Conditionally enable mtls for the allocator.

cmd/allocator/main.go

@@ -88,64 +88,66 @@ func main() {
 		return err
 	})
 
-	h := newServiceHandler(kubeClient, agonesClient, health)
-
-	// creates a new file watcher for client certificate folder
-	watcher, err := fsnotify.NewWatcher()
-	if err != nil {
-		logger.WithError(err).Fatal("could not create watcher for client certs")
-	}
-	defer watcher.Close() // nolint: errcheck
-	if err := watcher.Add(certDir); err != nil {
-		logger.WithError(err).Fatalf("cannot watch folder %s for secret changes", certDir)
-	}
-
-	watcherTLS, err := fsnotify.NewWatcher()
-	if err != nil {
-		logger.WithError(err).Fatal("could not create watcher for tls certs")
-	}
-	defer watcherTLS.Close() // nolint: errcheck
-	if err := watcherTLS.Add(tlsDir); err != nil {
-		logger.WithError(err).Fatalf("cannot watch folder %s for secret changes", tlsDir)
-	}
+	h := newServiceHandler(kubeClient, agonesClient, health, conf.MTLSDisabled)
 
 	listener, err := net.Listen("tcp", fmt.Sprintf(":%s", sslPort))
 	if err != nil {
 		logger.WithError(err).Fatalf("failed to listen on TCP port %s", sslPort)
 	}
 
-	// Watching for the events in certificate directory for updating certificates, when there is a change
-	go func() {
-		for {
-			select {
-			// watch for events
-			case event := <-watcherTLS.Events:
-				tlsCert, err := readTLSCert()
-				if err != nil {
-					logger.WithError(err).Error("could not load TLS cert; keeping old one")
-				} else {
-					h.tlsMutex.Lock()
-					h.tlsCert = tlsCert
-					h.tlsMutex.Unlock()
-				}
-				logger.Infof("Tls directory change event %v", event)
-			case event := <-watcher.Events:
-				h.certMutex.Lock()
-				caCertPool, err := getCACertPool(certDir)
-				if err != nil {
-					logger.WithError(err).Error("could not load CA certs; keeping old ones")
-				} else {
-					h.caCertPool = caCertPool
-				}
-				logger.Infof("Certificate directory change event %v", event)
-				h.certMutex.Unlock()
+	if !h.mTLSDisabled {
+		// creates a new file watcher for client certificate folder
+		watcher, err := fsnotify.NewWatcher()
+		if err != nil {
+			logger.WithError(err).Fatal("could not create watcher for client certs")
+		}
+		defer watcher.Close() // nolint: errcheck
+		if err := watcher.Add(certDir); err != nil {
+			logger.WithError(err).Fatalf("cannot watch folder %s for secret changes", certDir)
+		}
 
-				// watch for errors
-			case err := <-watcher.Errors:
-				logger.WithError(err).Error("error watching for certificate directory")
-			}
+		watcherTLS, err := fsnotify.NewWatcher()
+		if err != nil {
+			logger.WithError(err).Fatal("could not create watcher for tls certs")
 		}
-	}()
+		defer watcherTLS.Close() // nolint: errcheck
+		if err := watcherTLS.Add(tlsDir); err != nil {
+			logger.WithError(err).Fatalf("cannot watch folder %s for secret changes", tlsDir)
+		}
+
+		// Watching for the events in certificate directory for updating certificates, when there is a change
+		go func() {
+			for {
+				select {
+				// watch for events
+				case event := <-watcherTLS.Events:
+					tlsCert, err := readTLSCert()
+					if err != nil {
+						logger.WithError(err).Error("could not load TLS cert; keeping old one")
+					} else {
+						h.tlsMutex.Lock()
+						h.tlsCert = tlsCert
+						h.tlsMutex.Unlock()
+					}
+					logger.Infof("Tls directory change event %v", event)
+				case event := <-watcher.Events:
+					h.certMutex.Lock()
+					caCertPool, err := getCACertPool(certDir)
+					if err != nil {
+						logger.WithError(err).Error("could not load CA certs; keeping old ones")
+					} else {
+						h.caCertPool = caCertPool
+					}
+					logger.Infof("Certificate directory change event %v", event)
+					h.certMutex.Unlock()
+
+					// watch for errors
+				case err := <-watcher.Errors:
+					logger.WithError(err).Error("error watching for certificate directory")
+				}
+			}
+		}()
+	}
 
 	opts := h.getServerOptions()
 
