-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add JWTProxy based implementation for SecureServerExposer
- Loading branch information
1 parent
ffb369b
commit 4b53f31
Showing
13 changed files
with
707 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
...che/workspace/infrastructure/kubernetes/server/secure/jwtproxy/JwtProxyConfigBuilder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,82 @@ | ||
/* | ||
* Copyright (c) 2012-2018 Red Hat, Inc. | ||
* All rights reserved. This program and the accompanying materials | ||
* are made available under the terms of the Eclipse Public License v1.0 | ||
* which accompanies this distribution, and is available at | ||
* http://www.eclipse.org/legal/epl-v10.html | ||
* | ||
* Contributors: | ||
* Red Hat, Inc. - initial API and implementation | ||
*/ | ||
package org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.jwtproxy; | ||
|
||
import static org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.jwtproxy.JwtProxyProvisioner.JWT_PROXY_CONFIG_FOLDER; | ||
import static org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.jwtproxy.JwtProxyProvisioner.JWT_PROXY_PUBLIC_KEY_FILE; | ||
|
||
import java.util.ArrayList; | ||
import java.util.List; | ||
|
||
/** | ||
* Helps to build JWTProxy config with several verifier proxies. | ||
* | ||
* @author Sergii Leshchenko | ||
*/ | ||
public class JwtProxyConfigBuilder { | ||
private final List<VerifierProxy> verifierProxies = new ArrayList<>(); | ||
private final String workspaceId; | ||
|
||
public JwtProxyConfigBuilder(String workspaceId) { | ||
this.workspaceId = workspaceId; | ||
} | ||
|
||
public void addVerifierProxy(Integer listenPort, String upstream) { | ||
verifierProxies.add(new VerifierProxy(listenPort, upstream)); | ||
} | ||
|
||
public String build() { | ||
StringBuilder configBuilder = new StringBuilder(); | ||
|
||
configBuilder.append("jwtproxy:\n" + " verifier_proxies:\n"); | ||
for (VerifierProxy verifierProxy : verifierProxies) { | ||
configBuilder.append( | ||
String.format( | ||
" - listen_addr: :%s\n" // :4471 | ||
+ " verifier:\n" | ||
+ " upstream: %s/\n" // http://localhost:4401 | ||
+ " audience: http://%s\n" | ||
+ " max_skew: 1m\n" | ||
+ " max_ttl: 3h\n" | ||
+ " key_server:\n" | ||
+ " type: preshared\n" | ||
+ " options:\n" | ||
+ " issuer: wsmaster\n" | ||
+ " key_id: mykey\n" | ||
+ " public_key_path: " | ||
+ JWT_PROXY_CONFIG_FOLDER | ||
+ "/" | ||
+ JWT_PROXY_PUBLIC_KEY_FILE | ||
+ "\n" | ||
+ " claims_verifiers:\n" | ||
+ " - type: static\n" | ||
+ " options:\n" | ||
+ " iss: wsmaster\n" | ||
+ " nonce_storage:\n" | ||
+ " type: void\n", | ||
verifierProxy.listenPort, | ||
verifierProxy.upstream, | ||
workspaceId)); | ||
} | ||
configBuilder.append(" signer_proxy:\n" + " enabled: false\n"); | ||
return configBuilder.toString(); | ||
} | ||
|
||
private class VerifierProxy { | ||
private Integer listenPort; | ||
private String upstream; | ||
|
||
VerifierProxy(Integer listenPort, String upstream) { | ||
this.listenPort = listenPort; | ||
this.upstream = upstream; | ||
} | ||
} | ||
} |
210 changes: 210 additions & 0 deletions
210
...e/che/workspace/infrastructure/kubernetes/server/secure/jwtproxy/JwtProxyProvisioner.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,210 @@ | ||
/* | ||
* Copyright (c) 2012-2018 Red Hat, Inc. | ||
* All rights reserved. This program and the accompanying materials | ||
* are made available under the terms of the Eclipse Public License v1.0 | ||
* which accompanies this distribution, and is available at | ||
* http://www.eclipse.org/legal/epl-v10.html | ||
* | ||
* Contributors: | ||
* Red Hat, Inc. - initial API and implementation | ||
*/ | ||
package org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.jwtproxy; | ||
|
||
import static java.util.Collections.emptyList; | ||
import static java.util.Collections.emptyMap; | ||
