Agent configuration

# Backup the current keystore
kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/keystore" "$BACKUP_DIR/keystore"
# Backup the passkey
kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/passkey" "$BACKUP_DIR/passkey"
# Backup the security directory (CA certificates)
kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/security" "$BACKUP_DIR/security"
# Backup commander.properties
kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/commander.properties" "$BACKUP_DIR/commander.properties"
▼

# Find the keystore file in /tmp (it has a random suffix)
KEYSTORE_FILE=$(kubectl exec -n $NAMESPACE $SERVER_POD -- find /tmp -maxdepth 1 -name "keystore*" -type f 2>/dev/null | head -1)
echo "Found keystore at: $KEYSTORE_FILE"
# Find the passkey file in /tmp (it also has a random suffix)
PASSKEY_FILE=$(kubectl exec -n $NAMESPACE $SERVER_POD -- find /tmp -maxdepth 1 -name "passkey*" -type f 2>/dev/null | head -1)
echo "Found passkey at: $PASSKEY_FILE"
# Backup the keystore
if [ -n "$KEYSTORE_FILE" ]; then
    kubectl cp "$NAMESPACE/$SERVER_POD:$KEYSTORE_FILE" "$BACKUP_DIR/keystore"
    echo "Keystore backed up successfully"
else
    echo "WARNING: Keystore not found in /tmp. Check /opt/cbflow/conf/keystore instead."
    kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/keystore" "$BACKUP_DIR/keystore" 2>/dev/null
fi
# Backup the passkey
if [ -n "$PASSKEY_FILE" ]; then
    kubectl cp "$NAMESPACE/$SERVER_POD:$PASSKEY_FILE" "$BACKUP_DIR/passkey"
    echo "Passkey backed up successfully"
else
    echo "WARNING: Passkey not found in /tmp. Check /opt/cbflow/conf/passkey instead."
    kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/passkey" "$BACKUP_DIR/passkey" 2>/dev/null
fi
# Backup commander.properties (always at the standard path)
kubectl cp "$NAMESPACE/$SERVER_POD:/opt/cbflow/conf/commander.properties" "$BACKUP_DIR/commander.properties"
▼

# Convert PEM certificate + private key to PKCS12 (intermediate format)
openssl pkcs12 -export \
    -in server.crt \
    -inkey server.key \
    -certfile ca-chain.crt \
    -out /tmp/server.p12 \
    -name jetty \
    -passout pass:abcdef
# Convert PKCS12 to JKS
keytool -importkeystore \
    -srckeystore /tmp/server.p12 \
    -srcstoretype PKCS12 \
    -srcstorepass abcdef \
    -destkeystore ./keystore \
    -deststoretype JKS \
    -deststorepass abcdef \
    -destkeypass abcdef \
    -noprompt
# Import the CA certificate chain with required "CA:" alias prefix
keytool -importcert \
    -file ca-chain.crt \
    -keystore ./keystore \
    -alias "CA:CustomCA" \
    -storepass abcdef \
    -noprompt
# Verify the keystore contents
keytool -list -keystore ./keystore -storepass abcdef
# Expected output should show:
#   jetty, <date>, PrivateKeyEntry
#   ca:customca, <date>, trustedCertEntry
# Clean up intermediate file
rm -f /tmp/server.p12
▼

# Create PKCS12 locally (only needs openssl)
openssl pkcs12 -export \
    -in server.crt \
    -inkey server.key \
    -certfile ca-chain.crt \
    -out /tmp/server.p12 \
    -name jetty \
    -passout pass:abcdef
# Copy the PKCS12 and CA chain into the server pod
kubectl cp /tmp/server.p12 "$NAMESPACE/$SERVER_POD:/tmp/server.p12"
kubectl cp ca-chain.crt "$NAMESPACE/$SERVER_POD:/tmp/ca-chain.crt"
# Convert PKCS12 to JKS inside the pod
kubectl exec -n $NAMESPACE $SERVER_POD -- \
    /opt/cbflow/jre/bin/keytool -importkeystore \
    -srckeystore /tmp/server.p12 \
    -srcstoretype PKCS12 \
    -srcstorepass abcdef \
    -destkeystore /tmp/custom-keystore \
    -deststoretype JKS \
    -deststorepass abcdef \
    -destkeypass abcdef \
    -noprompt
# Import CA chain inside the pod
kubectl exec -n $NAMESPACE $SERVER_POD -- \
    /opt/cbflow/jre/bin/keytool -importcert \
    -file /tmp/ca-chain.crt \
    -keystore /tmp/custom-keystore \
    -alias "CA:CustomCA" \
    -storepass abcdef \
    -noprompt
# Verify inside the pod
kubectl exec -n $NAMESPACE $SERVER_POD -- \
    /opt/cbflow/jre/bin/keytool -list -keystore /tmp/custom-keystore -storepass abcdef
# Expected: jetty (PrivateKeyEntry) + ca:customca (trustedCertEntry)
# Copy the finished keystore back to your local machine
kubectl cp "$NAMESPACE/$SERVER_POD:/tmp/custom-keystore" ./keystore
# Clean up temp files from the pod
kubectl exec -n $NAMESPACE $SERVER_POD -- rm -f /tmp/server.p12 /tmp/ca-chain.crt /tmp/custom-keystore
# Clean up local temp file
rm -f /tmp/server.p12
▼

