mirror of
https://github.com/status-im/consul.git
synced 2025-02-10 04:45:05 +00:00
78b170ad50
* Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>
61 lines
2.1 KiB
Go
61 lines
2.1 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package consul
|
|
|
|
import (
|
|
"google.golang.org/grpc"
|
|
|
|
"github.com/hashicorp/consul-net-rpc/net/rpc"
|
|
"github.com/hashicorp/go-hclog"
|
|
|
|
"github.com/hashicorp/consul/agent/consul/stream"
|
|
"github.com/hashicorp/consul/agent/grpc-external/limiter"
|
|
"github.com/hashicorp/consul/agent/hcp"
|
|
"github.com/hashicorp/consul/agent/leafcert"
|
|
"github.com/hashicorp/consul/agent/pool"
|
|
"github.com/hashicorp/consul/agent/router"
|
|
"github.com/hashicorp/consul/agent/rpc/middleware"
|
|
"github.com/hashicorp/consul/agent/token"
|
|
"github.com/hashicorp/consul/internal/resource"
|
|
"github.com/hashicorp/consul/tlsutil"
|
|
)
|
|
|
|
type Deps struct {
|
|
LeafCertManager *leafcert.Manager
|
|
EventPublisher *stream.EventPublisher
|
|
Logger hclog.InterceptLogger
|
|
TLSConfigurator *tlsutil.Configurator
|
|
Tokens *token.Store
|
|
Router *router.Router
|
|
ConnPool *pool.ConnPool
|
|
GRPCConnPool GRPCClientConner
|
|
LeaderForwarder LeaderForwarder
|
|
XDSStreamLimiter *limiter.SessionLimiter
|
|
Registry resource.Registry
|
|
// GetNetRPCInterceptorFunc, if not nil, sets the net/rpc rpc.ServerServiceCallInterceptor on
|
|
// the server side to record metrics around the RPC requests. If nil, no interceptor is added to
|
|
// the rpc server.
|
|
GetNetRPCInterceptorFunc func(recorder *middleware.RequestRecorder) rpc.ServerServiceCallInterceptor
|
|
// NewRequestRecorderFunc provides a middleware.RequestRecorder for the server to use; it cannot be nil
|
|
NewRequestRecorderFunc func(logger hclog.Logger, isLeader func() bool, localDC string) *middleware.RequestRecorder
|
|
|
|
// HCP contains the dependencies required when integrating with the HashiCorp Cloud Platform
|
|
HCP hcp.Deps
|
|
|
|
Experiments []string
|
|
|
|
EnterpriseDeps
|
|
}
|
|
|
|
type GRPCClientConner interface {
|
|
ClientConn(datacenter string) (*grpc.ClientConn, error)
|
|
ClientConnLeader() (*grpc.ClientConn, error)
|
|
SetGatewayResolver(func(string) string)
|
|
}
|
|
|
|
type LeaderForwarder interface {
|
|
// UpdateLeaderAddr updates the leader address in the local DC's resolver.
|
|
UpdateLeaderAddr(datacenter, addr string)
|
|
}
|