...
The A1 Policy Management Service uses the has a default keystore and truststore that are built into the container. The paths and passwords for these stores are located in a yaml file:
nonrtric/policy-agent/config/application.yaml
...
There is also A1 Policy Management Service's own cert in the default truststore for mocking purposes and unit-testing (ApplicationTest.java).
A1 Policy Management Service, configuration of certs in Kubernetes
The keystore and truststore can be configured in Kubernetes. In the source code repository, the default files are located. Updating this in a running cluster can be done in more than one way, but this is probably the simplest.
First you need to create a directory with three files.
config/
application.yaml
keystore.jks
truststore.jks
The default application.yaml can be taken from the source code repository or by using command "kubectl describe configmap policymanagementservice-configmap -n nonrtric"
Then you need to create the keystore.jks and (if used, this is not used by default) a truststore.jks .
There is a README file in the source code repository that describes how the default keystore and truststore are created. This involves creating a CA cert used for signing.
The following parameters in the application.yaml needs to updated (the non relevant parameters for this are omitted):
...
server:
ssl:
key-store-type: JKS
key-store-password: secret
key-store: /opt/app/policy-agent/config/keystore.jks
key-password: secret
key-alias: policy_agent
app:
webclient:
trust-store-used: false
trust-store-password: policy_agent
trust-store: /opt/app/policy-agent/config/truststore.jks
...
A1 Policy Management Service, configuration of certs in Docker
The default keystore, truststore, and application.yaml files can be overridden by mounting new files using the "volumes" field of docker-compose or docker run command.
...