import static org.eclipse.che.commons.lang.NameGenerator.generate; | ||
import static org.eclipse.che.workspace.infrastructure.kubernetes.Constants.CHE_ORIGINAL_NAME_LABEL; | ||
import static org.eclipse.che.workspace.infrastructure.kubernetes.server.KubernetesServerExposer.SERVER_PREFIX; | ||
import static org.eclipse.che.workspace.infrastructure.kubernetes.server.KubernetesServerExposer.SERVER_UNIQUE_PART_SIZE; | ||
|
||
import com.google.common.annotations.VisibleForTesting; | ||
import com.google.common.collect.ImmutableMap; | ||
import io.fabric8.kubernetes.api.model.ConfigMap; | ||
import io.fabric8.kubernetes.api.model.ConfigMapBuilder; | ||
import io.fabric8.kubernetes.api.model.ContainerBuilder; | ||
import io.fabric8.kubernetes.api.model.Pod; | ||
import io.fabric8.kubernetes.api.model.PodBuilder; | ||
import io.fabric8.kubernetes.api.model.Service; | ||
import io.fabric8.kubernetes.api.model.ServicePort; | ||
import io.fabric8.kubernetes.api.model.ServicePortBuilder; | ||
import io.fabric8.kubernetes.api.model.VolumeBuilder; | ||
import io.fabric8.kubernetes.api.model.VolumeMount; | ||
import java.security.KeyPair; | ||
import java.util.HashMap; | ||
import java.util.Map; | ||
import org.eclipse.che.api.core.model.workspace.config.MachineConfig; | ||
import org.eclipse.che.api.core.model.workspace.runtime.RuntimeIdentity; | ||
import org.eclipse.che.api.workspace.server.spi.InfrastructureException; | ||
import org.eclipse.che.api.workspace.server.spi.InternalInfrastructureException; | ||
import org.eclipse.che.api.workspace.server.spi.environment.InternalMachineConfig; | ||
import org.eclipse.che.multiuser.machine.authentication.server.signature.SignatureKeyManager; | ||
import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment; | ||
import org.eclipse.che.workspace.infrastructure.kubernetes.server.ServerServiceBuilder; | ||
|
||
/** @author Sergii Leshchenko */ | ||
public class JwtProxyProvisioner { | ||
|
||
static final int FIRST_AVAILABLE_PORT = 4400; | ||
|
||
static final int JWT_PROXY_MEMORY_LIMIT_BYTES = 128 * 1024 * 1024; // 128mb | ||
|
||
static final String PUBLIC_KEY_HEADER = "-----BEGIN PUBLIC KEY-----\n"; | ||
static final String PUBLIC_KEY_FOOTER = "\n-----END PUBLIC KEY-----"; | ||
|
||
static final String JWTPROXY_IMAGE = "ksmster/jwtproxy"; | ||
static final String JWT_PROXY_CONFIG_FILE = "config.yaml"; | ||
static final String JWT_PROXY_MACHINE_NAME = "jwtproxy"; | ||
|
||
static final String JWT_PROXY_CONFIG_FOLDER = "/config"; | ||
static final String JWT_PROXY_PUBLIC_KEY_FILE = "mykey.pub"; | ||
|
||
private final SignatureKeyManager signatureKeyManager; | ||
|
||
private final RuntimeIdentity identity; | ||
|
||
private final JwtProxyConfigBuilder proxyConfigBuilder; | ||
|
||
private final String serviceName; | ||
private int availablePort; | ||
|
||
public JwtProxyProvisioner(RuntimeIdentity identity, SignatureKeyManager signatureKeyManager) { | ||
this.signatureKeyManager = signatureKeyManager; | ||
|
||
this.identity = identity; | ||
|
||
this.proxyConfigBuilder = new JwtProxyConfigBuilder(identity.getWorkspaceId()); | ||
|
||
this.serviceName = generate(SERVER_PREFIX, SERVER_UNIQUE_PART_SIZE) + "-jwtproxy"; | ||
this.availablePort = FIRST_AVAILABLE_PORT; | ||
} | ||
|
||
/** | ||
* Modifies Kubernetes environment to expose the specified service port via JWTProxy. | ||
* | ||
* @param k8sEnv Kubernetes environment to modify | ||
* @param backendServiceName service name that will be exposed | ||
* @param backendServicePort service port that will be exposed | ||
* @param protocol protocol that will be used for exposed port | ||
* @return JWTProxy service port that expose the specified one | ||
* @throws InfrastructureException if any exception occurs during port exposing | ||
*/ | ||
public ServicePort expose( | ||
KubernetesEnvironment k8sEnv, | ||