# Create a Kubernetes secret with the keystore
kubectl create secret generic flow-server-custom-keystore \
    --from-file=keystore=./keystore \
    -n $NAMESPACE
# Deploy via Helm
helm upgrade <release-name> <chart-path> \
    --set server.customConfig.existingSecret=flow-server-custom-keystore \
    --reuse-values \
    -n $NAMESPACE
▼

# Get the current server pod name
SERVER_POD=$(kubectl get pods -n $NAMESPACE -l app=flow-server -o jsonpath='{.items[0].metadata.name}')
# Copy the custom keystore into the running pod
kubectl cp ./keystore "$NAMESPACE/$SERVER_POD:/tmp/custom-keystore"
# Upload the keystore to ZooKeeper
kubectl exec -n $NAMESPACE $SERVER_POD -- /opt/cbflow/jre/bin/java \
    -DCOMMANDER_ZK_CONNECTION=zookeeper:2181 \
    -jar /opt/cbflow/server/bin/zk-config-tool-jar-with-dependencies.jar \
    --keystoreFile /tmp/custom-keystore
# Clean up the temp file
kubectl exec -n $NAMESPACE $SERVER_POD -- rm -f /tmp/custom-keystore
# Restart the server pods to pick up the new keystore from ZK
kubectl rollout restart deployment/flow-server -n $NAMESPACE
kubectl rollout status deployment/flow-server -n $NAMESPACE --timeout=300s
▼

kubectl exec -n $NAMESPACE $SERVER_POD -- printenv CBF_ZK_CONNECTION
▼

kubectl create secret generic flow-server-original-keystore \
    --from-file=keystore="$BACKUP_DIR/keystore" \
    --from-file=passkey="$BACKUP_DIR/passkey" \
    --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
helm upgrade <release-name> <chart-path> \
    --set server.customConfig.existingSecret=flow-server-original-keystore \
    --reuse-values \
    -n $NAMESPACE
▼

helm upgrade <release-name> <chart-path> \
    --set server.customConfig.existingSecret=null \
    --reuse-values \
    -n $NAMESPACE
kubectl delete secret flow-server-custom-keystore -n $NAMESPACE
▼

SERVER_POD=$(kubectl get pods -n $NAMESPACE -l app=flow-server -o jsonpath='{.items[0].metadata.name}')
# Copy the backed-up keystore into the pod
kubectl cp "$BACKUP_DIR/keystore" "$NAMESPACE/$SERVER_POD:/tmp/restore-keystore"
# Upload the original keystore to ZooKeeper
kubectl exec -n $NAMESPACE $SERVER_POD -- /opt/cbflow/jre/bin/java \
    -DCOMMANDER_ZK_CONNECTION=zookeeper:2181 \
    -jar /opt/cbflow/server/bin/zk-config-tool-jar-with-dependencies.jar \
    --keystoreFile /tmp/restore-keystore
# Clean up and restart
kubectl exec -n $NAMESPACE $SERVER_POD -- rm -f /tmp/restore-keystore
kubectl rollout restart deployment/flow-server -n $NAMESPACE
▼

kubectl exec -n vault vault-0 -- \
  vault auth enable kubernetes
▼

kubectl exec -n vault vault-0 -- \
  vault write auth/kubernetes/config \
  kubernetes_host="https://kubernetes.default.svc:443"
▼

# Create policy file
cat > /tmp/flow-policy.hcl <<'EOF'
path "secret/data/flow-custom-config" {
  capabilities = ["read"]
}
path "secret/metadata/flow-custom-config" {
  capabilities = ["read", "list"]
}
EOF
# Copy to Vault pod
kubectl cp /tmp/flow-policy.hcl vault/vault-0:/tmp/flow-policy.hcl
# Create policy in Vault
kubectl exec -n vault vault-0 -- \
  vault policy write flow-secrets /tmp/flow-policy.hcl
▼

kubectl exec -n vault vault-0 -- \
  vault write auth/kubernetes/role/external-secrets \
  bound_service_account_names=external-secrets-sa \
  bound_service_account_namespaces=<your-flow-namespace> \
  policies=flow-secrets \
  ttl=24h
▼