From 5ea70797a8ed44acb2875ec83edeb6a4a8e81cf1 Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Wed, 5 Jul 2023 15:02:41 -0300 Subject: [PATCH 1/7] Add default socket path, change examples to snake case Signed-off-by: FedeNQ --- README.md | 40 ++++++++++++++++----------------- examples/mosquitto/helper.conf | 14 ++++++------ examples/mysql/helper.conf | 20 ++++++++--------- examples/postgresql/helper.conf | 14 ++++++------ helper.conf | 16 ++++++------- helper_envoy.conf | 14 ++++++------ helper_ghostunnel.conf | 14 ++++++------ helper_windows.conf | 14 ++++++------ pkg/sidecar/config.go | 2 -- pkg/sidecar/config_test.go | 9 -------- pkg/sidecar/sidecar.go | 10 ++++++--- 11 files changed, 80 insertions(+), 87 deletions(-) diff --git a/README.md b/README.md index 6c0d5e22..6afb19b8 100644 --- a/README.md +++ b/README.md @@ -18,32 +18,32 @@ The configuration file is an [HCL](https://github.com/hashicorp/hcl) formatted f |Configuration | Description | Example Value | |--------------------------|------------------------------------------------------------------------------------------------| ------------- | - |`agentAddress` | Socket address of SPIRE Agent. | `"/tmp/agent.sock"` | + |`agent_address` | Socket address of SPIRE Agent. | `"/tmp/agent.sock"` | |`cmd` | The path to the process to launch. | `"ghostunnel"` | - |`cmdArgs` | The arguments of the process to launch. | `"server --listen localhost:8002 --target localhost:8001--keystore certs/svid_key.pem --cacert certs/svid_bundle.pem --allow-uri-san spiffe://example.org/Database"` | - |`certDir` | Directory name to store the fetched certificates. This directory must be created previously. | `"certs"` | - |`addIntermediatesToBundle`| Add intermediate certificates into Bundle file instead of SVID file. | `true` | - |`renewSignal` | The signal that the process to be launched expects to reload the certificates. It is not supported on Windows. | `"SIGUSR1"` | - |`svidFileName` | File name to be used to store the X.509 SVID public certificate in PEM format. | `"svid.pem"` | - |`svidKeyFileName` | File name to be used to store the X.509 SVID private key and public certificate in PEM format. | `"svid_key.pem"` | - |`svidBundleFileName` | File name to be used to store the X.509 SVID Bundle in PEM format. | `"svid_bundle.pem"` | + |`cmd_args` | The arguments of the process to launch. | `"server --listen localhost:8002 --target localhost:8001--keystore certs/svid_key.pem --cacert certs/svid_bundle.pem --allow-uri-san spiffe://example.org/Database"` | + |`cert_dir` | Directory name to store the fetched certificates. This directory must be created previously. | `"certs"` | + |`add_intermediates_to_bundle`| Add intermediate certificates into Bundle file instead of SVID file. | `true` | + |`renew_signal` | The signal that the process to be launched expects to reload the certificates. It is not supported on Windows. | `"SIGUSR1"` | + |`svid_file_name` | File name to be used to store the X.509 SVID public certificate in PEM format. | `"svid.pem"` | + |`svid_key_file_name` | File name to be used to store the X.509 SVID private key and public certificate in PEM format. | `"svid_key.pem"` | + |`svid_bundle_file_name` | File name to be used to store the X.509 SVID Bundle in PEM format. | `"svid_bundle.pem"` | ### Configuration example ``` -agentAddress = "/tmp/agent.sock" +agent_address = "/tmp/agent.sock" cmd = "ghostunnel" -cmdArgs = "server --listen localhost:8002 --target localhost:8001 --keystore certs/svid_key.pem --cacert certs/svid_bundle.pem --allow-uri-san spiffe://example.org/Database" -certDir = "certs" -renewSignal = "SIGUSR1" -svidFileName = "svid.pem" -svidKeyFileName = "svid_key.pem" -svidBundleFileName = "svid_bundle.pem" +cmd_args = "server --listen localhost:8002 --target