Skip to content

CD-4047 Setup Script Issuer fix #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nwilliamsgit wants to merge 2 commits into
base: main
Choose a base branch
from
Open

CD-4047 Setup Script Issuer fix #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d7bf2d1
CD-3760 Minor revisions for HSM setup script
nwilliamsgit Jun 29, 2026
e75beb2
CD-4047 Update JWT Issuer for CKS
nwilliamsgit Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions setup-cks-hsm-latest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,12 @@ prompt () {
updateEnvVariable () {
VARIABLE=$1
VALUE=$2
LINE="$(awk "/${1}/{ print NR; exit }" "$WORKING_DIR"/env/cks.env)"
LINE="$(awk "/^${VARIABLE}=/{ print NR; exit }" "$WORKING_DIR"/env/cks.env)"

if [ -z "$LINE" ]; then
echo "$VARIABLE=$VALUE" >> "$WORKING_DIR"/env/cks.env
else
LINE="$LINE"s
sed -i '.bak' "$LINE|.*|$VARIABLE=$VALUE|" "$WORKING_DIR"/env/cks.env
sed -i "${LINE}s|.*|${VARIABLE}=${VALUE}|" "$WORKING_DIR"/env/cks.env
fi
}

Expand Down Expand Up @@ -78,12 +77,12 @@ KEY_PROVIDER_TYPE=hsm
CRYPTO_OPERATIONS_TYPE=hsm

# SoftHSM2 Config (Test Mode)
if [ $CKS_HSM_TEST_MODE = "1" ]; then
if [ "${CKS_HSM_TEST_MODE:-0}" = "1" ]; then
PKCS11_LIB_NAME=SoftHSM2
PKCS11_LIB_PATH=/usr/lib/softhsm/libsofthsm2.so
fi

docker run -e HSM_IP="$HSM_IP" -e PKCS11_VENDOR="$PKCS11_VENDOR" -e PKCS11_LIB_NAME="$PKCS11_LIB_NAME" -e PKCS11_LIB_PATH="$PKCS11_LIB_PATH" -e PKCS11_SLOT_LBL="$PKCS11_SLOT_LBL" -e PKCS11_KEY_LBL="$PKCS11_KEY_LBL" -e PKCS11_PIN="$PKCS11_PIN" -e KEY_PROVIDER_TYPE="$KEY_PROVIDER_TYPE" -e CRYPTO_OPERATIONS_TYPE="$CRYPTO_OPERATIONS_TYPE" --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION" list-keys
docker run --rm -e HSM_IP="$HSM_IP" -e PKCS11_VENDOR="$PKCS11_VENDOR" -e PKCS11_LIB_NAME="$PKCS11_LIB_NAME" -e PKCS11_LIB_PATH="$PKCS11_LIB_PATH" -e PKCS11_SLOT_LBL="$PKCS11_SLOT_LBL" -e PKCS11_KEY_LBL="$PKCS11_KEY_LBL" -e PKCS11_PIN="$PKCS11_PIN" -e KEY_PROVIDER_TYPE="$KEY_PROVIDER_TYPE" -e CRYPTO_OPERATIONS_TYPE="$CRYPTO_OPERATIONS_TYPE" --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION" list-keys

if prompt "Did the CKS successfully list the keys? Please enter yes or no."; then
echo "Updating the environment file at $WORKING_DIR/env/cks.env."
Expand All @@ -100,9 +99,13 @@ if prompt "Did the CKS successfully list the keys? Please enter yes or no."; the

echo "Setup of HSM complete"

