US-624029 : SSL and NIST SP 800-53 and NIST SP 800-131 support for Clustering Service

[vnihal72]

US-624029 : SSL and NIST SP 800-53 and NIST SP 800-131 support Clustering Service

[Saurabh-16]

When is this file invoked? Can this file be put within HZ subcharts?

[Pushpendrak18]

This file will be invoked manually, please refer: https://github.com/pegasystems/pega-helm-charts/pull/794/files#diff-346646b74f5caaa4e6ffacf9785c6718623b85624c4ad9bd81b6b4496b4d4eb2R1282
This file will generate common certificate for clustering-service and platform, so we are putting it in pega chart

[Saurabh-16]

I assume this path is available in HZ image.
/opt/hazelcast/certs

[Pushpendrak18]

yes @Saurabh-16

[kingakowalska1]

Hi Nihal,

Here are my doc suggestions regarding the PR:

In charts/pega/README.md:

Line 1253:

hazelcast.encryption.enabled | Set to true if SSL connection is required; otherwise leave set to false. Note: Set this value to false for Pega platform versions below 24.2; if not set the installation will fail, see this section

To:

hazelcast.encryption.enabled | Set to true if you require SSL connection in your Clustering Service. Note: Highly secure encryption mode is only available in Pega Platform '24.2 and later. Set this value to false for Pega Platform release '24.1 and earlier or the installation will fail.

Line 1282:

(Optional) Enabling encryption of traffic between Pega and ClusteringService

Run the make file in charts/pega/Makefile when encryption or HighlySecureCryptoMode is enabled to generate the certificates and mount it to the Hazelcast and Pega pods before Helm Install.

Parameter	Description
NAMESPACE	Namespace where Pega and Hazelcast is going to be deployed.
CLUSTERING_SERVICE_IMAGE	Reference the platform/clustering-service Docker image that you downloaded and pushed to your Docker registry that your deployment can access.
ENC_KEYSTORE_PASSWORD	Key store password.
ENC_TRUSTSTORE_PASSWORD	Trust store password.
HIGHLY_SECURE_CRYPTO_MODE_ENABLED	Enable it for complying with NIST SP 800-53 and NIST SP 800-131.

To:

(Optional) Enabling highly secure encryption of traffic between Pega Platform and the Clustering Service

Before Helm install, run the makefile in charts/pega/Makefile with the following parameters when you enable encryption or HighlySecureCryptoMode to generate the certificates and mount them to the Clustering Service and Pega Platform pods.

Parameter	Description
NAMESPACE	Namespace where you deploy Pega Platform and the Clustering Service.
CLUSTERING_SERVICE_IMAGE	Reference the platform/clustering-service Docker image that you downloaded and pushed to your Docker registry that your deployment can access.
ENC_KEYSTORE_PASSWORD	Keystore password.
ENC_TRUSTSTORE_PASSWORD	Truststore password.
HIGHLY_SECURE_CRYPTO_MODE_ENABLED	Set to true to enable the highly secure encryption mode to comply with NIST SP 800-53 and NIST SP 800-131.

And across the values.yaml files:

Setting below to true will enforce the SSL communication between Hazelcast and Pega Infinity.

To

Set to true to enforce SSL communication between the Clustering Service and Pega Platform.

And:

Enable it for complying with NIST SP 800-53 and NIST SP 800-131

To:

Set to true to comply with NIST SP 800-53 and NIST SP 800-131.

Thanks!
Kinga

[taz-pega-work]