localhost:8001 --keystore certs/svid_key.pem --cacert certs/svid_bundle.pem --allow-uri-san spiffe://example.org/Database" +cert_dir = "certs" +renew_signal = "SIGUSR1" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" ``` ### Windows example -agentAddress = "spire-agent\\public\\api" -certDir = "certs" -svidFileName = "svid.pem" -svidKeyFileName = "svid_key.pem" -svidBundleFileName = "svid_bundle.pem" +agent_address = "spire-agent\\public\\api" +cert_dir = "certs" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" diff --git a/examples/mosquitto/helper.conf b/examples/mosquitto/helper.conf index 5bd18402..816c0d07 100644 --- a/examples/mosquitto/helper.conf +++ b/examples/mosquitto/helper.conf @@ -1,19 +1,19 @@ # SPIRE agent unix socket path -agentAddress = "/tmp/spire-agent/public/api.sock" +agent_address = "/tmp/spire-agent/public/api.sock" # psql binary path cmd = "/usr/sbin/mosquitto" # Query for configuration reloading -cmdArgs = "-c ./examples/mosquitto/mosquitto.conf" +cmd_args = "-c ./examples/mosquitto/mosquitto.conf" # Directory to store certificates (must match with the ssl setings in postgresql.conf) -certDir = "/opt/spire/certs/mosquitto" +cert_dir = "/opt/spire/certs/mosquitto" # No renew signal is used in this example -renewSignal = "SIGHUP" +renew_signal = "SIGHUP" # Certificate, key and bundle names must match those configured in mosquitto.conf -svidFileName = "svid.pem" -svidKeyFileName = "svid.key" -svidBundleFileName = "svid_bundle.pem" \ No newline at end of file +svid_file_name = "svid.pem" +svid_key_file_name = "svid.key" +svid_bundle_file_name = "svid_bundle.pem" \ No newline at end of file diff --git a/examples/mysql/helper.conf b/examples/mysql/helper.conf index 33959946..24e408f4 100644 --- a/examples/mysql/helper.conf +++ b/examples/mysql/helper.conf @@ -1,23 +1,23 @@ # SPIRE agent unix socket path -agentAddress = "/tmp/agent.sock" +agent_address = "/tmp/agent.sock" # mysql binary path cmd = "/usr/bin/mysql" # Query for configuration reloading -cmdArgs = "-e \"ALTER INSTANCE RELOAD TLS;\"" +cmd_args = "-e \"ALTER INSTANCE RELOAD TLS;\"" # No renew signal is used for this example -renewSignal = "" +renew_signal = "" # Directory where mysql stores the certificates -certDir = "/var/lib/mysql" +cert_dir = "/var/lib/mysql" # Certificate, key and bundle names must match those configured for mysql -svidFileName = "server-cert.pem" -svidKeyFileName = "server-key.pem" -svidBundleFileName = "ca.pem" +svid_file_name = "server-cert.pem" +svid_key_file_name = "server-key.pem" +svid_bundle_file_name = "ca.pem" -# MySQL expect intermediate certificates inside `svidBundleFile` file -# instead of svidFile -addIntermediatesToBundle = true \ No newline at end of file +# MySQL expect intermediate certificates inside `svid_bundle_file` file +# instead of svid_file +add_intermediates_to_bundle = true \ No newline at end of file diff --git a/examples/postgresql/helper.conf b/examples/postgresql/helper.conf index 5dc4aa7d..eada3db4 100644 --- a/examples/postgresql/helper.conf +++ b/examples/postgresql/helper.conf @@ -19,23 +19,23 @@ # # SPIRE agent unix socket path -agentAddress = "/tmp/agent.sock" +agent_address = "/tmp/agent.sock" # psql binary path cmd = "/usr/bin/psql" # Query for configuration reloading -cmdArgs = "-p 5432 -c \"SELECT pg_reload_conf();\"" +cmd_args = "-p 5432 -c \"SELECT pg_reload_conf();\"" # Directory to store certificates (must match with the ssl setings in postgresql.conf) -certDir = "/opt/spire/certs/postgresql" +cert_dir = "/opt/spire/certs/postgresql" # No renew signal is used in this example -renewSignal = "" +renew_signal = "" # Certificate, key and bundle names must match those configured in postgresql.conf -svidFileName = "svid.pem" -svidKeyFileName = "svid.key" -svidBundleFileName = "svid_bundle.pem" +svid_file_name = "svid.pem" +svid_key_file_name = "svid.key" +svid_bundle_file_name = "svid_bundle.pem" diff --git a/helper.conf b/helper.conf index 692fcc00..2a706de7 100644 --- a/helper.conf +++ b/helper.conf @@ -1,12 +1,12 @@ -agentAddress = "/tmp/agent.sock" +agent_address = "/tmp/agent.sock" cmd = "" -cmdArgs = "" -certDir = "certs" -renewSignal = "SIGUSR1" -svidFileName = "svid.pem" -svidKeyFileName = "svid_key.pem" -svidBundleFileName = "svid_bundle.pem" +cmd_args = "" +cert_dir = "certs" +renew_signal = "SIGUSR1" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" # Add CA with intermediates into Bundle file instead of SVID file, # it is the expected behavior in some scenarios like MySQL. # Default: false -# addIntermediatesToBundle = false \ No newline at end of file +# add_intermediates_to_bundle = false \ No newline at end of file diff --git a/helper_envoy.conf b/helper_envoy.conf index ac08c9eb..735b6179 100644 --- a/helper_envoy.conf +++ b/helper_envoy.conf @@ -1,8 +1,8 @@ -agentAddress = "/tmp/agent.sock" +agent_address = "/tmp/agent.sock" cmd = "hot-restarter.py" -cmdArgs = "start_envoy.sh" -certDir = "certs" -renewSignal = "SIGHUP" -svidFileName = "svid.pem" -svidKeyFileName = "svid_key.pem" -svidBundleFileName = "svid_bundle.pem" +cmd_args = "start_envoy.sh" +cert_dir = "certs" +renew_signal = "SIGHUP" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" diff --git a/helper_ghostunnel.conf b/helper_ghostunnel.conf index f56be357..08cb0c63 100644 --- a/helper_ghostunnel.conf +++ b/helper_ghostunnel.conf @@ -1,8 +1,8 @@ -agentAddress = "/tmp/agent.sock" +agent_address = "/tmp/agent.sock" cmd = "ghostunnel" -cmdArgs = "server --listen localhost:8002 --target localhost:8001 --keystore certs/svid_key.pem --cacert certs/svid_bundle.pem --allow-uri-san spiffe://example.org/Database" -certDir = "certs" -renewSignal = "SIGUSR1" -svidFileName = "svid.pem" -svidKeyFileName = "svid_key.pem" -svidBundleFileName = "svid_bundle.pem" +cmd_args = "server --listen localhost:8002 --target localhost:8001 --keystore certs/svid_key.pem --cacert certs/svid_bundle.pem --allow-uri-san spiffe://example.org/Database" +cert_dir = "certs" +renew_signal = "SIGUSR1" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" diff --git a/helper_windows.conf b/helper_windows.conf index 91463327..e101d23a 100644 --- a/helper_windows.conf +++ b/helper_windows.conf @@ -1,11 +1,11 @@ -agentAddress = "spire-agent\\public\\api" +agent_address = "spire-agent\\public\\api" cmd = "" -cmdArgs = "" -certDir = "certs" -svidFileName = "svid.pem" -svidKeyFileName = "svid_key.pem" -svidBundleFileName = "svid_bundle.pem" +cmd_args = "" +cert_dir = "certs" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" # Add CA with intermediates into Bundle file instead of SVID file, # it is the expected behavior in some scenarios like MySQL. # Default: false -# addIntermediatesToBundle = false +# add_intermediates_to_bundle = false diff --git a/pkg/sidecar/config.go b/pkg/sidecar/config.go index 098ba3bc..ed088c10 100644 --- a/pkg/sidecar/config.go +++ b/pkg/sidecar/config.go @@ -115,8 +115,6 @@ func ValidateConfig(c *Config) error { } switch { - case c.AgentAddress == "": - return errors.New("agent_address is required") case c.SvidFileName == "": return errors.New("svid_file_name is required") case c.SvidKeyFileName == "": diff --git a/pkg/sidecar/config_test.go b/pkg/sidecar/config_test.go index ed646b81..4ded5581 100644 --- a/pkg/sidecar/config_test.go +++ b/pkg/sidecar/config_test.go @@ -50,15 +50,6 @@ func TestValidateConfig(t *testing.T) { SvidBundleFileName: "bundle.pem", }, }, - { - name: "no address", - config: &Config{ - SvidFileName: "cert.pem", - SvidKeyFileName: "key.pem", - SvidBundleFileName: "bundle.pem", - }, - expectError: "agent_address is required", - }, { name: "no SVID file", config: &Config{ diff --git a/pkg/sidecar/sidecar.go b/pkg/sidecar/sidecar.go index 0063790e..12564122 100644 --- a/pkg/sidecar/sidecar.go +++ b/pkg/sidecar/sidecar.go @@ -18,8 +18,9 @@ import ( ) const ( - certsFileMode = os.FileMode(0644) - keyFileMode = os.FileMode(0600) + certsFileMode = os.FileMode(0644) + keyFileMode = os.FileMode(0600) + defaultAgentAddress = "/tmp/spire-agent/public/api.sock" ) // Sidecar is the component that consumes the Workload API and renews certs @@ -47,7 +48,10 @@ func New(configPath string, log logrus.FieldLogger) (*Sidecar, error) { return nil, fmt.Errorf("invalid configuration: %w", err) } - // TODO: add default agent socket path + if config.AgentAddress == "" { + config.AgentAddress = defaultAgentAddress + } + config.Log.WithField("agent_address", config.AgentAddress).Info("Connecting to agent") if config.Cmd == "" { config.Log.Warn("No cmd defined to execute.") From 60532da72e06eb65a2e407a0e3ed2014c231da93 Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Wed, 5 Jul 2023 16:31:19 -0300 Subject: [PATCH 2/7] Enhance Readme on windows section Signed-off-by: FedeNQ --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 6afb19b8..28a1d1e9 100644 --- a/README.md +++ b/README.md @@ -41,9 +41,10 @@ svid_bundle_file_name = "svid_bundle.pem" ``` ### Windows example - +``` agent_address = "spire-agent\\public\\api" cert_dir = "certs" svid_file_name = "svid.pem" svid_key_file_name = "svid_key.pem" svid_bundle_file_name = "svid_bundle.pem" +``` \ No newline at end of file From 8e464f2ee47c220db84d3c1bd1041128f7d139ab Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Thu, 6 Jul 2023 10:55:26 -0300 Subject: [PATCH 3/7] add ENV variable for AgentAddress Signed-off-by: FedeNQ --- pkg/sidecar/sidecar.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/sidecar/sidecar.go b/pkg/sidecar/sidecar.go index 12564122..71b4abc1 100644 --- a/pkg/sidecar/sidecar.go +++ b/pkg/sidecar/sidecar.go @@ -49,7 +49,10 @@ func New(configPath string, log logrus.FieldLogger) (*Sidecar, error) { } if config.AgentAddress == "" { - config.AgentAddress = defaultAgentAddress + config.AgentAddress = os.Getenv("SPIRE_AGENT_ADDRESS") + if config.AgentAddress == "" { + config.AgentAddress = defaultAgentAddress + } } config.Log.WithField("agent_address", config.AgentAddress).Info("Connecting to agent") From 7562e6eafe2aeffda71af909670522acc3c21f22 Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Thu, 6 Jul 2023 12:40:25 -0300 Subject: [PATCH 4/7] add test for ENV variable SPIRE_AGENT_ADDRESS Signed-off-by: FedeNQ --- pkg/sidecar/sidecar_test.go | 9 +++++++++ test/sidecar/config/helper.conf | 9 +++++++++ 2 files changed, 18 insertions(+) create mode 100644 test/sidecar/config/helper.conf diff --git a/pkg/sidecar/sidecar_test.go b/pkg/sidecar/sidecar_test.go index 7fdf7493..f53b9d35 100644 --- a/pkg/sidecar/sidecar_test.go +++ b/pkg/sidecar/sidecar_test.go @@ -4,6 +4,7 @@ import ( "context" "crypto" "crypto/x509" + "os" "path" "testing" "time" @@ -191,6 +192,14 @@ func TestSidecar_RunDaemon(t *testing.T) { cancel() } +func TestEnvAgentAddress(t *testing.T) { + os.Setenv("SPIRE_AGENT_ADDRESS", "/tmp/agent.sock") + log, _ := test.NewNullLogger() + spiffeSidecar, err := New("../../test/sidecar/config/helper.conf", log) + require.NoError(t, err) + assert.Equal(t, spiffeSidecar.config.AgentAddress, "/tmp/agent.sock") +} + func TestGetCmdArgs(t *testing.T) { cases := []struct { name string diff --git a/test/sidecar/config/helper.conf b/test/sidecar/config/helper.conf new file mode 100644 index 00000000..523704aa --- /dev/null +++ b/test/sidecar/config/helper.conf @@ -0,0 +1,9 @@ +cmd = "hot-restarter.py" +cmd_args = "start_envoy.sh" +cert_dir = "certs" +renew_signal = "SIGHUP" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" +timeout = "10s" +add_intermediates_to_bundle = true \ No newline at end of file From 5fc3c84affc94ecee22bcee046fc22bc31b89168 Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Thu, 6 Jul 2023 12:50:29 -0300 Subject: [PATCH 5/7] add test of default socket path Signed-off-by: FedeNQ --- pkg/sidecar/sidecar_test.