Name != "" {
163-
var groupKeyLabel string
164-
if h.haTLSEnabled {
165-
groupKeyLabel, err = tls.ConfigureHAReplicationGroupTLS(keyStore, trustStore)
166-
} else {
167-
groupKeyLabel, err = tls.CreateHAReplicationGroupTLS()
168-
}
169-
if err != nil {
170-
return err
171-
}
172-
h.Group.CertificateLabel = groupKeyLabel
164+
if haGroupCertLabel != "" {
165+
h.Group.CertificateLabel = haGroupCertLabel
166+
h.haTLSEnabled = true
173167
}
174168

175-
h.fipsAvailable = fips.IsFIPSEnabled()
169+
h.fipsAvailable = fipsAvailable
176170

177171
return nil
178172
}

0 commit comments

Comments
 (0)