All Knox instances must be synced to use the same topologies credentials keystores. These files are located under {GATEWAY_HOME}/conf/security/keystores/{TOPOLOGY_NAME}-credentials.jceks. They are generated after the first topology deployment. Currently these files can be synced just manually. There is no automation tool. Here are the steps to sync topologies credentials keystores:
openssl-devel is required for Apache Module mod_ssl.
sudo yum install openssl-devel
Apache HTTP Server 2.4.6 or later is required. See this document for installing and setting up Apache HTTP Server: http://httpd.apache.org/docs/2.4/install.html
Hint: pass --enable-ssl to ./configure command to enable Apache Module mod_ssl generation.
See this document for setting up Apache Module mod_proxy: http://httpd.apache.org/docs/2.4/mod/mod_proxy.html
See this document for setting up Apache Module mod_proxy_balancer: http://httpd.apache.org/docs/2.4/mod/mod_proxy_balancer.html
See this document for setting up Apache Module mod_ssl: http://httpd.apache.org/docs/2.4/mod/mod_ssl.html
See this document for an example: http://www.akadia.com/services/ssh_test_certificate.html
By convention, Apache HTTP Server and Knox certificates are put into /etc/apache2/ssl/ folder.
This file is located under {APACHE_HOME}/conf/httpd.conf.
Following directives have to be added or uncommented in the configuration file:
Also following lines have to be added to file. Replace placeholders (${...}) with real data:
Listen 443 <VirtualHost *:443> SSLEngine On SSLProxyEngine On SSLCertificateFile ${PATH_TO_CERTICICATE_FILE} SSLCertificateKeyFile ${PATH_TO_CERTICICATE_KEY_FILE} SSLProxyCACertificateFile ${PATH_TO_PROXY_CA_CERTICICATE_FILE} ProxyRequests Off ProxyPreserveHost Off Header add Set-Cookie "ROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/" env=BALANCER_ROUTE_CHANGED <Proxy balancer://mycluster> BalancerMember ${HOST_#1} route=1 BalancerMember ${HOST_#2} route=2 ... BalancerMember ${HOST_#N} route=N ProxySet failontimeout=On lbmethod=${LB_METHOD} stickysession=ROUTEID </Proxy> ProxyPass / balancer://mycluster/ ProxyPassReverse / balancer://mycluster/ </VirtualHost>
Note:
APACHE_HOME/bin/apachectl -k start APACHE_HOME/bin/apachectl -k stop
Use Knox samples.