sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[full-ci] Introduce TLS Settings for go-micro based grpc services and clients (#4901)

Browse Source 
* Introduce TLS Settings for go-micro based grpc services and clients

TLS for the services can be configure by setting the OCIS_MICRO_GRPC_TLS_ENABLED"
"OCIS_MICRO_GRPC_TLS_CERTIFICATE" and "OCIS_MICRO_GRPC_TLS_KEY"
enviroment variables.

TLS for the clients can configured by setting the "OCIS_MICRO_GRPC_CLIENT_TLS_MODE"
and "OCIS_MICRO_GRPC_CLIENT_TLS_CACERT" variables.

By default TLS is disabled.

Co-authored-by: Martin <github@diemattels.at>

* Unify TLS configuration for all grpc services

All grpc service (whether they're based on reva) or go-micro use the
same set of config vars now.

TLS for the services can be configure by setting the OCIS_GRPC_TLS_ENABLED,
OCIS_GRPC_TLS_CERTIFICATE and OCIS_GRPC_TLS_KEY enviroment variables.

TLS for the clients can configured by setting the OCIS_GRPC_CLIENT_TLS_MODE
and OCIS_MICRO_GRPC_CLIENT_TLS_CACERT variables.

There are no individual per service config vars currently. If really
needed, per service tls configurations can be specified via config file.

Co-authored-by: Martin <github@diemattels.at>

Co-authored-by: Martin <github@diemattels.at>
This commit is contained in:
Ralf Haferkamp
2022-11-03 10:17:08 +01:00
committed by GitHub
co-authored by Martin
parent b7482e5410
commit ee974afebf
91 changed files with 746 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/storage-users/pkg/config/config.go
+4 -6
View File
@@ -60,12 +60,10 @@ type Debug struct {
}
type GRPCConfig struct {
Addr string `yaml:"addr" env:"STORAGE_USERS_GRPC_ADDR" desc:"The bind address of the GRPC service."`
TLSEnabled bool `yaml:"tls_enabled" env:"OCIS_GRPC_TLS_ENABLED"`
TLSCert string `yaml:"tls_cert" env:"OCIS_GRPC_TLS_CERTIFICATE" desc:"Path/File name of the TLS server certificate (in PEM format) for the reva grpc services."`
TLSKey string `yaml:"tls_key" env:"OCIS_GRPC_TLS_KEY" desc:"Path/File name for the TLS certificate key (in PEM format) for the server certificate."`
Namespace string `yaml:"-"`
Protocol string `yaml:"protocol" env:"STORAGE_USERS_GRPC_PROTOCOL" desc:"The transport protocol of the GPRC service."`
Addr string `yaml:"addr" env:"STORAGE_USERS_GRPC_ADDR" desc:"The bind address of the GRPC service."`
TLS *shared.GRPCServiceTLS `yaml:"tls"`
Namespace string `yaml:"-"`
Protocol string `yaml:"protocol" env:"STORAGE_USERS_GRPC_PROTOCOL" desc:"The transport protocol of the GPRC service."`
}
type HTTPConfig struct {
services/storage-users/pkg/config/defaults/defaultconfig.go
+11 -3
View File
@@ -111,9 +111,8 @@ func EnsureDefaults(cfg *config.Config) {
if cfg.Reva == nil && cfg.Commons != nil && cfg.Commons.Reva != nil {
cfg.Reva = &shared.Reva{
Address: cfg.Commons.Reva.Address,
TLSMode: cfg.Commons.Reva.TLSMode,
TLSCACert: cfg.Commons.Reva.TLSCACert,
Address: cfg.Commons.Reva.Address,
TLS: cfg.Commons.Reva.TLS,
}
} else if cfg.Reva == nil {
cfg.Reva = &shared.Reva{}
@@ -126,6 +125,15 @@ func EnsureDefaults(cfg *config.Config) {
} else if cfg.TokenManager == nil {
cfg.TokenManager = &config.TokenManager{}
}
if cfg.GRPC.TLS == nil {
cfg.GRPC.TLS = &shared.GRPCServiceTLS{}
if cfg.Commons != nil && cfg.Commons.GRPCServiceTLS != nil {
cfg.GRPC.TLS.Enabled = cfg.Commons.GRPCServiceTLS.Enabled
cfg.GRPC.TLS.Cert = cfg.Commons.GRPCServiceTLS.Cert
cfg.GRPC.TLS.Key = cfg.Commons.GRPCServiceTLS.Key
}
}
}
func Sanitize(cfg *config.Config) {
services/storage-users/pkg/revaconfig/config.go
+3 -3
View File
@@ -23,9 +23,9 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} {
"network": cfg.GRPC.Protocol,
"address": cfg.GRPC.Addr,
"tls_settings": map[string]interface{}{
"enabled": cfg.GRPC.TLSEnabled,
"certificate": cfg.GRPC.TLSCert,
"key": cfg.GRPC.TLSKey,
"enabled": cfg.GRPC.TLS.Enabled,
"certificate": cfg.GRPC.TLS.Cert,
"key": cfg.GRPC.TLS.Key,
},
// TODO build services dynamically
"services": map[string]interface{}{
services/storage-users/pkg/revaconfig/user.go
+2 -2
View File
@@ -95,7 +95,7 @@ func UserDrivers(cfg *config.Config) map[string]interface{} {
"treetime_accounting": true,
"treesize_accounting": true,
"permissionssvc": cfg.Drivers.OCIS.PermissionsEndpoint,
"permissionssvc_tls_mode": "off",
"permissionssvc_tls_mode": cfg.Commons.GRPCClientTLS.Mode,
},
"s3": map[string]interface{}{
"enable_home": false,
@@ -115,7 +115,7 @@ func UserDrivers(cfg *config.Config) map[string]interface{} {
"treetime_accounting": true,
"treesize_accounting": true,
"permissionssvc": cfg.Drivers.S3NG.PermissionsEndpoint,
"permissionssvc_tls_mode": "off",
"permissionssvc_tls_mode": cfg.Commons.GRPCClientTLS.Mode,
"s3.region": cfg.Drivers.S3NG.Region,
"s3.access_key": cfg.Drivers.S3NG.AccessKey,
"s3.secret_key": cfg.Drivers.S3NG.SecretKey,