Comprehensive overhaul of Harvester and Server enhancements #171

maxlambrecht · 2023-05-24T03:23:44Z

Pull request check list

Proper tests/regressions included?
Documentation updated?

Summary of Changes

This Pull Request presents a comprehensive overhaul of the Harvester and several improvements to the Server. The enhancements presented in this PR mainly concern:

Improved synchronization of federation bundles: Enhancements in its relationship configuration and consent status.
Bundle signing and verification functionality: Configurable signing and verification through Providers.
Newly introduced Endpoint: Serving th Harvester admin API via a Unix Domain Socket (UDS).
Introduction of two Harvester Syncers:
- The first Syncer focuses on SPIRE bundle synchronization and server upload.
- The second Syncer orchestrates the synchronization of federated bundles from the server.
Streamlining of the data model: Elimination of unused fields, namely 'onboarding_bundle' and 'harvester_spiffe_if'.
Upgrades to the Server harvester and admin APIs: Improving naming of components to better align with REST operations. Adding consistency to the specs.
Enhancements in logging: More efficient debugging and system tracking.
Improvements in naming conventions: Fostering better code readability and maintainability.
Revisions in package organization and distribution of responsibilities: Enhancing modular design.

Additional Improvements

The Harvester now requests a new JWT token every half an hour and stores it on disk. This resilience-improving measure enables the Harvester to be restarted without needing to re-onboard it with a join token.

Additional Notes

Noteworthy changes to the CLI and configuration files are planned to be covered in a subsequent PR. There's also an acknowledgment of certain packages lacking comprehensive tests - this will be addressed in upcoming follow-up PRs.

Looking Ahead

The aforementioned enhancements in this PR reflect our ongoing commitment to evolve and refine the Harvester.

Which issue this pull requests fixes

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

maxlambrecht · 2023-05-24T03:52:54Z

pkg/common/http/http.go

+// LogAndRespondWithError logs the error and returns an HTTP error.
+func LogAndRespondWithError(logger logrus.FieldLogger, err error, errorMessage string, statusCode int) error {
+	if err != nil {
+		logger.Errorf("%s: %v", errorMessage, err)


The error message is sanitized.

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

mgbcaio

Left a few comments/questions, Max

mgbcaio · 2023-05-24T11:39:32Z

pkg/common/cryptoutil/certs.go

+func ParseCertificates(pemBytes []byte) ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+	block, rest := pem.Decode(pemBytes)
+	fmt.Println("block", block, "rest", rest)


mgbcaio · 2023-05-24T11:51:08Z

pkg/common/entity/entities.go

@@ -10,19 +10,17 @@ import (
 type ConsentStatus string

 const (
-	ConsentStatusAccepted ConsentStatus = "accepted"
+	ConsentStatusAccepted ConsentStatus = "approved"


Suggested change

ConsentStatusAccepted ConsentStatus = "approved"

ConsentStatusApproved ConsentStatus = "approved"

mgbcaio · 2023-05-24T11:56:39Z

pkg/harvester/bundlemanager/fedbundles.go

+		return fmt.Errorf("failed to fetch federated bundles from SPIRE Server: %w", err)
+	}
+
+	galadrielCtx, cancel := context.WithTimeout(ctx, galadrielCallTimeout)


Curiosity question, having 2 defer cancel which would trigger first, does that cancel the whole context ?

good catch, reusing the same variable for the cancel is a mistake.

mgbcaio · 2023-05-24T12:19:27Z

pkg/harvester/bundlemanager/spirebundle.go

+
+	// Check if the bundle is the same as the last one fetched
+	if s.lastSpireBundle != nil && s.lastSpireBundle.Equal(bundle) {
+		return nil // No new bundle


what you think about putting a log here to indicate that there is no new bundle?

That specific log line might be redundant, as we have a Debug log statement that says "Checking..." before the action takes place, and another one that states "New bundle..." when it fetches a new bundle, and an Info log statement indicating "Uploaded...". I think these log lines provide sufficient visibility into the process.

okay, sounds good

mgbcaio · 2023-05-24T15:30:56Z

pkg/harvester/galadrielclient/client.go

+}
+
+func (p *jwtProvider) setToken(jwt string) {
+	p.mu.Lock()


why not p.mu.RLock in here ?

The setToken function modifies the shared jwt token. Therefore, we need to ensure that no other goroutines are reading or writing the jwt token at the same time. A full lock, i.e, Lock(), accomplishes this by blocking both reads and writes to the shared resource. On the other hand, RLock only blocks write operations but allows multiple concurrent read operations.

thanks for clarifying!

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

wibarre

hats off!!! @maxlambrecht

wibarre · 2023-05-24T12:20:13Z

pkg/common/cryptoutil/certs.go

+func ParseCertificates(pemBytes []byte) ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+	block, rest := pem.Decode(pemBytes)
+	fmt.Println("block", block, "rest", rest)


Was this for debugging?

it was a leftover, already removed.

wibarre · 2023-05-24T12:34:25Z

pkg/harvester/bundlemanager/fedbundles_test.go

@@ -0,0 +1 @@
+package bundlemanager


wibarre · 2023-05-24T16:32:49Z

pkg/common/jwt/issuer.go

-const kidHeader = "kid"
+const (
+	kidHeader     = "kid"
+	defaultJWTTTL = 10 * time.Minute


I wonder if this would be better to have them as a configuration. It could give the users of Galadriel the opportunity to align with internal policies they may have for their JWTs.

