From d7bf2d13fdfebed77603e6394c877cad67a5fefe Mon Sep 17 00:00:00 2001 From: Nathan Williams Date: Mon, 29 Jun 2026 12:52:26 -0400 Subject: [PATCH 1/2] CD-3760 Minor revisions for HSM setup script --- setup-cks-hsm-latest.sh | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/setup-cks-hsm-latest.sh b/setup-cks-hsm-latest.sh index c53aad9..965f0bf 100644 --- a/setup-cks-hsm-latest.sh +++ b/setup-cks-hsm-latest.sh @@ -29,13 +29,12 @@ prompt () { updateEnvVariable () { VARIABLE=$1 VALUE=$2 - LINE="$(awk "/${1}/{ print NR; exit }" "$WORKING_DIR"/env/cks.env)" + LINE="$(awk "/^${VARIABLE}=/{ print NR; exit }" "$WORKING_DIR"/env/cks.env)" if [ -z "$LINE" ]; then echo "$VARIABLE=$VALUE" >> "$WORKING_DIR"/env/cks.env else - LINE="$LINE"s - sed -i '.bak' "$LINE|.*|$VARIABLE=$VALUE|" "$WORKING_DIR"/env/cks.env + sed -i "${LINE}s|.*|${VARIABLE}=${VALUE}|" "$WORKING_DIR"/env/cks.env fi } @@ -78,12 +77,12 @@ KEY_PROVIDER_TYPE=hsm CRYPTO_OPERATIONS_TYPE=hsm # SoftHSM2 Config (Test Mode) -if [ $CKS_HSM_TEST_MODE = "1" ]; then +if [ "${CKS_HSM_TEST_MODE:-0}" = "1" ]; then PKCS11_LIB_NAME=SoftHSM2 PKCS11_LIB_PATH=/usr/lib/softhsm/libsofthsm2.so fi -docker run -e HSM_IP="$HSM_IP" -e PKCS11_VENDOR="$PKCS11_VENDOR" -e PKCS11_LIB_NAME="$PKCS11_LIB_NAME" -e PKCS11_LIB_PATH="$PKCS11_LIB_PATH" -e PKCS11_SLOT_LBL="$PKCS11_SLOT_LBL" -e PKCS11_KEY_LBL="$PKCS11_KEY_LBL" -e PKCS11_PIN="$PKCS11_PIN" -e KEY_PROVIDER_TYPE="$KEY_PROVIDER_TYPE" -e CRYPTO_OPERATIONS_TYPE="$CRYPTO_OPERATIONS_TYPE" --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION" list-keys +docker run --rm -e HSM_IP="$HSM_IP" -e PKCS11_VENDOR="$PKCS11_VENDOR" -e PKCS11_LIB_NAME="$PKCS11_LIB_NAME" -e PKCS11_LIB_PATH="$PKCS11_LIB_PATH" -e PKCS11_SLOT_LBL="$PKCS11_SLOT_LBL" -e PKCS11_KEY_LBL="$PKCS11_KEY_LBL" -e PKCS11_PIN="$PKCS11_PIN" -e KEY_PROVIDER_TYPE="$KEY_PROVIDER_TYPE" -e CRYPTO_OPERATIONS_TYPE="$CRYPTO_OPERATIONS_TYPE" --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION" list-keys if prompt "Did the CKS successfully list the keys? Please enter yes or no."; then echo "Updating the environment file at $WORKING_DIR/env/cks.env." @@ -100,9 +99,13 @@ if prompt "Did the CKS successfully list the keys? Please enter yes or no."; the echo "Setup of HSM complete" - if [ $PKCS11_LIB_NAME = "CloudHSM" ]; then - echo "docker run --name Virtru_CKS --interactive --tty --detach --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/ssl,target=/app/ssl --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION" serve" > "$WORKING_DIR/run.sh" + if [ "$PKCS11_LIB_NAME" = "CloudHSM" ]; then + cat > "$WORKING_DIR/run.sh" < "$WORKING_DIR/run.sh" + cat > "$WORKING_DIR/run.sh" < Date: Wed, 9 Sep 2026 09:28:27 -0400 Subject: [PATCH 2/2] CD-4047 Update JWT Issuer for CKS --- setup-cks-latest.sh | 5 ++--- update.sh | 6 +++++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/setup-cks-latest.sh b/setup-cks-latest.sh index 69fdff7..7c214b1 100644 --- a/setup-cks-latest.sh +++ b/setup-cks-latest.sh @@ -18,6 +18,7 @@ KEY_PROVIDER_TYPE="file" KEY_PROVIDER_PATH="/app/keys" HMAC_AUTH_ENABLED=false JWT_AUTH_ENABLED=true +JWT_AUTH_ISSUER="https://api.virtru.com" JWT_AUTH_AUDIENCE="" # KAS defaults @@ -241,6 +242,7 @@ if [ "$HMAC_AUTH_ENABLED" = true ]; then fi if [ "$JWT_AUTH_ENABLED" = true ]; then + printf "JWT_AUTH_ISSUER=%s\n" "$JWT_AUTH_ISSUER" >> ./env/cks.env printf "JWT_AUTH_AUDIENCE=%s\n" $JWT_AUTH_AUDIENCE >> ./env/cks.env fi @@ -281,9 +283,6 @@ if [ "$KAS_ENABLED" = true ]; then printf "KAS_PUBLIC_KEY_FILE=/app/keys/rsa_001.pub\n" >> ./env/cks.env printf "KAS_PRIVATE_KEY_FILE=/app/keys/rsa_001.pem\n" >> ./env/cks.env fi - - # Update JWT_AUTH_ISSUER to match KAS_AUTH_ISSUER for consistency - printf "JWT_AUTH_ISSUER=%s\n" "$KAS_AUTH_ISSUER" >> ./env/cks.env fi # Print Summary diff --git a/update.sh b/update.sh index 1bfe95b..b833d9f 100644 --- a/update.sh +++ b/update.sh @@ -11,6 +11,7 @@ CLEAR="\033c" # Defaults PORT=9000 KEY_PROVIDER_PATH="/app/keys" +JWT_AUTH_ISSUER="https://api.virtru.com" envVariableNotSet () { VARIABLE=$1 @@ -85,6 +86,7 @@ if envVariableNotSet "JWT_AUTH_ENABLED"; then read -p "Enter your Virtru Org ID: " JWT_AUTH_AUDIENCE updateEnvVariable "JWT_AUTH_ENABLED" "true" + updateEnvVariable "JWT_AUTH_ISSUER" "$JWT_AUTH_ISSUER" updateEnvVariable "JWT_AUTH_AUDIENCE" "$JWT_AUTH_AUDIENCE" fi fi @@ -171,7 +173,6 @@ if [ "$KAS_ENABLED" = false ]; then # Caddy fronts traffic on 9000; supervisord pins CKS Node to 3000 internally. # PORT here mirrors the chart's configmap value so cks.env stays aligned. updateEnvVariable "PORT" "9000" - updateEnvVariable "JWT_AUTH_ISSUER" "$KAS_AUTH_ISSUER" printf "\n${GREEN}KAS configuration added successfully.${RESET}\n\n" fi @@ -182,6 +183,9 @@ fi # already provisioned); otherwise prompt the operator for the SaaS-provisioned # Key ID. Anchored grep avoids a false match on WRAPPING_KEY_ID. if [ "$KAS_ENABLED" = true ]; then + # CKS request authentication and KAS OIDC authentication use different issuers. + updateEnvVariable "JWT_AUTH_ISSUER" "$JWT_AUTH_ISSUER" + EXISTING_KEY_ID=$(grep '^KEY_ID=' "$WORKING_DIR"/env/cks.env 2>/dev/null | cut -d "=" -f2-) if [ -z "$EXISTING_KEY_ID" ]; then