-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable serf encryption #1791
Enable serf encryption #1791
Changes from 9 commits
6705ab8
1bc0c02
2c115a2
7a5362d
1bc1b9b
b269804
e3dea06
8514abe
35a02c0
aa7c8c2
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -16,6 +16,19 @@ type Agent struct { | |
region string | ||
} | ||
|
||
// KeyringResponse is a unified key response and can be used for install, | ||
// remove, use, as well as listing key queries. | ||
type KeyringResponse struct { | ||
Messages map[string]string | ||
Keys map[string]int | ||
NumNodes int | ||
} | ||
|
||
// KeyringRequest is request objects for serf key operations. | ||
type KeyringRequest struct { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Unused? Looks like you use structs.KeyringRequest instead. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Using them now. |
||
Key string | ||
} | ||
|
||
// Agent returns a new agent which can be used to query | ||
// the agent-specific endpoints. | ||
func (c *Client) Agent() *Agent { | ||
|
@@ -157,6 +170,46 @@ func (a *Agent) SetServers(addrs []string) error { | |
return err | ||
} | ||
|
||
// ListKeys returns the list of installed keys | ||
func (a *Agent) ListKeys() (*KeyringResponse, error) { | ||
var resp KeyringResponse | ||
_, err := a.client.query("/v1/agent/keyring/list", &resp, nil) | ||
if err != nil { | ||
return nil, err | ||
} | ||
return &resp, nil | ||
} | ||
|
||
// InstallKey installs a key in the keyrings of all the serf members | ||
func (a *Agent) InstallKey(key string) (*KeyringResponse, error) { | ||
args := KeyringRequest{ | ||
Key: key, | ||
} | ||
var resp KeyringResponse | ||
_, err := a.client.write("/v1/agent/keyring/install", &args, &resp, nil) | ||
return &resp, err | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Above you do the extra |
||
} | ||
|
||
// UseKey uses a key from the keyring of serf members | ||
func (a *Agent) UseKey(key string) (*KeyringResponse, error) { | ||
args := KeyringRequest{ | ||
Key: key, | ||
} | ||
var resp KeyringResponse | ||
_, err := a.client.write("/v1/agent/keyring/use", &args, &resp, nil) | ||
return &resp, err | ||
} | ||
|
||
// RemoveKey removes a particular key from keyrings of serf members | ||
func (a *Agent) RemoveKey(key string) (*KeyringResponse, error) { | ||
args := KeyringRequest{ | ||
Key: key, | ||
} | ||
var resp KeyringResponse | ||
_, err := a.client.write("/v1/agent/keyring/remove", &args, &resp, nil) | ||
return &resp, err | ||
} | ||
|
||
// joinResponse is used to decode the response we get while | ||
// sending a member join request. | ||
type joinResponse struct { | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,11 +1,15 @@ | ||
package agent | ||
|
||
import ( | ||
"bytes" | ||
"encoding/json" | ||
"fmt" | ||
"net/http" | ||
"net/http/httptest" | ||
"strings" | ||
"testing" | ||
|
||
"github.com/hashicorp/nomad/nomad/structs" | ||
) | ||
|
||
func TestHTTP_AgentSelf(t *testing.T) { | ||
|
@@ -177,3 +181,111 @@ func TestHTTP_AgentSetServers(t *testing.T) { | |
} | ||
}) | ||
} | ||
|
||
func TestHTTP_AgentListKeys(t *testing.T) { | ||
key1 := "HS5lJ+XuTlYKWaeGYyG+/A==" | ||
|
||
httpTest(t, func(c *Config) { | ||
c.Server.EncryptKey = key1 | ||
}, func(s *TestServer) { | ||
req, err := http.NewRequest("GET", "/v1/agent/keyring/list", nil) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
respW := httptest.NewRecorder() | ||
|
||
out, err := s.Server.KeyringOperationRequest(respW, req) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
kresp := out.(structs.KeyringResponse) | ||
if len(kresp.Keys) != 1 { | ||
t.Fatalf("bad: %v", kresp) | ||
} | ||
}) | ||
} | ||
|
||
func TestHTTP_AgentInstallKey(t *testing.T) { | ||
key1 := "HS5lJ+XuTlYKWaeGYyG+/A==" | ||
key2 := "wH1Bn9hlJ0emgWB1JttVRA==" | ||
|
||
httpTest(t, func(c *Config) { | ||
c.Server.EncryptKey = key1 | ||
}, func(s *TestServer) { | ||
b, err := json.Marshal(&structs.KeyringRequest{Key: key2}) | ||
if err != nil { | ||
t.Fatalf("err: %v", err) | ||
} | ||
req, err := http.NewRequest("GET", "/v1/agent/keyring/install", bytes.NewReader(b)) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
respW := httptest.NewRecorder() | ||
|
||
_, err = s.Server.KeyringOperationRequest(respW, req) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
req, err = http.NewRequest("GET", "/v1/agent/keyring/list", bytes.NewReader(b)) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
respW = httptest.NewRecorder() | ||
|
||
out, err := s.Server.KeyringOperationRequest(respW, req) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
kresp := out.(structs.KeyringResponse) | ||
if len(kresp.Keys) != 2 { | ||
t.Fatalf("bad: %v", kresp) | ||
} | ||
}) | ||
} | ||
|
||
func TestHTTP_AgentRemoveKey(t *testing.T) { | ||
key1 := "HS5lJ+XuTlYKWaeGYyG+/A==" | ||
key2 := "wH1Bn9hlJ0emgWB1JttVRA==" | ||
|
||
httpTest(t, func(c *Config) { | ||
c.Server.EncryptKey = key1 | ||
}, func(s *TestServer) { | ||
b, err := json.Marshal(&structs.KeyringRequest{Key: key2}) | ||
if err != nil { | ||
t.Fatalf("err: %v", err) | ||
} | ||
|
||
req, err := http.NewRequest("GET", "/v1/agent/keyring/install", bytes.NewReader(b)) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
respW := httptest.NewRecorder() | ||
_, err = s.Server.KeyringOperationRequest(respW, req) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
|
||
req, err = http.NewRequest("GET", "/v1/agent/keyring/remove", bytes.NewReader(b)) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
respW = httptest.NewRecorder() | ||
if _, err = s.Server.KeyringOperationRequest(respW, req); err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
|
||
req, err = http.NewRequest("GET", "/v1/agent/keyring/list", nil) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
respW = httptest.NewRecorder() | ||
out, err := s.Server.KeyringOperationRequest(respW, req) | ||
if err != nil { | ||
t.Fatalf("err: %s", err) | ||
} | ||
kresp := out.(structs.KeyringResponse) | ||
if len(kresp.Keys) != 1 { | ||
t.Fatalf("bad: %v", kresp) | ||
} | ||
}) | ||
} | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Does it make sense to also add a test for |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -68,6 +68,7 @@ server { | |
retry_max = 3 | ||
retry_interval = "15s" | ||
rejoin_after_leave = true | ||
encrypt = "abc" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Indentation There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. whitespace |
||
} | ||
telemetry { | ||
statsite_address = "127.0.0.1:1234" | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe just use the struct package's KeyringResponse instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@schmichael The API package mimics the structs package largely but gives a separation between internal and external structs
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Well that explains it! Thanks. (Wish I could mark comments as addressed in this new PR mode without full on deleting them...)