@@ -165,7 +167,7 @@ func main() {
 	logger.WithError(err).Fatal("allocation service crashed")
 }
 
-func newServiceHandler(kubeClient kubernetes.Interface, agonesClient versioned.Interface, health healthcheck.Handler) *serviceHandler {
+func newServiceHandler(kubeClient kubernetes.Interface, agonesClient versioned.Interface, health healthcheck.Handler, mTLSDisabled bool) *serviceHandler {
 	defaultResync := 30 * time.Second
 	agonesInformerFactory := externalversions.NewSharedInformerFactory(agonesClient, defaultResync)
 	kubeInformerFactory := informers.NewSharedInformerFactory(kubeClient, defaultResync)
@@ -175,13 +177,14 @@ func newServiceHandler(kubeClient kubernetes.Interface, agonesClient versioned.I
 		agonesInformerFactory.Multicluster().V1().GameServerAllocationPolicies(),
 		kubeInformerFactory.Core().V1().Secrets(),
 		kubeClient,
-		gameserverallocations.NewReadyGameServerCache(agonesInformerFactory.Agones().V1().GameServers(), agonesClient.AgonesV1(), gsCounter, health))
+		gameserverallocations.NewReadyGameServerCache(agonesInformerFactory.Agones().V1().GameServers(), agonesClient.AgonesV1(), gsCounter, health), mTLSDisabled)
 
 	stop := signals.NewStopChannel()
 	h := serviceHandler{
 		allocationCallback: func(gsa *allocationv1.GameServerAllocation) (k8sruntime.Object, error) {
 			return allocator.Allocate(gsa, stop)
 		},
+		mTLSDisabled: mTLSDisabled,
 	}
 
 	kubeInformerFactory.Start(stop)
@@ -190,21 +193,23 @@ func newServiceHandler(kubeClient kubernetes.Interface, agonesClient versioned.I
 		logger.WithError(err).Fatal("starting allocator failed.")
 	}
 
-	caCertPool, err := getCACertPool(certDir)
-	if err != nil {
-		logger.WithError(err).Fatal("could not load CA certs.")
-	}
-	h.certMutex.Lock()
-	h.caCertPool = caCertPool
-	h.certMutex.Unlock()
+	if !h.mTLSDisabled {
+		caCertPool, err := getCACertPool(certDir)
+		if err != nil {
+			logger.WithError(err).Fatal("could not load CA certs.")
+		}
+		h.certMutex.Lock()
+		h.caCertPool = caCertPool
+		h.certMutex.Unlock()
 
-	tlsCert, err := readTLSCert()
-	if err != nil {
-		logger.WithError(err).Fatal("could not load TLS certs.")
+		tlsCert, err := readTLSCert()
+		if err != nil {
+			logger.WithError(err).Fatal("could not load TLS certs.")
+		}
+		h.tlsMutex.Lock()
+		h.tlsCert = tlsCert
+		h.tlsMutex.Unlock()
 	}
-	h.tlsMutex.Lock()
-	h.tlsCert = tlsCert
-	h.tlsMutex.Unlock()
 
 	return &h
 }
@@ -220,6 +225,9 @@ func readTLSCert() (*tls.Certificate, error) {
 // getServerOptions returns a list of GRPC server options.
 // Current options are TLS certs and opencensus stats handler.
 func (h *serviceHandler) getServerOptions() []grpc.ServerOption {
+	if h.mTLSDisabled {
+		return []grpc.ServerOption{grpc.StatsHandler(&ocgrpc.ServerHandler{})}
+	}
 
