Merge pull request #3995 from zowe/apiml/v3/sercurity-conf

move security configuration back to gateway
zowe · Sep 18, 2024 · ee75e1a · ee75e1a
2 parents d2f64cc + f57d956
commit ee75e1a
Show file tree

Hide file tree

Showing 16 changed files with 50 additions and 51 deletions.
diff --git a/bin/commands/internal/start/prepare/index.sh b/bin/commands/internal/start/prepare/index.sh
@@ -145,9 +145,9 @@ global_validate() {
     if [[ ${ZWE_ENABLED_COMPONENTS} == *"discovery"* ]]; then
       validate_this "validate_zosmf_host_and_port \"${ZOSMF_HOST}\" \"${ZOSMF_PORT}\" 2>&1" "zwe-internal-start-prepare,global_validate:${LINENO}"
     else
-      if [ "${ZWE_components_zaas_apiml_security_auth_provider}" = "zosmf" ]; then
+      if [ "${ZWE_components_gateway_apiml_security_auth_provider}" = "zosmf" ]; then
         let "ZWE_PRIVATE_ERRORS_FOUND=${ZWE_PRIVATE_OLD_ERRORS_FOUND}+1"
-        print_error "Using z/OSMF as 'components.zaas.apiml.security.auth.provider' is not possible: discovery is disabled."
+        print_error "Using z/OSMF as 'components.gateway.apiml.security.auth.provider' is not possible: discovery is disabled."
         print_formatted_info "ZWELS" "zwe-internal-start-prepare,global_validate:${LINENO}" "Zosmf validation failed"
       fi
     fi

diff --git a/bin/commands/internal/start/prepare/index.ts b/bin/commands/internal/start/prepare/index.ts
@@ -172,9 +172,9 @@ function globalValidate(enabledComponents:string[]): void {
         privateErrors++;
         common.printFormattedError('ZWELS', "zwe-internal-start-prepare,global_validate", "Zosmf validation failed");
       }
-    } else if (std.getenv('ZWE_components_zaas_apiml_security_auth_provider') == "zosmf") {
+    } else if (std.getenv('ZWE_components_gateway_apiml_security_auth_provider') == "zosmf") {
         privateErrors++;
-        common.printError("Using z/OSMF as 'components.zaas.apiml.security.auth.provider' is not possible: discovery is disabled.");
+        common.printError("Using z/OSMF as 'components.gateway.apiml.security.auth.provider' is not possible: discovery is disabled.");
         common.printFormattedError('ZWELS', "zwe-internal-start-prepare,global_validate", "Zosmf validation failed");
     }
   }

diff --git a/bin/commands/migrate/for/kubernetes/index.sh b/bin/commands/migrate/for/kubernetes/index.sh
@@ -204,7 +204,7 @@ done
 
 update_zowe_yaml "${temp_dir}/zowe.yaml" "zowe.externalPort" "${ZWE_CLI_PARAMETER_EXTERNAL_PORT}"
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.gateway.port" "7554"
-update_zowe_yaml "${temp_dir}/zowe.yaml" "components.zaas.port" "7563"
+update_zowe_yaml "${temp_dir}/zowe.yaml" "components.zaas.port" "7558"
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.discovery.port" "7553"
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.api-catalog.port" "7552"
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.caching-service.port" "7555"
@@ -220,13 +220,13 @@ update_zowe_yaml "${temp_dir}/zowe.yaml" "components.explorer-jes.enabled" "true
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.explorer-mvs.enabled" "true"
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.explorer-uss.enabled" "true"
 
-update_zowe_yaml "${temp_dir}/zowe.yaml" "components.zaas.apiml.security.x509.externalMapperUrl" ""
-update_zowe_yaml "${temp_dir}/zowe.yaml" "components.zaas.apiml.security.authorization.endpoint.url" ""
-zaas_auth_provider=$(read_yaml "${temp_dir}/zowe.yaml" ".components.zaas.apiml.security.authorization.endpoint.provider")
+update_zowe_yaml "${temp_dir}/zowe.yaml" "components.gateway.apiml.security.x509.externalMapperUrl" ""
+update_zowe_yaml "${temp_dir}/zowe.yaml" "components.gateway.apiml.security.authorization.endpoint.url" ""
+zaas_auth_provider=$(read_yaml "${temp_dir}/zowe.yaml" ".components.gateway.apiml.security.authorization.endpoint.provider")
 if [ "${zaas_auth_provider}" != "" ]; then
   print_message "Zowe APIML ZAAS authorization provider is suggested to be empty when running in Kubernetes. 'native' is not supported off Z platform."
 fi
-update_zowe_yaml "${temp_dir}/zowe.yaml" "components.zaas.apiml.security.authorization.endpoint.provider" ""
+update_zowe_yaml "${temp_dir}/zowe.yaml" "components.gateway.apiml.security.authorization.endpoint.provider" ""
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.discovery.replicas" "1"
 update_zowe_yaml "${temp_dir}/zowe.yaml" "components.caching-service.storage.mode" ""
 