if [ $PKCS11_LIB_NAME = "CloudHSM" ]; then
echo "docker run --name Virtru_CKS --interactive --tty --detach --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/ssl,target=/app/ssl --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION" serve" > "$WORKING_DIR/run.sh"
if [ "$PKCS11_LIB_NAME" = "CloudHSM" ]; then
cat > "$WORKING_DIR/run.sh" <<EOF
docker run --name Virtru_CKS --interactive --tty --detach --restart unless-stopped --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/ssl,target=/app/ssl --mount type=bind,source="$WORKING_DIR"/hsm-config/customerCA.crt,target=/opt/cloudhsm/etc/customerCA.crt containers.virtru.com/cks:v"$CKS_VERSION"
EOF
else
echo "docker run --name Virtru_CKS --interactive --tty --detach --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/ssl,target=/app/ssl containers.virtru.com/cks:v"$CKS_VERSION" serve" > "$WORKING_DIR/run.sh"
cat > "$WORKING_DIR/run.sh" <<EOF
docker run --name Virtru_CKS --interactive --tty --detach --restart unless-stopped --env-file "$WORKING_DIR"/env/cks.env -p 443:$PORT --mount type=bind,source="$WORKING_DIR"/keys,target="$KEY_PROVIDER_PATH" --mount type=bind,source="$WORKING_DIR"/ssl,target=/app/ssl containers.virtru.com/cks:v"$CKS_VERSION"
EOF
fi
fi
5 changes: 2 additions & 3 deletions setup-cks-latest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ KEY_PROVIDER_TYPE="file"
KEY_PROVIDER_PATH="/app/keys"
HMAC_AUTH_ENABLED=false
JWT_AUTH_ENABLED=true
JWT_AUTH_ISSUER="https://api.virtru.com"
JWT_AUTH_AUDIENCE=""

# KAS defaults
Expand Down Expand Up @@ -241,6 +242,7 @@ if [ "$HMAC_AUTH_ENABLED" = true ]; then
fi

if [ "$JWT_AUTH_ENABLED" = true ]; then
printf "JWT_AUTH_ISSUER=%s\n" "$JWT_AUTH_ISSUER" >> ./env/cks.env
printf "JWT_AUTH_AUDIENCE=%s\n" $JWT_AUTH_AUDIENCE >> ./env/cks.env
fi

Expand Down Expand Up @@ -281,9 +283,6 @@ if [ "$KAS_ENABLED" = true ]; then
printf "KAS_PUBLIC_KEY_FILE=/app/keys/rsa_001.pub\n" >> ./env/cks.env
printf "KAS_PRIVATE_KEY_FILE=/app/keys/rsa_001.pem\n" >> ./env/cks.env
fi

# Update JWT_AUTH_ISSUER to match KAS_AUTH_ISSUER for consistency
printf "JWT_AUTH_ISSUER=%s\n" "$KAS_AUTH_ISSUER" >> ./env/cks.env
fi

# Print Summary
Expand Down
6 changes: 5 additions & 1 deletion update.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ CLEAR="\033c"
# Defaults
PORT=9000
KEY_PROVIDER_PATH="/app/keys"
JWT_AUTH_ISSUER="https://api.virtru.com"

envVariableNotSet () {
VARIABLE=$1
Expand Down Expand Up @@ -85,6 +86,7 @@ if envVariableNotSet "JWT_AUTH_ENABLED"; then
read -p "Enter your Virtru Org ID: " JWT_AUTH_AUDIENCE

updateEnvVariable "JWT_AUTH_ENABLED" "true"
updateEnvVariable "JWT_AUTH_ISSUER" "$JWT_AUTH_ISSUER"
updateEnvVariable "JWT_AUTH_AUDIENCE" "$JWT_AUTH_AUDIENCE"
fi
fi
Expand Down Expand Up @@ -171,7 +173,6 @@ if [ "$KAS_ENABLED" = false ]; then
# Caddy fronts traffic on 9000; supervisord pins CKS Node to 3000 internally.
# PORT here mirrors the chart's configmap value so cks.env stays aligned.
updateEnvVariable "PORT" "9000"
updateEnvVariable "JWT_AUTH_ISSUER" "$KAS_AUTH_ISSUER"

printf "\n${GREEN}KAS configuration added successfully.${RESET}\n\n"
fi
Expand All @@ -182,6 +183,9 @@ fi
# already provisioned); otherwise prompt the operator for the SaaS-provisioned
# Key ID. Anchored grep avoids a false match on WRAPPING_KEY_ID.
if [ "$KAS_ENABLED" = true ]; then
# CKS request authentication and KAS OIDC authentication use different issuers.
updateEnvVariable "JWT_AUTH_ISSUER" "$JWT_AUTH_ISSUER"

EXISTING_KEY_ID=$(grep '^KEY_ID=' "$WORKING_DIR"/env/cks.env 2>/dev/null | cut -d "=" -f2-)

if [ -z "$EXISTING_KEY_ID" ]; then
Expand Down