 	cfg := &tls.Config{
 		GetCertificate:        h.getTLSCert,
@@ -323,6 +331,8 @@ type serviceHandler struct {
 
 	tlsMutex sync.RWMutex
 	tlsCert  *tls.Certificate
+
+	mTLSDisabled bool
 }
 
 // Allocate implements the Allocate gRPC method definition

cmd/allocator/metrics.go

@@ -32,13 +32,15 @@ const (
 	enablePrometheusMetricsFlag  = "prometheus-exporter"
 	projectIDFlag                = "gcp-project-id"
 	stackdriverLabels            = "stackdriver-labels"
+	mTLSDisabledFlag             = "disable-mtls"
 )
 
 func init() {
 	registerMetricViews()
 }
 
 type config struct {
+	MTLSDisabled      bool
 	PrometheusMetrics bool
 	Stackdriver       bool
 	GCPProjectID      string
@@ -51,11 +53,13 @@ func parseEnvFlags() config {
 	viper.SetDefault(enableStackdriverMetricsFlag, false)
 	viper.SetDefault(projectIDFlag, "")
 	viper.SetDefault(stackdriverLabels, "")
+	viper.SetDefault(mTLSDisabledFlag, false)
 
 	pflag.Bool(enablePrometheusMetricsFlag, viper.GetBool(enablePrometheusMetricsFlag), "Flag to activate metrics of Agones. Can also use PROMETHEUS_EXPORTER env variable.")
 	pflag.Bool(enableStackdriverMetricsFlag, viper.GetBool(enableStackdriverMetricsFlag), "Flag to activate stackdriver monitoring metrics for Agones. Can also use STACKDRIVER_EXPORTER env variable.")
 	pflag.String(projectIDFlag, viper.GetString(projectIDFlag), "GCP ProjectID used for Stackdriver, if not specified ProjectID from Application Default Credentials would be used. Can also use GCP_PROJECT_ID env variable.")
 	pflag.String(stackdriverLabels, viper.GetString(stackdriverLabels), "A set of default labels to add to all stackdriver metrics generated. By default metadata are automatically added using Kubernetes API and GCP metadata enpoint.")
+	pflag.Bool(mTLSDisabledFlag, viper.GetBool(mTLSDisabledFlag), "Flag to enable/disable mTLS in the allocator.")
 	runtime.FeaturesBindFlags()
 	pflag.Parse()
 
@@ -64,6 +68,7 @@ func parseEnvFlags() config {
 	runtime.Must(viper.BindEnv(enableStackdriverMetricsFlag))
 	runtime.Must(viper.BindEnv(projectIDFlag))
 	runtime.Must(viper.BindEnv(stackdriverLabels))
+	runtime.Must(viper.BindEnv(mTLSDisabledFlag))
 	runtime.Must(viper.BindPFlags(pflag.CommandLine))
 	runtime.Must(runtime.FeaturesBindEnv())
 
@@ -74,6 +79,7 @@ func parseEnvFlags() config {
 		Stackdriver:       viper.GetBool(enableStackdriverMetricsFlag),
 		GCPProjectID:      viper.GetString(projectIDFlag),
 		StackdriverLabels: viper.GetString(stackdriverLabels),
+		MTLSDisabled:      viper.GetBool(mTLSDisabledFlag),
 	}
 }
 

cmd/controller/main.go

@@ -76,6 +76,7 @@ const (
 	logLevelFlag                 = "log-level"
 	logSizeLimitMBFlag           = "log-size-limit-mb"
 	kubeconfigFlag               = "kubeconfig"
+	mTLSDisabledFlag             = "disable-mtls"
 	defaultResync                = 30 * time.Second
 )
 
