Allow CA overriding when generating mutual TLS certs

[luan]

This enables the use case where Cloud Controller passes in HTTPS urls
for task callbacks that require mututal tls.
In that scenario, the CA that signs both diego and cloud controller
certificates have to be the same, this commit allows that CA to be
passed in as an argument.

Also, adds documentation to examples/aws/README.md as to how to deploy a
Diego cluster with this enabled.

Signed-off-by: Eric Promislow [email protected]

[cfdreddbot]

Hey luan!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA.

[cfdreddbot]

Hey luan!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/136221643

The labels on this github issue will be updated when the story is started.

[emalm]

Thanks, @luan ! Prioritizing for the Diego team to pull in. If the TLS configuration files for CC are always in a predictable place, it would be preferable for the deploy_aws_environment script and the CF stub generation templates (https://github.com/cloudfoundry/diego-release/blob/develop/examples/aws/templates/cf/stub-internal.yml and https://github.com/cloudfoundry/diego-release/blob/develop/examples/aws/templates/cf/stub.yml) to capture them automatically, as they do for the Consul TLS credentials, instead of requiring them to be replaced in the CF properties.yml stub.

Thanks,
Eric

[bdshroyer]

@luan Any updates on this?

Thanks,

Brandon

[aashah]

We changed the script to pull the certs from cf-release. We're in the process of pushing the scripts/generate-cf-diego-certs into cf-release right now.

• Luan & Aakash

[jfmyers9]

@luan && @aashah,

Can you please rebase this against the develop branch so that it is easier to merge? Also this brings in a BOSHFILE and boshler which are dependencies/workflows that I don't think we are ready to take on. If you could please remove those that would be awesome.

Thanks,

@jfmyers9 && @bdshroyer, CF Diego Team