# Dockerfile for Gateway with Luna HSM Integration

## Description

This sample Dockerfile builds a derived Gateway image 11.0 that can connect to Luna HSM 7.  It has been updated to work with the new 11.0.00 CR2 which uses the UBI9-minimal base image from Iron Bank.  This Dockerfile will likely work with 10.1 and 11.0 CR1 (which still use the CentOS7 base image) though it wasn't tested with those versions. For the UBI9-minimal base image, Linux packages that are no longer available 
in the derived image may be added back using microdnf.

To build a derived **Gateway image 11.1 and above**, use dockerfile-example-luna10-6 as reference.

## Prerequisites/Dependencies
The Dockerfile has specific steps to install the Luna Client 10.3 + Luna Client jdk11 patch.  The following files are required from Thales:

- 610-000401-003_SW_Linux_Luna_Minimal_Client_V10.3.0_RevA.tar
- 630-000522-001_Sw_Patch_jsp_fix_for_jdk11_UC10.3.0_Custom_Release.tar

## Installation
To build the image:

1. Place the Luna client and patch archive files into the same directory as the Dockerfile.

2. Create a file named hsm-server-secret.txt and add the password for the <HSM_USER> account. This user and password will be used to ssh to the HSM appliance to copy over the HSM Client's certificate. Currently, the certificate is generated by the dockerfile.  The dockerfile can be modified to use an existing certificate.  Please see dockerfile contents for more details.

4. Execute the following command to build the image:

   `DOCKER_BUILDKIT=1 docker build -t <IMAGE_NAME> --no-cache --build-arg GW_IMAGE=<GATEWAY_IMAGE> --build-arg CLIENT_TAR_FILENAME=<CLIENT_FILE> --build-arg CLIENT_PATCH_TAR_FILENAME=<PATCH_FILE> --build-arg HSM_USER=<HSM_USER> --build-arg HSM_SERVER=<HSM_SERVER> --build-arg CERT_NAME=<CERT_NAME> --build-arg PARTITION_NAME=<PARTITION_NAME> --secret id=hsm-server-secret,src=hsm-server-secret.txt -f Dockerfile .`

   CERT_NAME is the name of the certificate that will be generated during image creation.

   **Note**: Re-running docker build will fail unless the client registration is commented out or the previous registration is deleted from the HSM.

5. Verify the connection to HSM by running `docker run <IMAGE_NAME> /usr/local/luna/bin/64/vtl verify`

6. Start up the container.  At this time, the Policy Manager must be used to enable the HSM Keystore. Click on Manage Private Keys / Manage Keystore/ Enable SafeNet HSM and enter the required information.

7. Scale down and scale up the Gateway.  The Gateway is now using Luna HSM.

Note:
From **GW11.1.2**, Policy Manager is not required for Headless deployment. See headless-helm-example.

## Known Limitations

* Policy Manager must be used to enable HSM on the Gateway once the Gateway has been started.
* For the simplicity of this sample, HSM client registration is done during image creation.  The registration steps can be moved out and be performed at a later time.
* The HSM partition is specified during image creation.  Create a new image if a new partition is to be selected.