diff --git a/containers/kubernetes/samples/config-cm.yaml b/containers/kubernetes/samples/config-cm.yaml
@@ -90,7 +90,7 @@ data:
 
       zaas:
         enabled: true
-        port: 7563
+        port: 7558
         debug: false
 
       discovery:

diff --git a/containers/kubernetes/samples/zaas-service.yaml b/containers/kubernetes/samples/zaas-service.yaml
@@ -20,6 +20,6 @@ spec:
   ports:
     - name: zaas
       protocol: TCP
-      port: 7563
+      port: 7558
       targetPort: zaas-port
       appProtocol: https
diff --git a/containers/kubernetes/workloads/zaas-deployment.yaml b/containers/kubernetes/workloads/zaas-deployment.yaml
@@ -61,17 +61,17 @@ spec:
               cpu: "700m"
           ports:
             - name: zaas-port
-              containerPort: 7563
+              containerPort: 7558
               protocol: TCP
           startupProbe:
             tcpSocket:
-              port: 7563
+              port: 7558
             # this should give 90 * periodSeconds(default to 10) seconds about 15 minutes to confirm it's ready
             periodSeconds: 10
             failureThreshold: 90
           livenessProbe:
             tcpSocket:
-              port: 7563
+              port: 7558
             # this should give 3 * periodSeconds(default to 10) seconds about 30 seconds to confirm it's offline
             periodSeconds: 10
             failureThreshold: 3

diff --git a/example-zowe.yaml b/example-zowe.yaml
@@ -518,18 +518,6 @@ components:
     enabled: true
     port: 7554
     debug: false
-
-    # If we customize this to use different external certificate, than should also
-    # define "server.internal.ssl.certificate" and enable "server.internal.ssl.enabled".
-    # certificate:
-    #   keystore:
-    #     alias: ""
-
-  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
-  zaas:
-    enabled: true
-    port: 7563
-    debug: false
     apiml:
       security:
         auth:
@@ -543,6 +531,18 @@ components:
           provider: "native"
         x509:
           enabled: false
+
+    # If we customize this to use different external certificate, than should also
+    # define "server.internal.ssl.certificate" and enable "server.internal.ssl.enabled".
+    # certificate:
+    #   keystore:
+    #     alias: ""
+
+  # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+  zaas:
+    enabled: true
+    port: 7558
+    debug: false
   # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
   api-catalog:
     enabled: true

diff --git a/files/defaults.yaml b/files/defaults.yaml
@@ -177,7 +177,7 @@ components:
   # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
   cloud-gateway:
     enabled: false
-    port: 7563
+    port: 7558
     debug: false
 
   # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

diff --git a/playbooks/all_host_vars_list.yml b/playbooks/all_host_vars_list.yml
@@ -28,7 +28,7 @@ zos_zosmf_user: IZUSVR
 zowe_apiml_catalog_port: 7552
 zowe_apiml_discovery_port: 7553
 zowe_apiml_gateway_port: 7554
-zowe_apiml_zaas_port: 7563
+zowe_apiml_zaas_port: 7558
 zowe_apiml_gateway_timeout_millis: 600000
 zowe_apiml_nonstrict_verify_certficates_of_services: true
 zowe_apiml_security_auth_provider: zosmf

diff --git a/playbooks/roles/configfmid/tasks/main.yml b/playbooks/roles/configfmid/tasks/main.yml
@@ -290,14 +290,14 @@
       "components.gateway.apiml.gateway.timeoutMillis": "{{ zowe_apiml_gateway_timeout_millis }}"
 
