From c697145dd5d87eaeab44a61a052ce1a166bb3cf2 Mon Sep 17 00:00:00 2001 From: Nikita Skrynnik Date: Fri, 16 Dec 2022 19:35:02 +1100 Subject: [PATCH] add custom policies support Signed-off-by: Nikita Skrynnik --- main.go | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/main.go b/main.go index a5d7dc2..525f469 100644 --- a/main.go +++ b/main.go @@ -82,20 +82,21 @@ import ( // Config holds configuration parameters from environment variables type Config struct { - Name string `default:"icmp-server" desc:"Name of ICMP Server"` - BaseDir string `default:"./" desc:"base directory" split_words:"true"` - ConnectTo url.URL `default:"unix:///var/lib/networkservicemesh/nsm.io.sock" desc:"url to connect to" split_words:"true"` - MaxTokenLifetime time.Duration `default:"10m" desc:"maximum lifetime of tokens" split_words:"true"` - ServiceNames []string `default:"icmp-responder" desc:"Name of provided services" split_words:"true"` - Payload string `default:"ETHERNET" desc:"Name of provided service payload" split_words:"true"` - Labels map[string]string `default:"" desc:"Endpoint labels"` - DNSConfigs dnsconfig.Decoder `default:"[]" desc:"DNSConfigs represents array of DNSConfig in json format. See at model definition: https://github.com/networkservicemesh/api/blob/main/pkg/api/networkservice/connectioncontext.pb.go#L426-L435" split_words:"true"` - CidrPrefix cidr.Groups `default:"169.254.0.0/16" desc:"List of CIDR Prefix to assign IPv4 and IPv6 addresses from" split_words:"true"` - IdleTimeout time.Duration `default:"0" desc:"timeout for automatic shutdown when there were no requests for specified time. Set 0 to disable auto-shutdown." split_words:"true"` - RegisterService bool `default:"true" desc:"if true then registers network service on startup" split_words:"true"` - PBRConfigPath string `default:"/etc/policy-based-routing/config.yaml" desc:"Path to policy based routing config file" split_words:"true"` - LogLevel string `default:"INFO" desc:"Log level" split_words:"true"` - OpenTelemetryEndpoint string `default:"otel-collector.observability.svc.cluster.local:4317" desc:"OpenTelemetry Collector Endpoint"` + Name string `default:"icmp-server" desc:"Name of ICMP Server"` + BaseDir string `default:"./" desc:"base directory" split_words:"true"` + ConnectTo url.URL `default:"unix:///var/lib/networkservicemesh/nsm.io.sock" desc:"url to connect to" split_words:"true"` + MaxTokenLifetime time.Duration `default:"10m" desc:"maximum lifetime of tokens" split_words:"true"` + RegistryClientPolicies []string `default:"etc/nsm/opa/common/.*.rego,etc/nsm/opa/registry/.*.rego,etc/nsm/opa/client/.*.rego" desc:"paths to files and directories that contain registry client policies" split_words:"true"` + ServiceNames []string `default:"icmp-responder" desc:"Name of provided services" split_words:"true"` + Payload string `default:"ETHERNET" desc:"Name of provided service payload" split_words:"true"` + Labels map[string]string `default:"" desc:"Endpoint labels"` + DNSConfigs dnsconfig.Decoder `default:"[]" desc:"DNSConfigs represents array of DNSConfig in json format. See at model definition: https://github.com/networkservicemesh/api/blob/main/pkg/api/networkservice/connectioncontext.pb.go#L426-L435" split_words:"true"` + CidrPrefix cidr.Groups `default:"169.254.0.0/16" desc:"List of CIDR Prefix to assign IPv4 and IPv6 addresses from" split_words:"true"` + IdleTimeout time.Duration `default:"0" desc:"timeout for automatic shutdown when there were no requests for specified time. Set 0 to disable auto-shutdown." split_words:"true"` + RegisterService bool `default:"true" desc:"if true then registers network service on startup" split_words:"true"` + PBRConfigPath string `default:"/etc/policy-based-routing/config.yaml" desc:"Path to policy based routing config file" split_words:"true"` + LogLevel string `default:"INFO" desc:"Log level" split_words:"true"` + OpenTelemetryEndpoint string `default:"otel-collector.observability.svc.cluster.local:4317" desc:"OpenTelemetry Collector Endpoint"` } // Process prints and processes env to config @@ -277,7 +278,8 @@ func main() { nsRegistryClient := registryclient.NewNetworkServiceRegistryClient(ctx, registryclient.WithClientURL(&config.ConnectTo), registryclient.WithDialOptions(clientOptions...), - registryclient.WithAuthorizeNSRegistryClient(registryauthorize.NewNetworkServiceRegistryClient())) + registryclient.WithAuthorizeNSRegistryClient(registryauthorize.NewNetworkServiceRegistryClient( + registryauthorize.WithPolicies(config.RegistryClientPolicies...)))) _, err = nsRegistryClient.Register(ctx, ®istryapi.NetworkService{ Name: serviceName, Payload: config.Payload, @@ -297,7 +299,8 @@ func main() { clientinfo.NewNetworkServiceEndpointRegistryClient(), registrysendfd.NewNetworkServiceEndpointRegistryClient(), ), - registryclient.WithAuthorizeNSERegistryClient(registryauthorize.NewNetworkServiceEndpointRegistryClient()), + registryclient.WithAuthorizeNSERegistryClient(registryauthorize.NewNetworkServiceEndpointRegistryClient( + registryauthorize.WithPolicies(config.RegistryClientPolicies...))), ) nse := getNseEndpoint(config, listenOn) nse, err = nseRegistryClient.Register(ctx, nse)