barbican: TLS termination at Apache (BSI ADR-406 Step 2)

[rajivmucheli]

Step 2 of BSI ADR-406: TLS termination moves from nginx ingress to Apache mod_ssl on the pod.

Depends on #12554 (Apache migration — merged).

Changes

• service-external.yaml (new): Calico BGP LoadBalancer port 443; spec.externalIPs required (serviceExternalIPs BGP config); disco Record CR for DNS A record (disco only manages DNS for Ingress, not LoadBalancer Services); spec.zoneName set to <region>.<tld>; gated on global.barbican_external_ip
• etc/_tls-hardening.conf.tpl (new): BSI TR-02102-2 cipher suites — TLS 1.2+1.3 only, SSLHonorCipherOrder on, compression off, session tickets off
• etc/_wsgi-barbican.conf.tpl: SSL VirtualHost *:443 gated on tls.enabled; LoadModule ssl_module inline (no a2enmod, compatible with readOnlyRootFilesystem: true)
• api-deployment.yaml: containerPort 443; cert Secret mount at /etc/apache2/ssl; config.linkerd.io/skip-inbound-ports: "443"; reloader watches TLS cert secret for rotation pickup
• ingress.yaml: gated on ingress.enabled (default true) — ingress kept alive during TLS rollout as fallback; remove in a follow-up secrets change per region after BGP path confirmed
• values.yaml: tls.enabled, tls.certSecret, ingress.enabled
• Chart.yaml: 0.9.0 → 0.9.1

Cert management

cert-manager + ClusterIssuer: digicert-issuer. Secret tls-keymanager-3-<region>-cloud-sap provisioned per-region via Certificate CR. Already READY: True in qa-de-1 (age 202d) — Apache mounts the existing Secret.

Rollout sequence per region

1. Set global.barbican_external_ip, tls.enabled: true, tls.certSecret in secrets repo
2. Deploy — TLS up, ingress still alive as fallback
3. Validate: TLS handshake, authenticated API call, check logs for https:// scheme
4. Follow-up secrets change: ingress.enabled: false → removes nginx ingress

Validated on qa-de-1

• TLS 1.3: TLS_AES_256_GCM_SHA384, digicert cert, Verification OK
• TLS 1.2: ECDHE-RSA-AES256-GCM-SHA384 (BSI cipher)
• TLS 1.0/1.1 rejected
• Barbican middleware logs https:// scheme confirming TLS e2e
• HSM PKCS#11 path intact, normal latency

Test plan

• helm template renders correctly with qa-de-1 values
• Deploy to qa-de-1 — pods 6/6 Running
• TLS 1.3 + TLS 1.2 (BSI ciphers) verified
• TLS 1.0/1.1 rejected
• Secret ops working through Apache + mod_ssl (HSM path intact)
• Barbican middleware logs https:// scheme
• Follow-up: set ingress.enabled: false per region after BGP path confirmed

[rajivmucheli]

fixed in #12641