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/sidecar/sidecar_test.go b/pkg/sidecar/sidecar_test.go index f53b9d35..63f76ecf 100644 --- a/pkg/sidecar/sidecar_test.go +++ b/pkg/sidecar/sidecar_test.go @@ -192,6 +192,12 @@ func TestSidecar_RunDaemon(t *testing.T) { cancel() } +func TestDefaultAgentAddress(t *testing.T) { + log, _ := test.NewNullLogger() + spiffeSidecar, err := New("../../test/sidecar/config/helper.conf", log) + require.NoError(t, err) + assert.Equal(t, spiffeSidecar.config.AgentAddress, "/tmp/spire-agent/public/api.sock") +} func TestEnvAgentAddress(t *testing.T) { os.Setenv("SPIRE_AGENT_ADDRESS", "/tmp/agent.sock") log, _ := test.NewNullLogger() From 6e7353952e4bb0eafc636948857825cbe546165f Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Mon, 10 Jul 2023 14:41:12 -0300 Subject: [PATCH 6/7] Add test for agent_address from .conf Signed-off-by: FedeNQ --- pkg/sidecar/sidecar_test.go | 9 +++++++++ test/sidecar/configWithAddress/helper.conf | 10 ++++++++++ 2 files changed, 19 insertions(+) create mode 100644 test/sidecar/configWithAddress/helper.conf diff --git a/pkg/sidecar/sidecar_test.go b/pkg/sidecar/sidecar_test.go index 63f76ecf..20ae10f8 100644 --- a/pkg/sidecar/sidecar_test.go +++ b/pkg/sidecar/sidecar_test.go @@ -206,6 +206,15 @@ func TestEnvAgentAddress(t *testing.T) { assert.Equal(t, spiffeSidecar.config.AgentAddress, "/tmp/agent.sock") } +func TestAgentAddress(t *testing.T) { + //This test is used to verify that we get the agent_address of the .conf file instead of the ENV value, if we have both + os.Setenv("SPIRE_AGENT_ADDRESS", "/tmp/agent.sock") + log, _ := test.NewNullLogger() + spiffeSidecar, err := New("../../test/sidecar/configWithAddress/helper.conf", log) + require.NoError(t, err) + assert.Equal(t, spiffeSidecar.config.AgentAddress, "/tmp/spire-agent/public/api.sock") +} + func TestGetCmdArgs(t *testing.T) { cases := []struct { name string diff --git a/test/sidecar/configWithAddress/helper.conf b/test/sidecar/configWithAddress/helper.conf new file mode 100644 index 00000000..d30c60ce --- /dev/null +++ b/test/sidecar/configWithAddress/helper.conf @@ -0,0 +1,10 @@ +agent_address = "/tmp/spire-agent/public/api.sock" +cmd = "hot-restarter.py" +cmd_args = "start_envoy.sh" +cert_dir = "certs" +renew_signal = "SIGHUP" +svid_file_name = "svid.pem" +svid_key_file_name = "svid_key.pem" +svid_bundle_file_name = "svid_bundle.pem" +timeout = "10s" +add_intermediates_to_bundle = true \ No newline at end of file From 12c33dd6113f0fe6c08fcf8e9aa445af4017bd9d Mon Sep 17 00:00:00 2001 From: FedeNQ Date: Mon, 10 Jul 2023 14:46:48 -0300 Subject: [PATCH 7/7] Add required space Signed-off-by: FedeNQ --- pkg/sidecar/sidecar_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/sidecar/sidecar_test.go b/pkg/sidecar/sidecar_test.go index 20ae10f8..fa9d43e9 100644 --- a/pkg/sidecar/sidecar_test.go +++ b/pkg/sidecar/sidecar_test.go @@ -207,7 +207,7 @@ func TestEnvAgentAddress(t *testing.T) { } func TestAgentAddress(t *testing.T) { - //This test is used to verify that we get the agent_address of the .conf file instead of the ENV value, if we have both + // This test is used to verify that we get the agent_address of the .conf file instead of the ENV value, if we have both os.Setenv("SPIRE_AGENT_ADDRESS", "/tmp/agent.sock") log, _ := test.NewNullLogger() spiffeSidecar, err := New("../../test/sidecar/configWithAddress/helper.conf", log)