How do I enable TLS for telemetry and gNMI on_change support?

Purpose

To enable TLS communication between MDM and managed NEs after an NSP system deployment, you must deploy a signed TLS server certificate to each MDM-managed device that supports gRPC TLS, and import the corresponding CA certificate to each MDM truststore.  While it is possible to have more than one CA certificate added to each MDM truststore, it is generally preferable to limit the number of CA certificates to the minimum required to adequately secure the network.

The following steps describe how to secure the following NSP communication with NEs by importing a TLS certificate:

  • telemetry

  • gNMI on_change notifications

Note: TLS certificates for gRPC mediation are separate from the certificates that secure communication between the NSP components and NBI-related certificates.

Note: release-ID in a file path has the following format:

R.r.p-rel.version

where

R.r.p is the NSP release, in the form MAJOR.minor.patch

version is a numeric value

Steps
 
1 

Log in as the root user on the NSP deployer host.

2 

Transfer the CA certificate to the following directory:

/opt/nsp/NSP-CN-DEP-release-ID/NSP-CN-release-ID/tls/telemetry

Note: You must not modify or delete any existing file in the directory.

3 

Log in as the root user on the NSP cluster host.

4 

Open a console window.

5 

Enter the following command for each namespace to delete the nsp-tls Kubernetes secret:

# kubectl delete secret nsp-tls -n $(kubectl get secrets -A | awk '/namespace/ {print $1;exit}') ↵

where namespace is the Kubernetes namespace

6 

On the NSP deployer host, enter the following:

# /opt/nsp/NSP-CN-DEP-release-ID/bin/nspdeployerctl install --config –-deploy ↵

The certificate file is made available to each MDM instance, but not yet imported.

Import certificate to MDM servers
 
7 

Perform one of the following to import the TLS certificate to the TLS truststore on each MDM server.

  1. Manually import the certificate; perform the following steps for each MDM server to activate the gRPC certificate file.

    Note: A manual import is not service-affecting, and is the recommended option.

    1. Transfer the certificate file in the /opt/nsp/NSP-CN-DEP-release-ID/NSP-CN-release-ID/tls/telemetry directory on the NSP deployer host to an empty temporary directory on the NSP cluster host.

    2. On the NSP cluster host, navigate to the temporary directory that holds the transferred file.

    3. Enter the following to copy the certificate file to the MDM server:

      # kubectl cp -n namespace certificate_file mdm-server-n:/opt/nsp/os/ssl/certs/telemetry ↵

      where

      namespace is the Kubernetes namespace

      n is the mdm-server pod number

      certificate_file is the name of the certificate file

    4. Enter the following:

      # kubectl exec -n $(kubectl get pods -A | awk '/mdm-server/ {print $1;exit}') -it mdm-server-n -- keytool -alias alias -file /opt/nsp/os/ssl/certs/telemetry/certificate_file -import -keystore /opt/nsp/os/ssl/nsp.truststore -storepass password ↵

      where

      n is the mdm-server pod number

      alias is the TLS keystore alias of the certificate

      certificate_file is the gRPC certificate file

      password is the TLS keystore password

      You are prompted to import the certificate.

    5. Enter yes ↵.

      The MDM server imports the certificate to the local TLS truststore.

  2. Restart the MDM server pod; perform How do I restart an MDM server? for each MDM server pod.

    Note: Restarting an MDM server pod is service-affecting, and must be performed only during a scheduled maintenance period.

8 

Close the open console windows.

End of steps