@@ -209,7 +210,7 @@ func main() {
 	gsSetController := gameserversets.NewController(wh, health, gsCounter,
 		kubeClient, extClient, agonesClient, agonesInformerFactory)
 	fleetController := fleets.NewController(wh, health, kubeClient, extClient, agonesClient, agonesInformerFactory)
-	gasController := gameserverallocations.NewController(api, health, gsCounter, kubeClient, kubeInformerFactory, agonesClient, agonesInformerFactory)
+	gasController := gameserverallocations.NewController(api, health, gsCounter, kubeClient, kubeInformerFactory, agonesClient, agonesInformerFactory, ctlConf.MTLSDisabled)
 	fasController := fleetautoscalers.NewController(wh, health,
 		kubeClient, extClient, agonesClient, agonesInformerFactory)
 
@@ -240,6 +241,7 @@ func parseEnvFlags() config {
 	}
 
 	base := filepath.Dir(exec)
+	viper.SetDefault(mTLSDisabledFlag, false)
 	viper.SetDefault(sidecarImageFlag, "gcr.io/agones-images/agones-sdk:"+pkg.Version)
 	viper.SetDefault(sidecarCPURequestFlag, "0")
 	viper.SetDefault(sidecarCPULimitFlag, "0")
@@ -261,6 +263,7 @@ func parseEnvFlags() config {
 	viper.SetDefault(logLevelFlag, "Info")
 	viper.SetDefault(logSizeLimitMBFlag, 10000) // 10 GB, will be split into 100 MB chunks
 
+	pflag.Bool(mTLSDisabledFlag, viper.GetBool(mTLSDisabledFlag), "Flag to enable/disable mTLS for the allocator.")
 	pflag.String(sidecarImageFlag, viper.GetString(sidecarImageFlag), "Flag to overwrite the GameServer sidecar image that is used. Can also use SIDECAR env variable")
 	pflag.String(sidecarCPULimitFlag, viper.GetString(sidecarCPULimitFlag), "Flag to overwrite the GameServer sidecar container's cpu limit. Can also use SIDECAR_CPU_LIMIT env variable")
 	pflag.String(sidecarCPURequestFlag, viper.GetString(sidecarCPURequestFlag), "Flag to overwrite the GameServer sidecar container's cpu request. Can also use SIDECAR_CPU_REQUEST env variable")
@@ -287,6 +290,7 @@ func parseEnvFlags() config {
 	pflag.Parse()
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+	runtime.Must(viper.BindEnv(mTLSDisabledFlag))
 	runtime.Must(viper.BindEnv(sidecarImageFlag))
 	runtime.Must(viper.BindEnv(sidecarCPULimitFlag))
 	runtime.Must(viper.BindEnv(sidecarCPURequestFlag))
@@ -357,6 +361,7 @@ func parseEnvFlags() config {
 		LogLevel:              viper.GetString(logLevelFlag),
 		LogSizeLimitMB:        int(viper.GetInt32(logSizeLimitMBFlag)),
 		StackdriverLabels:     viper.GetString(stackdriverLabels),
+		MTLSDisabled:          viper.GetBool(mTLSDisabledFlag),
 	}
 }
 
@@ -373,6 +378,7 @@ type config struct {
 	AlwaysPullSidecar     bool
 	PrometheusMetrics     bool
 	Stackdriver           bool
+	MTLSDisabled          bool
 	StackdriverLabels     string
 	KeyFile               string
 	CertFile              string

install/helm/agones/templates/controller.yaml

@@ -120,6 +120,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
+        - name: DISABLE_MTLS
+          value: {{ .Values.agones.disableMTLS | quote }}
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:

install/helm/agones/templates/service/allocation.yaml

@@ -118,6 +118,8 @@ spec:
           value: {{ .Values.agones.metrics.stackdriverProjectID | quote }}
         - name: STACKDRIVER_LABELS
           value: {{ .Values.agones.metrics.stackdriverLabels | quote }}
+        - name: DISABLE_MTLS
+          value: {{ .Values.agones.disableMTLS | quote }}
         - name: POD_NAME
           valueFrom:
             fieldRef:

install/helm/agones/values.yaml

@@ -34,6 +34,7 @@ agones:
     sdk: agones-sdk
   createPriorityClass: true
   priorityClassName: agones-system
+  disableMTLS: false
   controller:
     resources: {}
     nodeSelector: {}

install/yaml/install.yaml

@@ -1392,6 +1392,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
+        - name: DISABLE_MTLS
+          value: "false"
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
@@ -1574,6 +1576,8 @@ spec:
           value: ""
         - name: STACKDRIVER_LABELS
           value: ""
+        - name: DISABLE_MTLS
+          value: "false"
         - name: POD_NAME
           valueFrom:
             fieldRef:

pkg/gameserverallocations/allocator.go

@@ -107,6 +107,7 @@ type Allocator struct {
 	readyGameServerCache     *ReadyGameServerCache
 	topNGameServerCount      int
 	remoteAllocationCallback func(string, grpc.DialOption, *pb.AllocationRequest) (*pb.AllocationResponse, error)
+	mTLSDisabled             bool
 }
 
 // request is an async request for allocation
@@ -124,7 +125,7 @@ type response struct {
 
 // NewAllocator creates an instance off Allocator
 func NewAllocator(policyInformer multiclusterinformerv1.GameServerAllocationPolicyInformer, secretInformer informercorev1.SecretInformer,
-	kubeClient kubernetes.Interface, readyGameServerCache *ReadyGameServerCache) *Allocator {
+	kubeClient kubernetes.Interface, readyGameServerCache *ReadyGameServerCache, mTLSDisabled bool) *Allocator {
 	ah := &Allocator{
 		pendingRequests:        make(chan request, maxBatchQueue),
 		allocationPolicyLister: policyInformer.Lister(),
@@ -143,6 +144,7 @@ func NewAllocator(policyInformer multiclusterinformerv1.GameServerAllocationPoli
 			grpcClient := pb.NewAllocationServiceClient(conn)
 			return grpcClient.Allocate(context.Background(), request)
 		},
+		mTLSDisabled: mTLSDisabled,
 	}
 
 	ah.baseLogger = runtime.NewLoggerWithType(ah)
@@ -364,6 +366,10 @@ func (c *Allocator) allocateFromRemoteCluster(gsa *allocationv1.GameServerAlloca
 
 // createRemoteClusterDialOption creates a grpc client dial option with proper certs to make a remote call.
 func (c *Allocator) createRemoteClusterDialOption(namespace string, connectionInfo *multiclusterv1.ClusterConnectionInfo) (grpc.DialOption, error) {
+	if c.mTLSDisabled {
+		return grpc.WithInsecure(), nil
+	}
+
 	clientCert, clientKey, caCert, err := c.getClientCertificates(namespace, connectionInfo.SecretName)
 	if err != nil {
 		return nil, err

pkg/gameserverallocations/controller.go

@@ -58,14 +58,16 @@ func NewController(apiServer *apiserver.APIServer,
 	kubeInformerFactory informers.SharedInformerFactory,
 	agonesClient versioned.Interface,
 	agonesInformerFactory externalversions.SharedInformerFactory,
+	mTLSDisabled bool,
 ) *Controller {
 	c := &Controller{
 		api: apiServer,
 		allocator: NewAllocator(
 			agonesInformerFactory.Multicluster().V1().GameServerAllocationPolicies(),
 			kubeInformerFactory.Core().V1().Secrets(),
 			kubeClient,
-			NewReadyGameServerCache(agonesInformerFactory.Agones().V1().GameServers(), agonesClient.AgonesV1(), counter, health)),
+			NewReadyGameServerCache(agonesInformerFactory.Agones().V1().GameServers(), agonesClient.AgonesV1(), counter, health),
+			mTLSDisabled),
 	}
 	c.baseLogger = runtime.NewLoggerWithType(c)