Merge pull request #4 from topcoder-platform/issue-131

For #131: Port self-signed cert changes over to AWS DLP

Author: jmgasper

DLPTrigger/utils/presidio.ts

@@ -1,4 +1,7 @@
 import axios, { AxiosRequestConfig } from 'axios'
+import https from 'https'
+
+const httpsAgent = new https.Agent({ rejectUnauthorized: false })
 
 /**
  * Presidio Analyze Response item
@@ -26,8 +29,12 @@ export async function identifyPII (dataString: string): Promise<PresidioRes> {
     data: {
       text: dataString,
       language: 'en'
-    }
+    },
+    headers: {
+      Host: 'tcx-presidio.svc'
+    },
+    httpsAgent
   }
-  const res = await axios(requestConfig)
-  return res.data as PresidioRes
+  const res = await axios.request<PresidioRes>(requestConfig)
+  return res.data
 }

deployment/charts/presidio/templates/_helpers.tpl

@@ -24,6 +24,12 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- define "presidio.anonymizerimage.fullname" -}}
 {{ include "presidio.fullname" . | printf "%s-image-redactor" }}
 {{- end -}}
+{{- define "presidio.ingress.fullname" -}}
+{{ include "presidio.fullname" . | printf "%s-ingress" }}
+{{- end -}}
+{{- define "presidio.ingress.cert.secretname" -}}
+{{ include "presidio.fullname" . | printf "%s-ingress-cert" }}
+{{- end -}}
 
 {{- define "presidio.analyzer.address" -}}
 {{template "presidio.analyzer.fullname" .}}:{{.Values.analyzer.service.externalPort}}
@@ -37,4 +43,13 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{template "presidio.anonymizerimage.fullname" .}}:{{.Values.anonymizerimage.service.externalPort}}
 {{- end -}}
 
-{{- define "presidio.rbac.version" }}rbac.authorization.k8s.io/v1{{ end -}}
+{{- define "presidio.rbac.version" }}rbac.authorization.k8s.io/v1{{ end -}}
+
+{{/* Generate certificates for custom-metrics api server */}}
+{{- define "tcx-presidio.gen-certs" -}}
+{{- $ca := genCA (.Values.caCommonName) 365 -}}
+{{- $altNames := list (.Values.certDomainName) -}}
+{{- $cert := genSignedCert (.Values.certDomainName) nil $altNames 365 $ca -}}
+tls.crt: {{ $cert.Cert | b64enc }}
+tls.key: {{ $cert.Key | b64enc }}
+{{- end -}}

deployment/charts/presidio/templates/ingress-cert.yaml

@@ -0,0 +1,16 @@
+{{- $ingressCertSecretName := include "presidio.ingress.cert.secretname" . -}}
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/tls
+metadata:
+  name: {{ $ingressCertSecretName }}
+  labels:
+    app: {{ $ingressCertSecretName }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": "pre-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+data:
+{{ ( include "tcx-presidio.gen-certs" . ) | indent 2 }}

deployment/charts/presidio/templates/ingress.yaml

@@ -1,22 +1,29 @@
 {{- if and (.Values.ingress.enabled) (eq .Values.ingress.class "nginx") -}}
+{{- $ingressName := include "presidio.ingress.fullname" . -}}
+{{- $ingressCertSecretName := include "presidio.ingress.cert.secretname" . -}}
 {{- $analyzerfullname := include "presidio.analyzer.fullname" . -}}
 {{- $anonymizerfullname := include "presidio.anonymizer.fullname" . -}}
 {{- $anonymizerimagefullname := include "presidio.anonymizerimage.fullname" . -}}
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
-  name: presidio-ingress
+  name: {{ $ingressName }}
   labels:
-    app: presidio-ingress
+    app: {{ $ingressName }}
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
   annotations:
     kubernetes.io/ingress.class: {{ .Values.ingress.class }}
     nginx.ingress.kubernetes.io/rewrite-target: "/$2"
 spec:
+  tls:
+  - hosts:
+    - "{{ .Values.certDomainName }}"
+    secretName: {{ $ingressCertSecretName }}
   rules:
-  - http:
+  - host: "{{ .Values.certDomainName }}"
+    http:
       paths:
       - backend:
           serviceName: {{ $analyzerfullname }}

deployment/charts/presidio/values.yaml

@@ -66,3 +66,6 @@ anonymizerimage:
     externalPort: 80
     internalPort: 8080
     name: http
+
+certDomainName: tcx-presidio.svc
+caCommonName: tcx-presidio.ca