I'll take a note to address this later on.

wibarre · 2023-05-24T16:57:28Z

pkg/harvester/galadrielclient/client.go

+	return nil
+}
+
+// isOnboarded Check if the client has been onboarded by checking if there is a JWT token


Do we need to check if the JWT has not expired as well? If there is no token or if the token is expired, we need new onboarding, correct?

I have enhanced the client's constructor function such that it now attempts to renew the token during initialization. This way, if it fails to procure a renewed token from the server, the creation process will fail, preventing the Harvester from starting. In case of such a failure, the Harvester will log stating that the Harvester was unable to establish a connection with the server using the stored token. The error message will suggest the need for re-onboarding the Harvester using a fresh join token.

wibarre · 2023-05-24T17:10:04Z

pkg/server/endpoints/endpoints.go

 		}
 		err = server.Close()
 		if err != nil {
 			e.Logger.WithError(err).Error("Error closing Echo Server")
 		}
 		<-errChan
-		e.Logger.Info("TCP Server stopped")
+		log.Info("TCP Server stopped")


TPC Listener stopped

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

sonarcloud · 2023-05-24T19:18:30Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
16 Code Smells

No Coverage information
0.1% Duplication

mgbcaio

Finished my second round of the review. Amazing work, thanks Max!

maxlambrecht added 3 commits May 23, 2023 21:53

Reimplementing Server and Harvester APIs

2c45cb2

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Revert duplicated change

33c1cc1

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Revert unintended change

c614a46

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

maxlambrecht requested review from wibarre, mchurichi, jufantozzi, mgbcaio and Victorblsilveira as code owners May 24, 2023 03:23

github-advanced-security bot found potential problems May 24, 2023

View reviewed changes

maxlambrecht added 2 commits May 23, 2023 22:46

Add logs sanitization

744a99e

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Move TTL constant closer to issuer. Reduce JWT TTLs

0085c4a

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

mgbcaio reviewed May 24, 2023

View reviewed changes

maxlambrecht added 5 commits May 24, 2023 10:55

Remove leftover

cce021b

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Amend constant name

210ae32

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Amend cancel contexts usage

f770b23

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Amend cancel contexts usage

33fb158

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

A few cleaningups

d2e50f3

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

wibarre reviewed May 24, 2023

View reviewed changes

maxlambrecht added 8 commits May 24, 2023 12:23

Improve namings in API specs

3398cfd

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Address PR comments

d62f02d

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Amend log statements

96654f8

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Improve namings in API specs

e689d1d

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Improve namings in API specs

178e043

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Improve namings in API specs

f589795

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Address PR comment

451b11f

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Improve API spec names

fb9459b

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

mgbcaio approved these changes May 25, 2023

View reviewed changes

wibarre approved these changes May 25, 2023

View reviewed changes

maxlambrecht merged commit ac99727 into HewlettPackard:main May 25, 2023

maxlambrecht deleted the reimplementing-galadriel branch May 25, 2023 14:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comprehensive overhaul of Harvester and Server enhancements #171

Comprehensive overhaul of Harvester and Server enhancements #171

maxlambrecht commented May 24, 2023 •

edited

Loading

maxlambrecht May 24, 2023

mgbcaio left a comment

mgbcaio May 24, 2023

maxlambrecht May 24, 2023

mgbcaio May 24, 2023

maxlambrecht May 24, 2023

mgbcaio May 24, 2023

maxlambrecht May 24, 2023

mgbcaio May 24, 2023

maxlambrecht May 24, 2023

mgbcaio May 24, 2023

mgbcaio May 24, 2023

maxlambrecht May 24, 2023

mgbcaio May 24, 2023

wibarre left a comment

wibarre May 24, 2023

maxlambrecht May 24, 2023

wibarre May 24, 2023

wibarre May 24, 2023

maxlambrecht May 24, 2023

wibarre May 24, 2023

maxlambrecht May 24, 2023

wibarre May 24, 2023

sonarcloud bot commented May 24, 2023

mgbcaio left a comment

	ConsentStatusAccepted ConsentStatus = "approved"
	ConsentStatusApproved ConsentStatus = "approved"

Comprehensive overhaul of Harvester and Server enhancements #171

Comprehensive overhaul of Harvester and Server enhancements #171

Conversation

maxlambrecht commented May 24, 2023 • edited Loading

Summary of Changes

Additional Improvements

Additional Notes

Looking Ahead

Choose a reason for hiding this comment

mgbcaio left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wibarre left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonarcloud bot commented May 24, 2023

mgbcaio left a comment

Choose a reason for hiding this comment

maxlambrecht commented May 24, 2023 •

edited

Loading