Containerize the App

We have an OpenAPI spec, an app that implements that spec, and it’s tested.

Now it’s time to get it ready to deploy.

The spring-boot-maven-plugin can generate a Docker image for us, but we are going to spice it up a bit and add a requirement for including custom CA Certs in the image at runtime.

So, to start with, yes we will create the image with mvn clean verify spring-boot:build-image However, we are going to define our own image name pattern so our pipeline can compute the name and we don’t have to do something special to get it. For this we will add an <image> element to the spring-boot-maven-plugin Like so:

<image>
   <name>docker.io/blah-blah-corp/${project.artifactId}-${project.version}:latest</name>
</image>

Now build and add a goal to build the image: mvn clean verify spring-boot:build-image Once that is complete docker images and there you have it.

Now that we have an image. We will gen up a cert as our internal CA cert. Then, create a file that identifies the pem files in the directory as ca-certificates. This is used by the paketo/ca-certificates buildpack to add out “internal CA” cert to the cacerts used by Java as the app is starting. Just a note, the cert.key file is actually created in the directory above so as not to cause problems as startup time for the app. The cert-dir will only contain the cert.pem and type files.

mkdir cert-dir
cd cert-dir
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
  -nodes -keyout ../cert.key -out cert.pem -subj "/CN=blah-blah.com" \
  -addext "subjectAltName=DNS:blah-blah.com,DNS:*.blah-blah.com,IP:10.0.0.1"
echo "ca-certificates" > type

Once the cert is in place we can run the app with our new cert.

bash:
docker run -e SERVICE_BINDING_ROOT=/bindings \
  -v "$(pwd):/bindings/ca-certificates:ro" \
  blah-blah-corp/meeting-management-system-1.0.0

PowerShell:
docker run -e SERVICE_BINDING_ROOT=/bindings `
  -v "$((get-location).path):/bindings/ca-certificates:ro" `
  blah-blah-corp/meeting-management-system-1.0.0

Conclusion:

We created a Docker image and started it with a CA cert included at runtime. Now we can get on with the business of building our app.

View the code on GitHub here.