From 5d99ee80ca2af8152a832b9a55088afa509aa55b Mon Sep 17 00:00:00 2001 From: Kyle Havlovitz Date: Thu, 15 Jun 2017 15:24:04 -0700 Subject: [PATCH] Add an option to disable keyring file (#3145) Also disables keyring file in dev mode. --- agent/agent.go | 12 ++++++++---- agent/config.go | 7 +++++++ agent/config_test.go | 4 ++++ command/agent.go | 2 ++ .../github.com/hashicorp/serf/serf/internal_query.go | 10 ++++++---- vendor/vendor.json | 6 +++--- website/source/docs/agent/options.html.md | 7 +++++++ 7 files changed, 37 insertions(+), 11 deletions(-) diff --git a/agent/agent.go b/agent/agent.go index 59877353b5..6595600e61 100644 --- a/agent/agent.go +++ b/agent/agent.go @@ -887,8 +887,10 @@ func (a *Agent) makeServer() (*consul.Server, error) { if err != nil { return nil, err } - if err := a.setupKeyrings(config); err != nil { - return nil, fmt.Errorf("Failed to configure keyring: %v", err) + if !a.config.DisableKeyringFile { + if err := a.setupKeyrings(config); err != nil { + return nil, fmt.Errorf("Failed to configure keyring: %v", err) + } } server, err := consul.NewServerLogger(config, a.logger) if err != nil { @@ -903,8 +905,10 @@ func (a *Agent) makeClient() (*consul.Client, error) { if err != nil { return nil, err } - if err := a.setupKeyrings(config); err != nil { - return nil, fmt.Errorf("Failed to configure keyring: %v", err) + if !a.config.DisableKeyringFile { + if err := a.setupKeyrings(config); err != nil { + return nil, fmt.Errorf("Failed to configure keyring: %v", err) + } } client, err := consul.NewClientLogger(config, a.logger) if err != nil { diff --git a/agent/config.go b/agent/config.go index 79ee16fe68..ffed9737b9 100644 --- a/agent/config.go +++ b/agent/config.go @@ -367,6 +367,9 @@ type Config struct { // Encryption key to use for the Serf communication EncryptKey string `mapstructure:"encrypt" json:"-"` + // Disables writing the keyring to a file. + DisableKeyringFile bool `mapstructure:"disable_keyring_file"` + // EncryptVerifyIncoming and EncryptVerifyOutgoing are used to enforce // incoming/outgoing gossip encryption and can be used to upshift to // encrypted gossip on a running cluster. @@ -952,6 +955,7 @@ func DevConfig() *Config { conf.DisableAnonymousSignature = true conf.EnableUI = true conf.BindAddr = "127.0.0.1" + conf.DisableKeyringFile = true conf.ConsulConfig = consul.DefaultConfig() conf.ConsulConfig.SerfLANConfig.MemberlistConfig.ProbeTimeout = 100 * time.Millisecond @@ -1561,6 +1565,9 @@ func MergeConfig(a, b *Config) *Config { if b.EncryptKey != "" { result.EncryptKey = b.EncryptKey } + if b.DisableKeyringFile { + result.DisableKeyringFile = true + } if b.EncryptVerifyIncoming != nil { result.EncryptVerifyIncoming = b.EncryptVerifyIncoming } diff --git a/agent/config_test.go b/agent/config_test.go index c5070c1fe8..16c748a08c 100644 --- a/agent/config_test.go +++ b/agent/config_test.go @@ -317,6 +317,10 @@ func TestDecodeConfig(t *testing.T) { in: `{"enable_syslog":true}`, c: &Config{EnableSyslog: true}, }, + { + in: `{"disable_keyring_file":true}`, + c: &Config{DisableKeyringFile: true}, + }, { in: `{"encrypt_verify_incoming":true}`, c: &Config{EncryptVerifyIncoming: Bool(true)}, diff --git a/command/agent.go b/command/agent.go index 3faf96a7a1..83bb4432f6 100644 --- a/command/agent.go +++ b/command/agent.go @@ -88,6 +88,8 @@ func (cmd *AgentCommand) readConfig() *agent.Config { f.StringVar(&cmdCfg.UIDir, "ui-dir", "", "Path to directory containing the web UI resources.") f.StringVar(&cmdCfg.PidFile, "pid-file", "", "Path to file to store agent PID.") f.StringVar(&cmdCfg.EncryptKey, "encrypt", "", "Provides the gossip encryption key.") + f.BoolVar(&cmdCfg.DisableKeyringFile, "disable-keyring-file", false, "Disables the backing up "+ + "of the keyring to a file.") f.BoolVar(&cmdCfg.Server, "server", false, "Switches agent to server mode.") f.BoolVar(&cmdCfg.NonVotingServer, "non-voting-server", false, diff --git a/vendor/github.com/hashicorp/serf/serf/internal_query.go b/vendor/github.com/hashicorp/serf/serf/internal_query.go index 128b2cf214..04c984582d 100644 --- a/vendor/github.com/hashicorp/serf/serf/internal_query.go +++ b/vendor/github.com/hashicorp/serf/serf/internal_query.go @@ -192,10 +192,12 @@ func (s *serfQueries) handleInstallKey(q *Query) { goto SEND } - if err := s.serf.writeKeyringFile(); err != nil { - response.Message = err.Error() - s.logger.Printf("[ERR] serf: Failed to write keyring file: %s", err) - goto SEND + if s.serf.config.KeyringFile != "" { + if err := s.serf.writeKeyringFile(); err != nil { + response.Message = err.Error() + s.logger.Printf("[ERR] serf: Failed to write keyring file: %s", err) + goto SEND + } } response.Result = true diff --git a/vendor/vendor.json b/vendor/vendor.json index 0525d8b623..d9b49bf627 100644 --- a/vendor/vendor.json +++ b/vendor/vendor.json @@ -675,11 +675,11 @@ "revisionTime": "2017-05-25T23:15:04Z" }, { - "checksumSHA1": "ZkJRgexeNzNZzpw6YnedwoJl7pE=", + "checksumSHA1": "3LFg00GII0KbMRpqi38MRkMhoyM=", "comment": "v0.7.0-66-g6c4672d", "path": "github.com/hashicorp/serf/serf", - "revision": "dfab144618a063232d5753eaa4250a09865106c5", - "revisionTime": "2017-05-26T05:01:28Z" + "revision": "91fd53b1d3e624389ed9a295a3fa380e5c7b9dfc", + "revisionTime": "2017-06-14T22:59:51Z" }, { "checksumSHA1": "ZhK6IO2XN81Y+3RAjTcVm1Ic7oU=", diff --git a/website/source/docs/agent/options.html.md b/website/source/docs/agent/options.html.md index 48416f9d82..4bb839304a 100644 --- a/website/source/docs/agent/options.html.md +++ b/website/source/docs/agent/options.html.md @@ -163,6 +163,10 @@ will exit with an error at startup. initialized with an encryption key, then the provided key is ignored and a warning will be displayed. +* `-disable-keyring-file` - If set, + the keyring will not be persisted to a file. Any installed keys will be lost on shutdown, and only the given + `-encrypt` key will be available on startup. This defaults to false. + * `-http-port` - the HTTP API port to listen on. This overrides the default port 8500. This option is very useful when deploying Consul to an environment which communicates the HTTP port through the environment e.g. PaaS like CloudFoundry, allowing @@ -720,6 +724,9 @@ Consul will not enable TLS for the HTTP API unless the `https` port has been ass (/docs/agent/encryption.html#configuring-gossip-encryption-on-an-existing-cluster) for more information. Defaults to true. +* `disable_keyring_file` - Equivalent to the + [`-disable-keyring-file` command-line flag](#_disable_keyring_file). + * `key_file` This provides a the file path to a PEM-encoded private key. The key is used with the certificate to verify the agent's authenticity. This must be provided along with [`cert_file`](#cert_file).