OpenShift Container Platform

Configure OpenShift Container Platform

Set up Luna HSM

Ensure the HSM is set up, initialized, provisioned, and ready for deployment.

Connect to a Red Hat Enterprise Linux (RHEL) system (RHEL7/RHEL8/RHEL CoreOS) as a user with administrative privileges.

Copy the LunaClient Minimal tar file to a suitable location.

Create a directory where you will extract the file. For example:

mkdir -p /var/usrlocal/luna

Extract the LunaClient Minimal tar file into /var/usrlocal/luna:

tar xvf LunaClient-Minimal-10.3.0-275.x86_64.tar --strip 1 -C /var/usrlocal/luna

Navigate to the Luna directory:

cd /var/usrlocal/luna/

Create a directory for certificates and configuration files:

mkdir -p /var/usrlocal/luna/config/certs

Copy the configuration template file to the config directory:

cp /var/usrlocal/luna/Chrystoki-template.conf /var/usrlocal/luna/config/Chrystoki.conf

Set the ChrystokiConfigurationPath environment variable:

export ChrystokiConfigurationPath=/var/usrlocal/luna/config

Update the PATH environment variable to include LunaClient utilities:

export PATH="/var/usrlocal/luna/bin/64:${PATH}"

Modify the Chrystoki.conf file using the configurator utility:

configurator setValue -s Chrystoki2 -e LibUNIX -v /var/usrlocal/luna/libs/64/libCryptoki2.so
configurator setValue -s Chrystoki2 -e LibUNIX64 -v /var/usrlocal/luna/libs/64/libCryptoki2_64.so
configurator setValue -s Misc -e ToolsDir -v /var/usrlocal/luna/bin/64
configurator setValue -s "LunaSA Client" -e SSLConfigFile -v /var/usrlocal/luna/openssl.cnf
configurator setValue -s "LunaSA Client" -e ClientPrivKeyFile -v /var/usrlocal/luna/config/certs/dockerclientKey.pem
configurator setValue -s "LunaSA Client" -e ClientCertFile -v /var/usrlocal/luna/config/certs/dockerclient.pem
configurator setValue -s "LunaSA Client" -e ServerCAFile -v /var/usrlocal/luna/config/certs/CAFile.pem
configurator removeSection -s "Secure Trusted Channel"

You can alternatively use any text editor to manually modify the Chrystoki.conf file.

Create a Luna HSM Client certificate for the containers:

vtl createCert -n dockerclient

Here, dockerclient is the name of the client certificate.

Copy the client certificate to the Luna Network HSM appliance:

scp /var/usrlocal/luna/config/certs/dockerclient.pem admin@10.124.143.158:

Here, 10.124.143.158 is the HSM appliance's IP address.

Copy the Luna HSM server certificate (server.pem) to the config directory:

scp admin@10.124.143.158:server.pem /var/usrlocal/luna/config/certs/

Register the Luna HSM server certificate with the client:

vtl addServer -c /var/usrlocal/luna/config/certs/server.pem -n 10.124.143.158

Connect to the Luna Network HSM appliance via SSH and log in to LunaSH:

ssh admin@10.124.143.158

Provide the admin password when prompted.

Register the client with the Luna HSM:

client register -client dockerclient -hostname dockerclient

Create a partition on the HSM (if none exists):

partition create -partition 

Assign the partition to the client:

client assignPartition -partition  -client dockerclient

To use multiple containers with the same IP address, disable the ntls ipcheck to avoid the containers appearing as the same client to the HSM:

ntls ipcheck disable

For multiple containers with unique IP addresses, enable ntls ipcheck since each container is treated as a separate client and requires its own configuration file and unique certificates:

ntls ipcheck enable

Exit the HSM SSH session:

exit

On the client workstation, start LunaCM:

lunacm

You should see an output similar to the following:

lunacm (64-bit) v10.3.0-275. Copyright (c) 2020 SafeNet. All rights reserved.

