Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding TLS Certificate Authentication to gRPC #5040

Merged
merged 1 commit into from
Jun 21, 2024

Conversation

zhzhuang-zju
Copy link
Contributor

@zhzhuang-zju zhzhuang-zju commented Jun 12, 2024

What type of PR is this?
/kind feature

What this PR does / why we need it:
For now, the grpc connection between karmada-scheduler-estimator and karmada-scheduler/karmada-descheduler is insecure by default, and does not provide a way to config TLS Certificate Authentication. So I would like to introduce the ability to authenticate grpc tls certificates, including:

  • server-side TLS(enabled if a certificate is configured)
  • mutual TLS(enabled by the flag ---client-cert-auth=true)

Which issue(s) this PR fixes:
Parts of #5041

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

`Security Enhancement`: Introduced TLS certificate authentication mechanism to secure gRPC connections to `karmada-scheduler-estimator`. 
The flags added to `karmada-scheduler-estimator` are:
--grpc-auth-cert-file
--grpc-auth-key-file
--grpc-client-ca-file
--insecure-skip-grpc-client-verify
The flags added to `karmada-scheduler` are:
--scheduler-estimator-ca-file
--scheduler-estimator-key-file
--scheduler-estimator-cert-file
--insecure-skip-estimator-verify
The flags added to `karmada-descheduler` are:
--scheduler-estimator-ca-file
--scheduler-estimator-key-file
--scheduler-estimator-cert-file
--insecure-skip-estimator-verify

The added filed don't require any adoption during the process of upgrading from a previous version of Karmada, but gives an optional and recommended wait to secure the gRPC connection.

@karmada-bot karmada-bot added the kind/feature Categorizes issue or PR as related to a new feature. label Jun 12, 2024
@karmada-bot karmada-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jun 12, 2024
@codecov-commenter
Copy link

codecov-commenter commented Jun 12, 2024

Codecov Report

Attention: Patch coverage is 25.00000% with 90 lines in your changes missing coverage. Please review.

Project coverage is 28.23%. Comparing base (2ad9cbb) to head (7bd0bcf).
Report is 12 commits behind head on master.

Files Patch % Lines
pkg/util/grpc/grpc.go 0.00% 48 Missing ⚠️
pkg/descheduler/descheduler.go 0.00% 17 Missing ⚠️
pkg/estimator/server/server.go 53.84% 6 Missing ⚠️
cmd/descheduler/app/options/options.go 0.00% 4 Missing ⚠️
cmd/scheduler-estimator/app/options/options.go 0.00% 4 Missing ⚠️
cmd/scheduler/app/options/options.go 0.00% 4 Missing ⚠️
pkg/estimator/client/cache.go 0.00% 3 Missing ⚠️
pkg/scheduler/scheduler.go 81.81% 2 Missing ⚠️
cmd/scheduler/app/scheduler.go 0.00% 1 Missing ⚠️
pkg/estimator/client/service.go 0.00% 1 Missing ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5040   +/-   ##
=======================================
  Coverage   28.22%   28.23%           
=======================================
  Files         632      632           
  Lines       43431    43517   +86     
=======================================
+ Hits        12258    12286   +28     
- Misses      30278    30336   +58     
  Partials      895      895           
Flag Coverage Δ
unittests 28.23% <25.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@zhzhuang-zju zhzhuang-zju changed the title Adding TLS Certificate Authentication to gRPC [WIP]Adding TLS Certificate Authentication to gRPC Jun 12, 2024
@karmada-bot karmada-bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 12, 2024
@RainbowMango
Copy link
Member

Please rebase the code to address the failing tests.

@zhzhuang-zju zhzhuang-zju force-pushed the grpctlsauth branch 3 times, most recently from 314461b to 3bce736 Compare June 12, 2024 04:04
@zhzhuang-zju zhzhuang-zju changed the title [WIP]Adding TLS Certificate Authentication to gRPC Adding TLS Certificate Authentication to gRPC Jun 12, 2024
@karmada-bot karmada-bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 12, 2024
@zhzhuang-zju
Copy link
Contributor Author

/retest

@zhzhuang-zju zhzhuang-zju force-pushed the grpctlsauth branch 3 times, most recently from ab7f741 to 7bd0bcf Compare June 14, 2024 09:02
Copy link
Member

@RainbowMango RainbowMango left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/assign

Copy link
Member

@RainbowMango RainbowMango left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally looks good, only some nits.

cmd/scheduler/app/options/options.go Outdated Show resolved Hide resolved
cmd/scheduler-estimator/app/options/options.go Outdated Show resolved Hide resolved
Comment on lines 43 to 51
// ClientCertAuth when this is set, server will check all incoming HTTPS requests for a client certificate signed by the trusted CA,
// requests that don’t supply a valid client certificate will fail. If authentication is enabled,
// the certificate provides credentials for the user name given by the Common Name field.
ClientCertAuth bool
// CertFile the certificate used for SSL/TLS connections.
CertFile string
// KeyFile the key for the certificate.
KeyFile string
// TrustedCAFile Trusted certificate authority.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

variable naming and comments.

cmd/descheduler/app/options/options.go Outdated Show resolved Hide resolved
pkg/util/grpc/grpc.go Outdated Show resolved Hide resolved
pkg/util/grpc/grpc.go Outdated Show resolved Hide resolved
pkg/scheduler/scheduler.go Outdated Show resolved Hide resolved
cmd/scheduler/app/options/options.go Outdated Show resolved Hide resolved
cmd/scheduler-estimator/app/options/options.go Outdated Show resolved Hide resolved
cmd/scheduler-estimator/app/options/options.go Outdated Show resolved Hide resolved
@zhzhuang-zju zhzhuang-zju force-pushed the grpctlsauth branch 2 times, most recently from bb42ed4 to 6cf427c Compare June 21, 2024 02:48
Copy link
Member

@RainbowMango RainbowMango left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

I updated the release notes by the way.

@karmada-bot karmada-bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jun 21, 2024
@karmada-bot karmada-bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 21, 2024
Signed-off-by: zhzhuang-zju <m17799853869@163.com>
@karmada-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@karmada-bot karmada-bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jun 21, 2024
@RainbowMango
Copy link
Member

/lgtm

@karmada-bot karmada-bot added the lgtm Indicates that a PR is ready to be merged. label Jun 21, 2024
@karmada-bot karmada-bot merged commit 5e35497 into karmada-io:master Jun 21, 2024
12 checks passed
@RainbowMango RainbowMango added this to the v1.11 milestone Jul 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/feature Categorizes issue or PR as related to a new feature. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants