Hardserver containers

The hardserver container controls communication between the configured nShield Connect HSMs and application containers. Only one hardserver container is required per deployment, regardless of the number of nShield Connects or application containers. For information about how many hardserver containers are permitted in a deployment, see License restrictions.

Creating the hardserver image

Create the hardserver image by using either the builder tool or the hardserver Dockerfile template located in /opt/nfast/containers/templates. The only required arguments are the path to a directory containing the nShield packages and the type of container (hardserver). The base image and tag can be supplied.

For example:

$ python3 /opt/nfast/containers/builder.py \
          --tag nshield-hardserver \
          --base redhat/ubi9-micro:9.8 \
          nshield-packages hardserver
$ docker build --build-arg "PACKAGES_DIR=." \
               --build-arg "BASE_IMAGE=redhat/ubi9-micro:9.8" \
               --file "/opt/nfast/containers/templates/hardserver/Dockerfile" \
               --target hardserver \
               --tag nshield-hardserver \
               nshield-packages

The default base image for nShield hardserver containers is Red Hat UBI10-Micro. When you use the builder tool, the default tag reflects the type of container built (nshield-container/hardserver). See builder.py --help for more options.

Configuring the hardserver container

The hardserver kneti file can be generated as follows:

/opt/nfast/sbin/hardserver --generate-kneti <path to kneti file>

The hardserver container’s configuration file can be created from the default template generated with cfg-mkdefault -f FILE. The nethsm_imports section must contain the details of the HSMs to be used by the hardserver container:

[nethsm_imports]
local_module=0
remote_esn=1111-2222-3333
remote_ip=127.0.0.1
remote_port=9004
keyhash=0000000000000000000000000000000000000000
privileged=0

The keyhash can be retrieved with the anonkneti command.

Different configuration files can be used for different container deployments.

Verify the configuration file values against those displayed on the front panel or obtained through another trusted method.

Running the hardserver container with Docker

To run the hardserver container, you must:

  • Supply the generated hardserver configuration to the container

  • Mount a volume for the /opt/nfast/sockets folder

  • Mount a hardserver kneti file in /opt/nfast/hardserver.d/kneti-hardserver

For example:

$ docker volume create nfast_socket
$ docker run \
    -v nfast_socket:/opt/nfast/sockets \
    -v <path to config>:/opt/nfast/kmdata/config/config:ro \
    -v <path to kneti file>:/opt/nfast/hardserver.d/kneti-hardserver:ro \
    nshield-hardserver

This makes the hardserver available via the sockets in the Docker volume nfast_socket.

The config volume should contain the hardserver’s configuration file. The kmlocal volume should be a writable persistent volume for the keys, softcards and cardset files used by the application containers.