Hardening The Deployment

kubectl --namespace istio-system delete secret keysafe5-server-credential

kubectl --namespace istio-system create secret tls keysafe5-server-credential \
  --cert=path/to/cert/file \
  --key=path/to/key/file

helm upgrade --install keysafe5-istio \
  --namespace=nshieldkeysafe5 \
  --values keysafe5-istio-values.yaml \
  --wait --timeout 1m \
helm-charts/nshield-keysafe5-istio-1.6.1.tgz

  Usage: ./updateinternalcerts.sh [OPTION]... [SERVER] DAYS
         ./updateinternalcerts.sh [OPTION]... [SERVER] DIRECTORY

  Update the internal server and client TLS credentials for a deployment created
  by deploy.sh.

  This can update certificates and keys for both the Agent Communications
  Server and MongoDB as set up by deploy.sh, along with the certificates and
  keys for the KeySafe 5 BackEnd services.  The Agent Communications Server has
  a single key and certificate.  MongoDB has three keys and certificates, two
  for the replica-set, and one for the arbiter.  The KeySafe 5 backend services
  also have two keys and client certificates for connecting to both the Agent
  Communications Server, and MongoDB.

  When using the insecure internal CA, specify when the new keys and certs will
  expire and this script will do the rest.

  When using a secure external CA, all the keys and certificates will have to
  be provided and they will be packaged up for the deployment.

  When you update the certificates for the Agent Communications Server, the
  script will generate an updated agent-config.tar.gz and agent-config.zip
  files containing a config file and ca.crt.

  Certificate Addresses

  The certificates contain names and IP addresses that verify the connection,
  signed by a mutally trusted authority.

  The backend servers only use Kubernetes internal addressing to access
  MongoDB, and 127.0.0.1 for the Agent Communications Server.

  MongoDB is only used by the backend services so does not require an external
  address.

  The Agent Communications Server is also accessed by the KeySafe 5 Agents
  through an external address.

  Shared Optional parameters

  -n, --namespace=NAMESPACE   The deploy script normally uses nshieldkeysafe5
                              as the namespace for the KeySafe 5 servers and
                              mongons for MongoDB.  However you can override
                              these to use a single namespace for all the
                              servers.  If that is the case, then use this
                              option.
  SERVER                      One of "mongodb" or "agentcomms".
                              If the server is not specified then both will
                              be updated.
  Internal CA
  -----------

  DAYS                        Number of days before the generated certificates
                              expire

  This script will use the IP address provided by the loadbalancer, but you may
  override this with a different IP address or DNS name.

  -a, --agentcomms=ADDRESS    The external address for the Agent Communications
                              Server
  -m, --mongodb=ADDRESS       The external address for MongoDB

  External CA
  -----------

  DIRECTORY                   The directory containing the server and client
                              keys and certificates in PEM format.
  Files in the directory
  ----------------------
  ca.crt                      The certificate of the CA that is to be trusted by
                              the system.
  agentcomms.key              The key to be used by the Agent Communications
                              Server
  agentcomms.crt              And its certificate
  ks5agentcomms.key           The key to be used by ks5
  ks5agentcomms.crt           And its certificate
  mongodb-0.key               The key to be used by mongo-chart-mongodb-0
  mongodb-0.crt               And its certificate
  mongodb-1.key               The key to be used by mongo-chart-mongodb-1
  mongodb-1.crt               And its certificate
  mongodb-a.key               The key to be used by mongo-chart-mongodb-arbiter
  mongodb-a.crt               And its certificate
  ks5mongodb.key              The key to be used by ks5-mongo-user
  ks5mongodb.crt              And its certificate

  If agentcomms is specified, the mongodb files may be skipped, and vice versa.

  Internal CA examples

  Refresh certificates for both servers for the next 30 days, and set a DNS
  entry for the Agent Communications Server
    ./updateinternalcerts.sh -r keysafe5.example.com 30

  Refresh just MongoDB for the next 4 weeks
    ./updateinternalcerts.sh mongodb 28

  External CA examples

  Refresh certificates for both servers (and KeySafe 5) in a specific namespace
    ./updateinternalcerts.sh -n kansas all-certs-dir

    Refresh certificates for just MongoDB (and KeySafe 5) in standard namespaces
    ./updateinternalcerts.sh mongodb mongo-certs-dir