Repository navigation
Conversation
Replaces trust-all with a CA-pinned SSLContext when GALAXY_TLS_CA_CERT, GALAXY_TLS_VM_CERT and GALAXY_TLS_VM_KEY env vars are set (from Secret Manager). Falls back to trust-all when absent (BEE / dev without provisioned secret). Changes: - GalaxyVmConfig gains tlsCaCert/tlsVmCert/tlsVmKey (all Option[String]) read from env vars via reference.conf substitution - BaselineDependenciesBuilder.buildGalaxySslContext: pins to the CA cert when present (X509ExtendedTrustManager wrapping the chain-verifying inner TM, bypassing hostname check since Galaxy VMs are addressed by IP), else trust-all - galaxySslContext shared between vmClient (HttpAppDAO) and ProxyService, removing the duplicate inline trust-all context from ProxyService - GKEInterpreter: injects galaxy-tls-cert / galaxy-tls-key instance metadata when VM cert+key are configured, for the playbook to use Ticket: https://broadworkbench.atlassian.net/browse/CTM-678 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GcpDependenciesBuilderSpec and MockProxyService were missing the new galaxySslContext parameter added to BaselineDependencies and ProxyService. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds tlsAllowTrustAllFallback (GALAXY_TLS_ALLOW_TRUST_ALL_FALLBACK) to GalaxyVmConfig. Defaults to false: Leo fails at startup if tlsCaCert is absent, so a missing or removed Secret Manager secret is immediately visible rather than silently degrading to trust-all. BEEs set this to true via the helmfile since the leo-galaxy-tls secret is not provisioned there. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ning time Each Galaxy VM now gets a unique TLS cert+key signed by Leo's root CA and injected via GCE instance metadata at createInstance time (GKEInterpreter). A user reading their VM's metadata can only compromise their own connection, not other VMs. Changes: - Adds org.bouncycastle:bcpkix-jdk18on for cert generation; removes the global BouncyCastle exclusion (it was excluded as unused transitive dep) - Replaces tlsVmCert/tlsVmKey config fields with tlsCaKey (the CA private key Leo signs per-VM certs with) - GKEInterpreter.generateVmTlsCert signs a fresh 2048-bit RSA cert per VM - Startup validation: tlsCaCert and tlsCaKey must both be set or both absent Ticket: https://broadworkbench.atlassian.net/browse/CTM-678 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove trust-all fallback path; CA cert is now required at startup - Add Leo client cert+key (GALAXY_TLS_LEO_CLIENT_CERT/KEY) loaded into SSLContext KeyManager for mTLS handshake with Galaxy VMs - Inject galaxy_tls_client_ca into VM metadata so nginx can verify Leo - Fix metadata key names: hyphens -> underscores to match galaxy-k8s-boot PR #144 - Remove tlsAllowTrustAllFallback; BEEs now use real GSM secret (broad-dsde-qa) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… merge strategy bcpkix, bcprov, and bcutil 1.86 each contain META-INF/versions/9/OSGI-INF/MANIFEST.MF with different contents. The default deduplicate strategy fails; use first. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Hard-throwing on absent GALAXY_TLS_CA_CERT prevents Leo from starting in environments where the leo-galaxy-tls Secret Manager secret has not been provisioned yet (e.g. BEEs before Terraform PR #2074 is deployed). Replace the throw with an SLF4J warning and fall back to SSLContext.getDefault. Galaxy VM connections will fail at the TLS handshake in those environments, but that is caught per-request and does not block startup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove empty commonExcludes and its Settings.scala reference; BouncyCastle is now an explicit dependency so there is nothing to exclude transitively. - Introduce GalaxyTlsConfig grouping all four TLS secrets (caCert, caKey, leoClientCert, leoClientKey) into one type. The reader yields None when any field is missing, enforcing all-or-nothing semantics instead of partial state. Replace the four individual Option[String] fields in GalaxyVmConfig with tls: Option[GalaxyTlsConfig] and update all call sites. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
BouncyCastle PEMParser yields PrivateKeyInfo for PKCS#8 keys (OpenSSL 3.x `BEGIN PRIVATE KEY`) and PEMKeyPair for traditional RSA keys (`BEGIN RSA PRIVATE KEY`). The cast to PEMKeyPair crashed on PKCS#8 input. Ticket: https://broadworkbench.atlassian.net/browse/CTM-678 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…2d to n2-standard t2d-standard capacity is constrained in us-central1-a, causing creation failures for users. n2-standard is widely available and becomes the new default. n2d-standard is surfaced in the UI as a cheaper AMD alternative. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
t2d-standard capacity is constrained in us-central1-a, causing Galaxy app creation failures. Switches the default to n2-standard-4 (Intel, widely available). n2d-standard is surfaced in the Terra UI as a cheaper AMD EPYC alternative.
🤖 Generated with Claude Code