Skip to content

[Barbican] TLS Implementation - #11217

Closed
rajivmucheli wants to merge 10 commits into
masterfrom
bsi-barbican
Closed

[Barbican] TLS Implementation#11217
rajivmucheli wants to merge 10 commits into
masterfrom
bsi-barbican

Conversation

@rajivmucheli

@rajivmucheli rajivmucheli commented Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What this does

  • Migrate Barbican API from paste.httpserver to Apache+mod_wsgi (keystone-style startup script)
  • TLS termination at Apache (port 443) for BSI TR-02102-2 compliance
  • NGINX ingress TLS passthrough mode when tls.enabled=true
  • TLS Bootstrap Job (Helm pre-install/pre-upgrade hook, fail-closed)
  • TLS Rotation CronJob (weekly, configurable renewal threshold)
  • BSI-compliant TLS protocol hardening (TLS 1.2/1.3, cipher suites, ECDHE curves)
  • Linkerd mTLS skip for HTTPS inbound port
  • Chart version bump: 0.8.6 -> 0.9.0

Review fixes

  • imageTag: removed latest, now a required field -- fails fast at render time if unset
  • hook-delete-policy: added before-hook-creation so failed bootstrap jobs don't block subsequent helm upgrade
  • RBAC: fixed create+resourceNames rule (Kubernetes silently ignores create with resourceNames); split into two clean rules
  • Dual WSGI daemon groups: collapsed barbican-api-https + barbican-api-http into a single barbican-api process group -- was doubling the mod_wsgi worker pool
  • LimitRequestBody 114688: added to both VirtualHosts (matches keystone)
  • Startup script: aligned with keystone -- removed a2enmod calls and fallback path lookup that masked broken images; fail fast if binary missing
  • Trailing newlines: fixed in 3 generated files
  • Inline comments: removed verbose WP-xxxx task references from all templates

Merge from master

  • Added rbac.enabled: true from master
  • Added barbican-tmp and barbican-run emptyDir volumes from master
  • Set readOnlyRootFilesystem: false -- Apache writes to /var/run/apache2, /var/log/apache2 at runtime
  • Added tls: enabled: false to CI test values to prevent nil pointer in linter

@rajivmucheli
rajivmucheli marked this pull request as draft March 30, 2026 11:31
BerndKue
BerndKue previously approved these changes Mar 30, 2026
View reviewed changes
@rajivmucheli
BSI TLS Implementation for Barbican (WP-1187, WP-1188, WP-1189, WP-11…
b5a9001 
…94, WP-1195, WP-1196, WP-1197)

This commit implements the BSI TLS certification requirements for Barbican:

WP-1187: Migrate to Apache+mod_wsgi
- Added Apache WSGI configuration template (_wsgi-barbican.conf.tpl)
- Updated api-deployment.yaml to use Apache instead of paste.httpserver
- Added api.processes and api.threads configuration in values.yaml

WP-1188: Add TLS Termination to Apache
- Added TLS certificate volume mounts
- Added HTTPS port (443) to deployment and service
- TLS certificates loaded from Kubernetes secret

WP-1189: Switch Ingress to TLS Passthrough
- Updated ingress.yaml with ssl-passthrough annotation
- Added backend-protocol HTTPS annotation
- Conditional configuration based on tls.passthrough setting

WP-1194: TLS Bootstrap Job (Helm hook)
- Created job-tls-bootstrap.yaml as pre-install/pre-upgrade hook
- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fe s- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- Fa- notation patch

WP-1196: Apache TLS ProWP-1196: Apache TLS ProWP-1196: Apache TLS ProWP-1196: Apache TLS nt WP-1196: Apache TLS ProWP-1196: Apache TLS ProWP-1196: Apache TLS ProisaWP-1196: Apache TLS ProWP-1196: Apache TLS ProWP-1196: Apache TLScemWP-1196: Apache TLS ProWP-1196: ApacatiWP-1196: Apache TLS ProWP-1196: Apacs WP-1196: Apache TLS ProWP-1196: Apache TLS ProWP-
-----------------------------------------------Acco------------------------------sive TLS configuration section in values.yaml
- All features disable- All features disanabled: false)
@rajivmucheli
Fix Apache startup script: add default env vars for APACHE_RUN_DIR
28a3eca
@rajivmucheli
WP-1196: Fix BSI TR-02102-2 TLS compliance
a6d1d13 
- Fix TLS 1.3 cipher suites: Remove TLS_AES_128_GCM_SHA256 (not in spec)
- Fix TLS 1.2 cipher suites: Add ECDHE-ECDSA variants, remove CHACHA20-POLY1305
- Fix ECDHE curve order: brainpoolP256r1 > brainpoolP384r1 > prime256v1 > secp384r1
- Add configurable ecdheCurves parameter in values.yaml
- Update comments to reference BSI TR-02102-2 and SF.Eco.3/SF.Eco.4