String backendServiceName, | ||
int backendServicePort, | ||
String protocol) | ||
throws InfrastructureException { | ||
ensureJwtProxyInjected(k8sEnv); | ||
|
||
int listenPort = availablePort++; | ||
|
||
proxyConfigBuilder.addVerifierProxy( | ||
listenPort, "http://" + backendServiceName + ":" + backendServicePort); | ||
k8sEnv | ||
.getConfigMaps() | ||
.get(getConfigMapName()) | ||
.getData() | ||
.put(JWT_PROXY_CONFIG_FILE, proxyConfigBuilder.build()); | ||
|
||
ServicePort exposedPort = | ||
new ServicePortBuilder() | ||
.withName(backendServiceName + "-" + listenPort) | ||
.withPort(listenPort) | ||
.withProtocol(protocol) | ||
.withNewTargetPort(listenPort) | ||
.build(); | ||
|
||
k8sEnv.getServices().get(getServiceName()).getSpec().getPorts().add(exposedPort); | ||
|
||
return exposedPort; | ||
} | ||
|
||
/** Returns service name that exposed JWTProxy Pod. */ | ||
public String getServiceName() { | ||
return serviceName; | ||
} | ||
|
||
/** Returns config map name that will be mounted into JWTProxy Pod. */ | ||
@VisibleForTesting | ||
String getConfigMapName() { | ||
return "jwtproxy-config-" + identity.getWorkspaceId(); | ||
} | ||
|
||
private void ensureJwtProxyInjected(KubernetesEnvironment k8sEnv) throws InfrastructureException { | ||
if (!k8sEnv.getMachines().containsKey(JWT_PROXY_MACHINE_NAME)) { | ||
k8sEnv.getMachines().put(JWT_PROXY_MACHINE_NAME, createJwtProxyMachine()); | ||
k8sEnv.getPods().put("jwtproxy", createJwtProxyPod(identity)); | ||
|
||
KeyPair keyPair = signatureKeyManager.getKeyPair(); | ||
if (keyPair == null) { | ||
throw new InternalInfrastructureException( | ||
"Key pair for machine authentication does not exist"); | ||
} | ||
Map<String, String> initConfigMapData = new HashMap<>(); | ||
initConfigMapData.put( | ||
JWT_PROXY_PUBLIC_KEY_FILE, | ||
PUBLIC_KEY_HEADER | ||
+ java.util.Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded()) | ||
+ PUBLIC_KEY_FOOTER); | ||
|
||
initConfigMapData.put(JWT_PROXY_CONFIG_FILE, proxyConfigBuilder.build()); | ||
|
||
ConfigMap jwtProxyConfigMap = | ||
new ConfigMapBuilder() | ||
.withNewMetadata() | ||
.withName(getConfigMapName()) | ||
.endMetadata() | ||
.withData(initConfigMapData) | ||
.build(); | ||
k8sEnv.getConfigMaps().put(jwtProxyConfigMap.getMetadata().getName(), jwtProxyConfigMap); | ||
|
||
Service jwtProxyService = | ||
new ServerServiceBuilder() | ||
.withName(serviceName) | ||
.withSelectorEntry(CHE_ORIGINAL_NAME_LABEL, JWT_PROXY_MACHINE_NAME) | ||
.withMachineName(JWT_PROXY_MACHINE_NAME) | ||
.withPorts(emptyList()) | ||
.build(); | ||
k8sEnv.getServices().put(jwtProxyService.getMetadata().getName(), jwtProxyService); | ||
} | ||
} | ||
|
||
private InternalMachineConfig createJwtProxyMachine() { | ||
return new InternalMachineConfig( | ||
null, | ||
emptyMap(), | ||
emptyMap(), | ||
ImmutableMap.of( | ||
MachineConfig.MEMORY_LIMIT_ATTRIBUTE, Integer.toString(JWT_PROXY_MEMORY_LIMIT_BYTES)), | ||
null); | ||
} | ||
|
||
private Pod createJwtProxyPod(RuntimeIdentity identity) { | ||
return new PodBuilder() | ||
.withNewMetadata() | ||
.withName("jwtproxy") | ||
.withAnnotations( | ||
ImmutableMap.of( | ||
"org.eclipse.che.container.verifier.machine_name", JWT_PROXY_MACHINE_NAME)) | ||
.endMetadata() | ||
.withNewSpec() | ||
.withContainers( | ||
new ContainerBuilder() | ||
.withName("verifier") | ||
.withImage(JWTPROXY_IMAGE) | ||
.withVolumeMounts( | ||
new VolumeMount( | ||
JWT_PROXY_CONFIG_FOLDER + "/", "jwtproxy-config-volume", false, null)) | ||
.withArgs("-config", JWT_PROXY_CONFIG_FOLDER + "/" + JWT_PROXY_CONFIG_FILE) | ||
.build()) | ||
.withVolumes( | ||
new VolumeBuilder() | ||
.withName("jwtproxy-config-volume") | ||
.withNewConfigMap() | ||
.withName("jwtproxy-config-" + identity.getWorkspaceId()) | ||
.endConfigMap() | ||
.build()) | ||
.endSpec() | ||
.build(); | ||
} | ||
} |
Oops, something went wrong.