You don’t need anything from me, right? These all seem like excellent suggestions 😉 Taz From: Kinga Kowalska ***@***.***> Sent: Monday, August 12, 2024 6:28 AM To: pegasystems/pega-helm-charts ***@***.***> Cc: Aciukewicz, Taz ***@***.***>; Review requested ***@***.***> Subject: ExtMsg: Re: [pegasystems/pega-helm-charts] US-624029 : SSL and NIST SP 800-53 and NIST SP 800-131 support for Clustering Service (PR #794) CAUTION: This email was sent from an EXTERNAL source. Think before clicking links or opening attachments. Hi Nihal, Here are my doc suggestions regarding the PR: In charts/pega/README.md: Line 1253: hazelcast.encryption.enabled | Set to true if SSL connection is required; otherwise leave set to false. Note: Set this value to false for Pega platform versions below 24.2; if not set the installation will fail, see this section To: hazelcast.encryption.enabled | Set to true if you require SSL connection in your Clustering Service. Note: Highly secure encryption mode is only available in Pega Platform '24.2 and later. Set this value to false for Pega Platform release '24.1 and earlier or the installation will fail. Line 1282: (Optional) Enabling encryption of traffic between Pega and ClusteringService Run the make file in charts/pega/Makefile when encryption or HighlySecureCryptoMode is enabled to generate the certificates and mount it to the Hazelcast and Pega pods before Helm Install. Parameter Description NAMESPACE Namespace where Pega and Hazelcast is going to be deployed. CLUSTERING_SERVICE_IMAGE Reference the platform/clustering-service Docker image that you downloaded and pushed to your Docker registry that your deployment can access. ENC_KEYSTORE_PASSWORD Key store password. ENC_TRUSTSTORE_PASSWORD Trust store password. HIGHLY_SECURE_CRYPTO_MODE_ENABLED Enable it for complying with NIST SP 800-53 and NIST SP 800-131. To: (Optional) Enabling highly secure encryption of traffic between Pega Platform and the Clustering Service Before Helm install, run the makefile in charts/pega/Makefile with the following parameters when you enable encryption or HighlySecureCryptoMode to generate the certificates and mount them to the Clustering Service and Pega Platform pods. Parameter Description NAMESPACE Namespace where you deploy Pega Platform and the Clustering Service. CLUSTERING_SERVICE_IMAGE Reference the platform/clustering-service Docker image that you downloaded and pushed to your Docker registry that your deployment can access. ENC_KEYSTORE_PASSWORD Keystore password. ENC_TRUSTSTORE_PASSWORD Truststore password. HIGHLY_SECURE_CRYPTO_MODE_ENABLED Set to true to enable the highly secure encryption mode to comply with NIST SP 800-53 and NIST SP 800-131. And across the values.yaml files: Setting below to true will enforce the SSL communication between Hazelcast and Pega Infinity. To Set to true to enforce SSL communication between the Clustering Service and Pega Platform. And: Enable it for complying with NIST SP 800-53 and NIST SP 800-131 To: Set to true to comply with NIST SP 800-53 and NIST SP 800-131. Thanks! Kinga — Reply to this email directly, view it on GitHub<#794 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ARRCUBUIM5SCO4UWNFVP3MLZRCE4FAVCNFSM6AAAAABMHCP4AKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOBTGYYDMMZRGI>. You are receiving this because your review was requested.Message ID: ***@***.******@***.***>>

[alemax22]

This is an enhancement that we are really interested in, but one of our security team requirement is to periodically change the encryption certificates (e.g. every 30 days). Will be possible to give the certificates by means of a secret instead of running a using some certificated created during the deployment phase? The ideal scenario will be to change the certificates, without requiring a redeploy of the entire cluster

[Pushpendrak18]

Hi Nihal,

Here are my doc suggestions regarding the PR:

In charts/pega/README.md:

Line 1253:

hazelcast.encryption.enabled | Set to true if SSL connection is required; otherwise leave set to false. Note: Set this value to false for Pega platform versions below 24.2; if not set the installation will fail, see this section

To:

hazelcast.encryption.enabled | Set to true if you require SSL connection in your Clustering Service. Note: Highly secure encryption mode is only available in Pega Platform '24.2 and later. Set this value to false for Pega Platform release '24.1 and earlier or the installation will fail.

Line 1282:

(Optional) Enabling encryption of traffic between Pega and ClusteringService

Run the make file in charts/pega/Makefile when encryption or HighlySecureCryptoMode is enabled to generate the certificates and mount it to the Hazelcast and Pega pods before Helm Install.

Parameter Description
NAMESPACE Namespace where Pega and Hazelcast is going to be deployed.
CLUSTERING_SERVICE_IMAGE Reference the platform/clustering-service Docker image that you downloaded and pushed to your Docker registry that your deployment can access.
ENC_KEYSTORE_PASSWORD Key store password.
ENC_TRUSTSTORE_PASSWORD Trust store password.
HIGHLY_SECURE_CRYPTO_MODE_ENABLED Enable it for complying with NIST SP 800-53 and NIST SP 800-131.
To:

(Optional) Enabling highly secure encryption of traffic between Pega Platform and the Clustering Service

Before Helm install, run the makefile in charts/pega/Makefile with the following parameters when you enable encryption or HighlySecureCryptoMode to generate the certificates and mount them to the Clustering Service and Pega Platform pods.

Parameter Description
NAMESPACE Namespace where you deploy Pega Platform and the Clustering Service.
CLUSTERING_SERVICE_IMAGE Reference the platform/clustering-service Docker image that you downloaded and pushed to your Docker registry that your deployment can access.
ENC_KEYSTORE_PASSWORD Keystore password.
ENC_TRUSTSTORE_PASSWORD Truststore password.
HIGHLY_SECURE_CRYPTO_MODE_ENABLED Set to true to enable the highly secure encryption mode to comply with NIST SP 800-53 and NIST SP 800-131.
And across the values.yaml files:

Setting below to true will enforce the SSL communication between Hazelcast and Pega Infinity.

To

Set to true to enforce SSL communication between the Clustering Service and Pega Platform.

And:

Enable it for complying with NIST SP 800-53 and NIST SP 800-131

To:

Set to true to comply with NIST SP 800-53 and NIST SP 800-131.

Thanks! Kinga

Hi @kingakowalska1 , We have incorporated the suggested changes, please review/approve PR.

[kingakowalska1]

Hi,
Since I reviewed the PR back in August, the PO driving the initiative requested that we keep a single name for this encryption enhancement, so the only comment I have is to replace every mention of "Highly secure encryption mode" with "Highly Secure Crypto Mode" in the readme.
Thanks!
Kinga

[kingakowalska1]

Looks great, thank you for making the changes!