Apigee config maven keystore configuration

[psdhera]

Hello Team,  We are planning to source control keystore and trust store using Apigee Config Maven.

But i am not getting answer seeing sample example https://github.com/apigee/apigee-config-maven-plugin/blob/master/samples/EdgeConfig/resources/edge/e... where to store .pem and .key file in Source control repos.

Do we need create directly structure to store keys in source control repos then put the path in alias.json ??

I might to create structure /edge/certs/key1.pem edge/certs/key12.key  configure in alias.json??

{
"alias":"testAliasKeyCertFileAndKey",
"keystorename": "testKeyStorename",
"format": "keycertfile",
"certFilePath":" /edge/certs/key1.pem",
"keyFilePath":" /edge/certs/key12key",
"password":"dummy"
},

And what is best practices and configuration to maintain keystore and trustkeystore using Apigee Config Maven??

[ssvaidyanathan]

@psdhera - yes, thats how the plugin is built. It takes the directory where the cert/key file exist and pushes that to Apigee.

Reg the best practice, please follow what is recommended/enforced by your security teams. Ideally managing sensitive info and files in source control is not a good practice. See if you can pull it somehow from your Secure Store/Vault using your pipeline and place that in /tmp directory and then use that directory path in the alias.json for the plugin to pick and push. 

[psdhera]

 @ssvaidyanathan   thanks for coming back on same 

i am trying to check how maven is working w.r.t to keystore , I did created directory under gitlab structure x/x/x/x/edge/env/dev/certs/ then passed  path in aliases from dev folder.

[

    {

         "alias":"testAliasKeyCertFileAndKey",

         "keystorename": "testKeyStorename",

         "format": "keycertfile",

         "certFilePath":"/dev/certs/demoserver.crt",

         "keyFilePath":"/dev/certs/server.key"

      }

]

but i am still getting error Failed to execute goal com.apigee.edge.config:apigee-config-maven-plugin:1.5.3:aliases (default-cli) on project config: Apigee network call error /dev/certs/server.key

Can you check this please or any working example you have to refer?

[ssvaidyanathan · Accepted solution]

It uses full path or relative path from where the mvn command is being executed. If you are running from the main repo directory, you need to refer to the path from there in the configuration

[psdhera]

I used full path in alias.json without forward slash in the start after that it was able to pick certs.