📙 You will learn

How to add custom root certificates to an AppSec Container.

Prerequisites

Audience: IT Professional
Difficulty: Intermediate
Time needed: Approximately 10 minutes
Tools required: kubectl, Helm

Enter the following commands on a command line to perform the described action.

1. Copy the root certificate to the server with kubectl access

2. Add the Denim Group Helm repository if not present

   helm repo add denimgroup https://threadfix-downloads.s3-us-west-2.amazonaws.com/helm/

3. Get the Helm release name for the ThreadFix instance.

   TF_RELEASE=$(helm ls | grep threadfix | awk '{print $1}')

4. Get the current installed version of ThreadFix.

   TF_VERSION=$(helm ls --filter "$TF_RELEASE" | grep -o 'threadfix-[Az0-9\.\-]*' | sed 's|threadfix-||g')

5. Set pod and deployment env vars for later use:

   TF_APPSEC_POD=$(kubectl get po -l app.kubernetes.io/name=appsec -o jsonpath='{ .items[].metadata.name }')

6. Validate that the generated parameters are set.

   echo $TF_RELEASE
   echo $TF_VERSION
   echo $TF_APPSEC_POD

7. Copy the certificate to the appsec pod:

   kubectl cp <certificate> $TF_APPSEC_POD:/<certificate>

8. Add the certificate to the Java truststore:

   kubectl exec $TF_APPSEC_POD -- keytool --importcert -file <certificate> -keystore /usr/local/openjdk-8/jre/lib/security/cacerts -storepass changeit -noprompt

9. Copy the generated cacerts file to the user machine:

   kubectl cp $TF_APPSEC_POD:/usr/local/openjdk-8/jre/lib/security/cacerts cacerts

10. Create a configmap with the copied cacerts file:

    kubectl create configmap tf-cacerts --from-file=cacerts=./cacerts

11. Create myValues dir if not present

    mkdir -p myValues

12. Create a file named 'root-ca.yaml':

    echo "appsec:
      extraVolumes:
        - configMap:
            defaultMode: 420
            name: tf-cacerts
      extraVolumeMounts:
        - mountPath: /usr/local/openjdk-8/jre/lib/security/cacerts
          name: cacerts
          readOnly: true
          subPath: cacerts" > myValues/root-ca.yaml

13. Export current Helm values:

    helm get values $TF_RELEASE > currentValues.yaml

14. helm upgrade $TF_RELEASE denimgroup/threadfix --version $TF_VERSION -f currentValues.yaml -f myValues/root-ca.yaml

15. The appsec pod will automatically restart.The progress can be viewed with:

    kubectl get pods -w