-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
TLS support for http and RPC #1853
Merged
Merged
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
11c1583
Implemented TLS support for http and rpc
diptanu 15b2cc5
Changed the way TLS config is parsed
diptanu e115f83
Updated the spec definition for tls config
diptanu 0e6e5b3
Enabling TLS on cli
diptanu ecfb24d
Moving the TLSConfig to structs
diptanu ac5f6fc
Moving the certs into tlsutil package
diptanu f416ac7
Moved tlsutil into helpers
diptanu File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -10,6 +10,7 @@ import ( | |
|
||
"github.com/hashicorp/nomad/nomad/structs" | ||
"github.com/hashicorp/nomad/nomad/structs/config" | ||
"github.com/hashicorp/nomad/tlsutil" | ||
) | ||
|
||
var ( | ||
|
@@ -132,6 +133,32 @@ type Config struct { | |
// PublishAllocationMetrics determines whether nomad is going to publish | ||
// allocation metrics to remote Telemetry sinks | ||
PublishAllocationMetrics bool | ||
|
||
// HttpTLS enables TLS for the HTTP endpoints on the clients. | ||
HttpTLS bool | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can you just embed the TLSConfig struct |
||
|
||
// RpcTLS enables TLS for the outgoing TLS connections to the Nomad servers. | ||
RpcTLS bool | ||
|
||
// VerifyServerHostname is used to enable hostname verification of servers. This | ||
// ensures that the certificate presented is valid for server.<datacenter>.<domain>. | ||
// This prevents a compromised client from being restarted as a server, and then | ||
// intercepting request traffic as well as being added as a raft peer. This should be | ||
// enabled by default with VerifyOutgoing, but for legacy reasons we cannot break | ||
// existing clients. | ||
VerifyServerHostname bool | ||
|
||
// CAFile is a path to a certificate authority file. This is used with VerifyIncoming | ||
// or VerifyOutgoing to verify the TLS connection. | ||
CAFile string | ||
|
||
// CertFile is used to provide a TLS certificate that is used for serving TLS connections. | ||
// Must be provided to serve TLS connections. | ||
CertFile string | ||
|
||
// KeyFile is used to provide a TLS key that is used for serving TLS connections. | ||
// Must be provided to serve TLS connections. | ||
KeyFile string | ||
} | ||
|
||
func (c *Config) Copy() *Config { | ||
|
@@ -226,3 +253,17 @@ func (c *Config) ReadStringListToMapDefault(key, defaultValue string) map[string | |
} | ||
return list | ||
} | ||
|
||
// TLSConfig returns a TLSUtil Config based on the client configuration | ||
func (c *Config) TLSConfig() *tlsutil.Config { | ||
tlsConf := &tlsutil.Config{ | ||
VerifyIncoming: true, | ||
VerifyOutgoing: true, | ||
VerifyServerHostname: c.VerifyServerHostname, | ||
CAFile: c.CAFile, | ||
CertFile: c.CertFile, | ||
KeyFile: c.KeyFile, | ||
ServerName: c.Node.Name, | ||
} | ||
return tlsConf | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -112,6 +112,10 @@ type Config struct { | |
// List of config files that have been loaded (in order) | ||
Files []string `mapstructure:"-"` | ||
|
||
// TLSConfig provides TLS related configuration for the Nomad server and | ||
// client | ||
TLSConfig *TLSConfig `mapstructure:"tls"` | ||
|
||
// HTTPAPIResponseHeaders allows users to configure the Nomad http agent to | ||
// set arbritrary headers on API responses | ||
HTTPAPIResponseHeaders map[string]string `mapstructure:"http_api_response_headers"` | ||
|
@@ -135,6 +139,36 @@ type AtlasConfig struct { | |
Endpoint string `mapstructure:"endpoint"` | ||
} | ||
|
||
// TLSConfig provides TLS related configuration | ||
type TLSConfig struct { | ||
|
||
// EnableHTTP enabled TLS for http traffic to the Nomad server and clients | ||
EnableHTTP bool `mapstructure:"http"` | ||
|
||
// EnableRPC enables TLS for RPC and Raft traffic to the Nomad servers | ||
EnableRPC bool `mapstructure:"rpc"` | ||
|
||
// VerifyServerHostname is used to enable hostname verification of servers. This | ||
// ensures that the certificate presented is valid for server.<datacenter>.<domain>. | ||
// This prevents a compromised client from being restarted as a server, and then | ||
// intercepting request traffic as well as being added as a raft peer. This should be | ||
// enabled by default with VerifyOutgoing, but for legacy reasons we cannot break | ||
// existing clients. | ||
VerifyServerHostname bool `mapstructure:"verify_server_hostname"` | ||
|
||
// CAFile is a path to a certificate authority file. This is used with VerifyIncoming | ||
// or VerifyOutgoing to verify the TLS connection. | ||
CAFile string `mapstructure:"ca_file"` | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Missing CAPath |
||
|
||
// CertFile is used to provide a TLS certificate that is used for serving TLS connections. | ||
// Must be provided to serve TLS connections. | ||
CertFile string `mapstructure:"cert_file"` | ||
|
||
// KeyFile is used to provide a TLS key that is used for serving TLS connections. | ||
// Must be provided to serve TLS connections. | ||
KeyFile string `mapstructure:"key_file"` | ||
} | ||
|
||
// ClientConfig is configuration specific to the client mode | ||
type ClientConfig struct { | ||
// Enabled controls if we are a client | ||
|
@@ -486,6 +520,7 @@ func DefaultConfig() *Config { | |
CollectionInterval: "1s", | ||
collectionInterval: 1 * time.Second, | ||
}, | ||
TLSConfig: &TLSConfig{}, | ||
} | ||
} | ||
|
||
|
@@ -566,6 +601,14 @@ func (c *Config) Merge(b *Config) *Config { | |
result.Telemetry = result.Telemetry.Merge(b.Telemetry) | ||
} | ||
|
||
// Apply the TLS Config | ||
if result.TLSConfig == nil && b.TLSConfig != nil { | ||
tlsConfig := *b.TLSConfig | ||
result.TLSConfig = &tlsConfig | ||
} else if b.TLSConfig != nil { | ||
result.TLSConfig = result.TLSConfig.Merge(b.TLSConfig) | ||
} | ||
|
||
// Apply the client config | ||
if result.Client == nil && b.Client != nil { | ||
client := *b.Client | ||
|
@@ -764,6 +807,32 @@ func (a *ClientConfig) Merge(b *ClientConfig) *ClientConfig { | |
return &result | ||
} | ||
|
||
// Merge is used to merge two TLS configs together | ||
func (t *TLSConfig) Merge(b *TLSConfig) *TLSConfig { | ||
result := *t | ||
|
||
if b.EnableHTTP { | ||
result.EnableHTTP = true | ||
} | ||
if b.EnableRPC { | ||
result.EnableRPC = true | ||
} | ||
if b.VerifyServerHostname { | ||
result.VerifyServerHostname = true | ||
} | ||
if b.CAFile != "" { | ||
result.CAFile = b.CAFile | ||
} | ||
if b.CertFile != "" { | ||
result.CertFile = b.CertFile | ||
} | ||
if b.KeyFile != "" { | ||
result.KeyFile = b.KeyFile | ||
} | ||
|
||
return &result | ||
} | ||
|
||
// Merge is used to merge two telemetry configs together | ||
func (a *Telemetry) Merge(b *Telemetry) *Telemetry { | ||
result := *a | ||
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Space after
//