nosvalds commented on issue #390:
URL: https://github.com/apache/solr-operator/issues/390#issuecomment-1012103800
Thanks @thelabdude !
I think this worked. Some modifications to the script to ensure I pulled the
`cacerts` file from one of my Solr pods.
```
#!/bin/bash
# Pick a truststore password
TRUST_STORE=truststore.p12
TRUST_STORE_PASSWORD=test123
# get JAVA_HOME from pod
kubectl exec -it <pod-name> -- bash
echo $JAVA_HOME
exit
JAVA_HOME=TODO # from above echo
# copy cacerts from pod to local machine
kubectl cp pod-name:$JAVA_HOME/lib/security/cacerts ./cacerts
# Create a PKCS12 file containing all the CA Certs already trusted your JVM
keytool -importkeystore -srckeystore cacerts -srcstorepass changeit \
-destkeystore $TRUST_STORE -deststoretype pkcs12 -deststorepass
$TRUST_STORE_PASSWORD
# Download the Let's Encrypt PEM file
wget https://letsencrypt.org/certs/lets-encrypt-r3.pem
# Import the Let's Encrypt Intermediate CA Cert into the truststore
keytool -import -trustcacerts -alias letsencrypt -file lets-encrypt-r3.pem \
-keystore $TRUST_STORE -storepass $TRUST_STORE_PASSWORD
# Verify the truststore is readable and the letsencrypt exists
keytool -list -keystore $TRUST_STORE -storepass $TRUST_STORE_PASSWORD
-storetype pkcs12 | grep letsencrypt
# Create a k8s secret containing the truststore.p12 file and password literal
kubectl create secret generic lets-encrypt-truststore-secret \
--from-file=truststore.p12=$TRUST_STORE \
--from-literal=password-key=$TRUST_STORE_PASSWORD
```
Then I updated my SolrCloud CRD as directed.
Looks like the truststore was updated appropriately:
```
❯ k describe po iati-dev-solrcloud-0 | grep SSL
SOLR_SSL_ENABLED: true
SOLR_SSL_WANT_CLIENT_AUTH: false
SOLR_SSL_NEED_CLIENT_AUTH: false
SOLR_SSL_CHECK_PEER_NAME: false
SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION: false
SOLR_SSL_KEY_STORE: /var/solr/tls/keystore.p12
SOLR_SSL_KEY_STORE_PASSWORD: <set to the key 'password-key'
in secret 'pkcs12-keystore-password-dev'> Optional: false
SOLR_SSL_TRUST_STORE:
/var/solr/tls-truststore/truststore.p12
SOLR_SSL_TRUST_STORE_PASSWORD: <set to the key 'password-key'
in secret 'lets-encrypt-truststore-secret'> Optional: false
```
I've only done this on my dev environment so far which is only 1 Solrcloud
pod, so not able to fully test it's fixed yet.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