       # zaas settings
-      "components.zaas.apiml.security.x509.enabled": "{{ zowe_apiml_security_x509_enabled|string|lower }}"
-      "components.zaas.apiml.security.auth.provider": "{{ zowe_apiml_security_auth_provider|string|lower }}"
-      "components.zaas.apiml.security.auth.zosmf.jwtAutoconfiguration": "{{ zowe_apiml_security_zosmf_jwt_autoconfiguration_mode }}"
-      "components.zaas.apiml.security.oidc.enabled": "{{ zowe_apiml_security_oidc_enabled|string|lower }}"
-      "components.zaas.apiml.security.oidc.clientId": "{{ zowe_apiml_security_oidc_client_id|string }}"
-      "components.zaas.apiml.security.oidc.clientSecret": "{{ zowe_apiml_security_oidc_client_secret|string }}"
-      "components.zaas.apiml.security.oidc.registry": "{{ zowe_apiml_security_oidc_registry|string }}"
-      "components.zaas.apiml.security.oidc.jwks.uri": "{{ zowe_apiml_security_oidc_jwks_uri|string }}"
+      "components.gateway.apiml.security.x509.enabled": "{{ zowe_apiml_security_x509_enabled|string|lower }}"
+      "components.gateway.apiml.security.auth.provider": "{{ zowe_apiml_security_auth_provider|string|lower }}"
+      "components.gateway.apiml.security.auth.zosmf.jwtAutoconfiguration": "{{ zowe_apiml_security_zosmf_jwt_autoconfiguration_mode }}"
+      "components.gateway.apiml.security.oidc.enabled": "{{ zowe_apiml_security_oidc_enabled|string|lower }}"
+      "components.gateway.apiml.security.oidc.clientId": "{{ zowe_apiml_security_oidc_client_id|string }}"
+      "components.gateway.apiml.security.oidc.clientSecret": "{{ zowe_apiml_security_oidc_client_secret|string }}"
+      "components.gateway.apiml.security.oidc.registry": "{{ zowe_apiml_security_oidc_registry|string }}"
+      "components.gateway.apiml.security.oidc.jwks.uri": "{{ zowe_apiml_security_oidc_jwks_uri|string }}"
       # desktop customizations
       "zowe.environments.ZWED_SSH_PORT": "{{ zowe_zlux_terminal_ssh_port }}"
       "zowe.environments.ZWED_TN3270_PORT": "{{ zowe_zlux_terminal_telnet_port }}"

diff --git a/playbooks/roles/configure/defaults/main.yml b/playbooks/roles/configure/defaults/main.yml
@@ -54,7 +54,7 @@ zos_zosmf_ca:
 zowe_apiml_catalog_port: 7552
 zowe_apiml_discovery_port: 7553
 zowe_apiml_gateway_port: 7554
-zowe_apiml_zaas_port: 7563
+zowe_apiml_zaas_port: 7558
 zowe_apiml_verify_certficates_of_services: true
 zowe_apiml_nonstrict_verify_certficates_of_services: true
 # APIML configuration properties

diff --git a/playbooks/roles/configure/tasks/main.yml b/playbooks/roles/configure/tasks/main.yml
@@ -290,18 +290,17 @@
       "components.zss.port": "{{ zowe_zss_port }}"
       # other gateway configs
       "components.gateway.apiml.gateway.timeoutMillis": "{{ zowe_apiml_gateway_timeout_millis }}"
-      "components.gateway.apiml.security.x509.enabled": "{{ zowe_apiml_security_x509_enabled|string|lower }}"
       "components.gateway.apiml.service.forwardClientCertEnabled": "{{ zowe_apiml_service_forwardClientCertEnabled|string|lower }}"
 