Acceptance criteria addressed:
- Only TLS 1.3 and TLS 1.2 accepted
- Correct cipher suites per SF.Eco.4
- Correct ECDHE curve order per SF.Eco.3
- SSLHonorCipherOrder on
- SSLSessionTickets off
- Perfect Forward Secrecy (all ECDHE)
@rajivmucheli
Update TLS lifecycle manager image to use Keppel registry
82706dd 
- Change image from 'tls-lifecycle-manager' to 'ccloud/tls-lifecycle-manager'
- Update imageTag from 'latest' to '20260407222924'

The image is now fetched from keppel.eu-de-1.cloud.sap/ccloud/tls-lifecycle-manager:20260407222924
@rajivmucheli
Revert "Update TLS lifecycle manager image to use Keppel registry"
9582ab1 
This reverts commit 82706dd.
@rajivmucheli rajivmucheli changed the title BSI TLS Implementation for Barbican [Barbican] TLS Implementation Aug 5, 2026
@rajivmucheli
[barbican] Address review concerns on TLS implementation PR
329512d 
- Fix imageTag: pin to empty string with required guard in both job
  templates (was: latest, non-deterministic)
- Fix hook-delete-policy: add before-hook-creation so failed bootstrap
  jobs do not block subsequent helm upgrade runs
- Fix RBAC: separate create/list from resourceNames-restricted verbs
- Fix dual WSGI daemon groups: single barbican-api group shared by both
  VirtualHosts, halving the mod_wsgi process pool
- Add LimitRequestBody 114688 to both VirtualHosts (matches keystone)
- Align startup script with keystone: remove a2enmod calls and fallback
  path; fail fast on missing binary
- Fix missing trailing newlines in three files
- Remove verbose WP-xxxx inline comments from all templates
@rajivmucheli
[barbican] Merge master, fix conflicts, bump chart to 0.9.0
874ddf6 
- Merge origin/master into bsi-barbican
- Resolve conflict in values.yaml: keep tls block, add rbac.enabled from master
- Resolve conflict in api-deployment.yaml: keep TLS volumes, add
  barbican-tmp and barbican-run emptyDir volumes from master
- Bump chart version 0.8.6 -> 0.9.0
@sapcc-bot

sapcc-bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Failed to validate the helm chart. Details. Readme.

@rajivmucheli
[barbican] Set readOnlyRootFilesystem=false for Apache compatibility
ebb4d09 
Apache writes to /var/run/apache2, /var/log/apache2 and other paths
at runtime that are not covered by emptyDir mounts.
@rajivmucheli
[barbican] Add tls: disabled to ci test-values to prevent nil pointer
b23e7ee
@sapcc-bot

sapcc-bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Failed to validate the helm chart. Details. Readme.

@rajivmucheli
[barbican] Align TLS exposure with keystone PR #12448 (Calico BGP)
4c52c32 
Replace NGINX ingress TLS passthrough with a dedicated LoadBalancer
service using Calico BGP (projectcalico.org/loadBalancerIPs), matching
the approach in #12448.

- Add service-external.yaml: LoadBalancer + Calico BGP when
  tls.enabled=true and global.barbican_external_ip is set
- ingress.yaml: remove passthrough branch; ingress always routes HTTP
  traffic to the internal port
- service.yaml: drop barbican-https port (owned by external service)
- values.yaml: restore full tls block (lost in merge), remove passthrough
  field, add global.barbican_external_ip
- Chart version 0.9.0 -> 0.9.1
@rajivmucheli

rajivmucheli commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

fixed in #12641

@rajivmucheli
rajivmucheli deleted the bsi-barbican branch August 24, 2026 17:11
@rajivmucheli
rajivmucheli restored the bsi-barbican branch August 24, 2026 17:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BerndKue BerndKue BerndKue left review comments
@JoJoPuppe JoJoPuppe Awaiting requested review from JoJoPuppe JoJoPuppe is a code owner
@dorneanu dorneanu Awaiting requested review from dorneanu dorneanu is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rajivmucheli @sapcc-bot @BerndKue