Configure Secure connectivity between Core Mojaloop Service and Backends (Tracking)

[mdebarros]

Goal:

As a Hub Operator

I want to configure TLS/Authentication for Mojaloop Backend services

so that communication is secure & authenticated between Mojaloop and Backend Services

Acceptance Criteria:

• Central-Ledger supports TLS/Authentication configs for:
  • Kafka
  • MySQL
  • MongoDB
• ML-API-Adapter supports TLS/Authentication configs for:
  • Kafka
• Bulk-API-Adapter supports TLS/Authentication configs for:
  • Kafka
  • MongoDB
• Central-Settlements supports TLS/Authentication configs for:
  • Kafka
  • MySQL
• Account-Lookup-Service supports TLS/Authentication configs for:
  • MySQL
• Quoting-Service supports TLS/Authentication configs for:
  • MySQL
  • Redis
• Mojaloop-Simulators supports TLS/Authentication configs for:
  • Redis
• Event-sidecar supports TLS/Authentication configs for:
  • Kafka
• Event-Stream-Processor supports TLS/Authentication configs for:
  • Kafka
  • ElasticSearch supports TLS/Authentication configs for:
  • APM
• Schema-Adapter supports TLS/Authentication configs for:
  • Redis
• Email-Notifier supports TLS/Authentication configs for:
  • Kafka
• Finance-Portal supports TLS/Authentication configs for:
  • MySQL
• Settlement-Management supports TLS/Authentication configs for:
  • MySQL

Complexity: Medium

Uncertainty: Low

---

Tasks:

• Update Central-Services-Database to support config for TLS & Authentication [#?] ~ 3
• Update Central-Services-Stream to support config for TLS & Authentication [#?] ~ 3
• Update Central-Object-Store to support config for TLS & Authentication [#?] ~ 3
  - In review - I simply allowed us to pass in config objects to Mongoose
• Central-Ledger [#?] ~ 3
  • config files
  • setup/config for backends
  • integration tests
• ML-API-Adapter [#?] ~ 3
  • config files
  • setup/config for backends
• Bulk-API-Adapter [#?] ~ 3
  • config files
  • setup/config for backends
• Central-Settlements [#?] ~ 3
  • config files
  • setup/config for backends
• Account-Lookup-Service [#?] ~ 3
  • config files
  • setup/config for backends
• Quoting-Service [#?] ~ 3
  • config files
  • setup/config for backends
• Mojaloop-Simulators [#?] ~ 3
  • config files
  • setup/config for backends
• Event-sidecar [#?] ~ 3
  • config files
  • setup/config for backends
• Event-Stream-Processor [#?] ~ 3
  • config files
  • setup/config for backends
• Schema-Adapter [#?] ~ 3
  • config files
  • setup/config for backends
• Email-Notifier [#?] ~ 3
  • config files
  • setup/config for backends
• Finance-Portal [#?] ~ 3
  • config files
  • setup/config for backends
• Settlement-Management [#?] ~ 3
  • config files
  • setup/config for backends
• Helm Support for TLS & Authentication Secrets [#?] ~ 5
  • Central-Ledger
  • ML-API-Adapter
  • Bulk-API-Adapter
  • Central-Settlements
  • Account-Lookup-Service
  • Quoting-Service
  • Mojaloop-Simulators
  • Event-sidecar
  • Event-Stream-Processor
  • Schema-Adapter
  • Email-Notifier
  • Finance-Portal
  • Settlement-Management

Done

• Acceptance Criteria pass
• Designs are up-to date
• Unit Tests pass
• Integration Tests pass
• Code Style & Coverage meets standards
• Changes made to config (default.json) are broadcast to team and follow-up tasks added to update helm charts and other deployment config.
• TBD

Pull Requests:

• feat!: #2100 allow config options to be passed through to Mongoose object-store-lib#21
• feat(mongodb): add extended config options for MongoDB central-ledger#831

Follow-up:

• N/A

Dependencies:

• N/A

Accountability:

• Owner: TBC
• QA/Review: TBC

[lewisdaly]

MongoDB support for TLS doesn't look all that difficult:

https://github.com/Automattic/mongoose/blob/c25169702ccc2a8f8123853453ed755f17278ce7/docs/tutorials/ssl.md

We will probably want to expose some options around specifying a CA file, and turning off and on the sslValidate option.

[lewisdaly]

@mdebarros maybe we can convert this into an Epic? Seems pretty epic to me.

[elnyry-sam-k]

yep @lewisdaly , @mdebarros - this is epic :-)