Available HSMs:
Slot Id ->              0
Label ->                
Serial Number ->        1238686731875
Model ->                LunaSA 7.7.1
Firmware Version ->     7.7.1
Bootloader Version ->   1.1.2
Configuration ->        Luna User Partition With SO (PW) Key Export
                        With Cloning Mode
Slot Description ->     Net Token Slot
FM HW Status ->         Non-FM
Current Slot Id: 0

Initialize the Crypto Officer and Crypto User roles for the registered partition:

For detailed steps on partition initialization and role management, refer to the Luna Network HSM documentation.

Create a Dockerfile in the /var/usrlocal/ directory:

FROM registry.access.redhat.com/ubi8/ubi:latest
# For UBI 7, use:
# FROM registry.access.redhat.com/ubi7/ubi:latest

RUN mkdir -p /var/usrlocal/luna
COPY luna /var/usrlocal/luna
ENV ChrystokiConfigurationPath=/var/usrlocal/luna/config
ENV PATH="/var/usrlocal/luna/bin/64:${PATH}"
ENTRYPOINT /bin/bash

You can store the configuration files and certificates located in /var/usrlocal/luna/config on a secure NFS server and mount them when running the pod.

Log in to any RHEL 7, RHEL 8, or RHEL CoreOS host as a user with administrative privileges.

Use pscp, scp, or another secure method to transfer the downloaded .zip file to your Client workstation.

Choose a directory where the file will be extracted. For example:

mkdir -p /var/usrlocal/luna

Extract the contents of the .zip file into /var/usrlocal/luna:

unzip setup-.zip -d /var/usrlocal/luna

Change to the directory where the files were extracted:

cd /var/usrlocal/luna/

Untar the cvclient-min.tar file to extract the necessary client files:

tar xvf cvclient-min.tar

Execute the setenv script to generate a new configuration file containing the information required for connecting to the Luna Cloud HSM service:

source ./setenv

Run the LunaCM utility to ensure that the Cloud HSM service is listed:

bin/64/lunacm

You should see the available HSMs listed in the output.

Initialize the Crypto Officer and Crypto User roles: Follow the detailed instructions in the Luna Cloud HSM documentation for initializing these roles and managing user access for the registered partition.

In the /var/usrlocal/ directory, create a Dockerfile to set up the Luna environment within a container:

FROM registry.access.redhat.com/ubi8/ubi:latest
# For UBI 7, use:
# FROM registry.access.redhat.com/ubi7/ubi:latest

RUN mkdir -p /var/usrlocal/luna
COPY luna /var/usrlocal/luna
ENV ChrystokiConfigurationPath=/var/usrlocal/luna
ENV PATH="/var/usrlocal/luna/bin/64:${PATH}"
ENTRYPOINT /bin/bash

You can store the configuration files and certificates located in the /var/usrlocal/luna directory on a secured NFS server and mount it when running the pod for easier management.

Use podman or docker to build the Luna client container image:

podman build . -t lunaclient-image

Check if the container image was built successfully:

podman images

Tag the container image and push it to your private registry. Replace <registry_ip> with the actual IP address of your registry:

podman tag localhost/lunaclient-image :5000/lunaclient-image
podman push :5000/lunaclient-image

It’s recommended to store the image in a private registry that is accessible from your OpenShift cluster nodes. After pushing it to your registry, you can delete the local container image.

Authenticate into the OpenShift platform:

oc login

Choose an existing project or create a new one where you want to deploy the Luna client pod. For example:

oc project lunaproject

Create a file named deployment.yaml with the following configuration:

apiVersion: v1
kind: Pod
metadata:
  name: luna-client-pod
  labels:
    openshift.io/name: luna-client-pod
spec:
  hostNetwork: true
  restartPolicy: Always
  containers:
    - name: luna-client-pod
      image: "[registry_ip]:5000/lunaclient-image"
      imagePullPolicy: IfNotPresent
      # Keeps the container running
      command: [ "/bin/bash", "-c", "--" ]
      args: [ "while true; do sleep 30; done;" ]

Replace [registry_ip] with your actual registry IP address. This configuration is minimal, so feel free to modify it as per your needs.

Deploy the pod using the following command:

oc apply -f deployment.yaml

Verify that the pod is running:

oc get pods

Log in to the pod and verify it can access the Luna HSM partition:

oc rsh luna-client-pod
sh-4.2$ lunacm