       # zaas configs
-      "components.zaas.apiml.security.x509.enabled": "{{ zowe_apiml_security_x509_enabled|string|lower }}"
-      "components.zass.apiml.security.auth.provider": "{{ zowe_apiml_security_auth_provider|string|lower }}"
-      "components.zaas.apiml.security.auth.zosmf.jwtAutoconfiguration": "{{ zowe_apiml_security_zosmf_jwt_autoconfiguration_mode }}"
-      "components.zaas.apiml.security.oidc.enabled": "{{ zowe_apiml_security_oidc_enabled|string|lower }}"
-      "components.zaas.apiml.security.oidc.clientId": "{{ zowe_apiml_security_oidc_client_id|string }}"
-      "components.zaas.apiml.security.oidc.clientSecret": "{{ zowe_apiml_security_oidc_client_secret|string }}"
-      "components.zaas.apiml.security.oidc.registry": "{{ zowe_apiml_security_oidc_registry|string }}"
-      "components.zaas.apiml.security.oidc.jwks.uri": "{{ zowe_apiml_security_oidc_jwks_uri|string }}"
+      "components.gateway.apiml.security.x509.enabled": "{{ zowe_apiml_security_x509_enabled|string|lower }}"
+      "components.gateway.apiml.security.auth.provider": "{{ zowe_apiml_security_auth_provider|string|lower }}"
+      "components.gateway.apiml.security.auth.zosmf.jwtAutoconfiguration": "{{ zowe_apiml_security_zosmf_jwt_autoconfiguration_mode }}"
+      "components.gateway.apiml.security.oidc.enabled": "{{ zowe_apiml_security_oidc_enabled|string|lower }}"
+      "components.gateway.apiml.security.oidc.clientId": "{{ zowe_apiml_security_oidc_client_id|string }}"
+      "components.gateway.apiml.security.oidc.clientSecret": "{{ zowe_apiml_security_oidc_client_secret|string }}"
+      "components.gateway.apiml.security.oidc.registry": "{{ zowe_apiml_security_oidc_registry|string }}"
+      "components.gateway.apiml.security.oidc.jwks.uri": "{{ zowe_apiml_security_oidc_jwks_uri|string }}"
       # desktop customizations
       "zowe.environments.ZWED_SSH_PORT": "{{ zowe_zlux_terminal_ssh_port }}"
       "zowe.environments.ZWED_TN3270_PORT": "{{ zowe_zlux_terminal_telnet_port }}"

diff --git a/playbooks/roles/custom_for_test/defaults/main.yml b/playbooks/roles/custom_for_test/defaults/main.yml
@@ -54,7 +54,7 @@ zos_zosmf_ca:
 zowe_apiml_catalog_port: 7552
 zowe_apiml_discovery_port: 7553
 zowe_apiml_gateway_port: 7554
-zowe_apiml_cloud_gateway_port: 7563
+zowe_apiml_zaas_port: 7558
 zowe_apiml_verify_certficates_of_services: true
 zowe_apiml_nonstrict_verify_certficates_of_services: true
 # APIML configuration properties

diff --git a/playbooks/roles/verify/defaults/main.yml b/playbooks/roles/verify/defaults/main.yml
@@ -27,6 +27,6 @@ zowe_job_prefix: ZWE
 zowe_proclib_membername: ZWESLSTC
 zowe_instance_id: 1
 # ports will be tested
-zowe_apiml_zaas_port: 7563
+zowe_apiml_zaas_port: 7558
 zowe_apiml_gateway_port: 7554
 zowe_zlux_port: 7556
diff --git a/workflows/files/ZWECONF.properties b/workflows/files/ZWECONF.properties
@@ -383,7 +383,7 @@ components_zaas_enabled=true
 # Category: components
 # Description:
 #  Port for the APIML ZAAS
-components_zaas_port=7563
+components_zaas_port=7558
 
 # components_zaas_debug
 # Label: ZAAS debug

diff --git a/workflows/files/ZWECONF.xml b/workflows/files/ZWECONF.xml
@@ -553,7 +553,7 @@ How we want to verify SSL certificates of services. Valid values are:
     <integer>
       <!-- Put validation here -->
       <!-- Specify choices here -->
-      <default>7563</default>
+      <default>7558</default>
     </integer>
   </variable>
   <variable name="components_zaas_debug" scope="instance" visibility="public">
@@ -2022,7 +2022,7 @@ echo '          enabled: ${instance-components_zaas_apiml_security_x509_enabled}
 #if (${instance-components_zaas_enabled} == "false" )
 echo '  zaas:' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"
 echo '    enabled: ${instance-components_zaas_enabled}' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"
-echo '    port: 7563' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"
+echo '    port: 7558' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"
 echo '    debug: false' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"
 echo '    apiml:' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"
 echo '      security:' >> "${instance-zowe_runtimeDirectory}/zowe.yaml"