From f52b88a96288d51346c1281e963f3ddf34b81cf0 Mon Sep 17 00:00:00 2001 From: Todd Gruben Date: Mon, 22 Mar 2021 08:49:54 -0500 Subject: [PATCH 1/3] etcd tls configuration support --- ctl/server.go | 7 ++++++- etcd/embed.go | 18 ++++++++++++++++++ server/config.go | 6 ++++++ 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/ctl/server.go b/ctl/server.go index e6469ffbd..65f854078 100644 --- a/ctl/server.go +++ b/ctl/server.go @@ -63,8 +63,13 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) { flags.StringVar(&srv.Config.Etcd.LPeerURL, "etcd.listen-peer-address", srv.Config.Etcd.LPeerURL, "Listen peer address.") flags.StringVar(&srv.Config.Etcd.APeerURL, "etcd.advertise-peer-address", srv.Config.Etcd.APeerURL, "Advertise peer address. If not provided, uses the listen peer address.") flags.StringVar(&srv.Config.Etcd.ClusterURL, "etcd.cluster-url", srv.Config.Etcd.ClusterURL, "Cluster URL to join.") - // Etcd.ClusterName uses Cluster.Name for its value. flags.StringVar(&srv.Config.Etcd.InitCluster, "etcd.initial-cluster", srv.Config.Etcd.InitCluster, "Initial cluster name1=apurl1,name2=apurl2") + // Etcd specified tls configuration options + flags.StringVar(&srv.Config.Etcd.TrustedCAFile, "etcd.tls-trusted-cafile", srv.Config.Etcd.TrustedCAFile, "Certificate Authority certificate") + flags.StringVar(&srv.Config.Etcd.ClientCertFile, "etcd.tls-cert-file", srv.Config.Etcd.ClientCertFile, "Client certificate (required for tls)") + flags.StringVar(&srv.Config.Etcd.ClientKeyFile, "etcd.tls-key-file", srv.Config.Etcd.ClientKeyFile, "Client key file (required for tls)") + flags.StringVar(&srv.Config.Etcd.PeerCertFile, "etcd.tls-peer-cert-file", srv.Config.Etcd.PeerCertFile, "Peer certificate (required for tls)") + flags.StringVar(&srv.Config.Etcd.PeerKeyFile, "etcd.tls-peer-key-file", srv.Config.Etcd.PeerKeyFile, "Peer key file (required for tls)") // AntiEntropy flags.DurationVar((*time.Duration)(&srv.Config.AntiEntropy.Interval), "anti-entropy.interval", (time.Duration)(srv.Config.AntiEntropy.Interval), "Interval at which to run anti-entropy routine.") diff --git a/etcd/embed.go b/etcd/embed.go index 0092ef42b..09afb7b22 100644 --- a/etcd/embed.go +++ b/etcd/embed.go @@ -34,6 +34,7 @@ import ( "go.etcd.io/etcd/embed" "go.etcd.io/etcd/etcdserver/api/v3client" "go.etcd.io/etcd/mvcc/mvccpb" + "go.etcd.io/etcd/pkg/transport" "go.etcd.io/etcd/pkg/types" ) @@ -48,6 +49,12 @@ type Options struct { InitCluster string `toml:"initial-cluster"` ClusterName string `toml:"cluster-name"` HeartbeatTTL int64 `toml:"heartbeat-ttl"` + // TLS provided tls files + TrustedCAFile string `toml:"tls-trusted-cafile"` + ClientCertFile string `toml:"tls-cert-file"` + ClientKeyFile string `toml:"tls-key-file"` + PeerCertFile string `toml:"tls-peer-cert-file"` + PeerKeyFile string `toml:"tls-peer-key-file"` LPeerSocket []*net.TCPListener LClientSocket []*net.TCPListener @@ -171,6 +178,17 @@ func parseOptions(opt Options) *embed.Config { id, name := memberAdd(cli, opt.APeerURL) log.Printf("\tid: %d, name: %s\n", id, name) } + // can only use tls if not using pre-configured listeners + cfg.ClientTLSInfo = transport.TLSInfo{ + TrustedCAFile: opt.TrustedCAFile, + CertFile: opt.ClientCertFile, + KeyFile: opt.ClientKeyFile, + } + cfg.PeerTLSInfo = transport.TLSInfo{ + TrustedCAFile: opt.TrustedCAFile, + CertFile: opt.PeerCertFile, + KeyFile: opt.PeerKeyFile, + } return cfg } diff --git a/server/config.go b/server/config.go index 1c004b7e8..edb69d5ec 100644 --- a/server/config.go +++ b/server/config.go @@ -351,6 +351,12 @@ func NewConfig() *Config { c.Etcd.InitCluster = c.Name + "=" + c.Etcd.LPeerURL c.Etcd.HeartbeatTTL = 5 + c.Etcd.TrustedCAFile = "" + c.Etcd.ClientCertFile = "" + c.Etcd.ClientKeyFile = "" + c.Etcd.PeerCertFile = "" + c.Etcd.PeerKeyFile = "" + return c } From 8c4d7e09ff31fbaead4032aa8ee3327dabfb76b1 Mon Sep 17 00:00:00 2001 From: Todd Gruben Date: Mon, 22 Mar 2021 16:48:09 -0500 Subject: [PATCH 2/3] re-use pilosa tls settings --- ctl/server.go | 6 ------ server/server.go | 6 ++++++ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ctl/server.go b/ctl/server.go index 65f854078..7116b8790 100644 --- a/ctl/server.go +++ b/ctl/server.go @@ -64,12 +64,6 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) { flags.StringVar(&srv.Config.Etcd.APeerURL, "etcd.advertise-peer-address", srv.Config.Etcd.APeerURL, "Advertise peer address. If not provided, uses the listen peer address.") flags.StringVar(&srv.Config.Etcd.ClusterURL, "etcd.cluster-url", srv.Config.Etcd.ClusterURL, "Cluster URL to join.") flags.StringVar(&srv.Config.Etcd.InitCluster, "etcd.initial-cluster", srv.Config.Etcd.InitCluster, "Initial cluster name1=apurl1,name2=apurl2") - // Etcd specified tls configuration options - flags.StringVar(&srv.Config.Etcd.TrustedCAFile, "etcd.tls-trusted-cafile", srv.Config.Etcd.TrustedCAFile, "Certificate Authority certificate") - flags.StringVar(&srv.Config.Etcd.ClientCertFile, "etcd.tls-cert-file", srv.Config.Etcd.ClientCertFile, "Client certificate (required for tls)") - flags.StringVar(&srv.Config.Etcd.ClientKeyFile, "etcd.tls-key-file", srv.Config.Etcd.ClientKeyFile, "Client key file (required for tls)") - flags.StringVar(&srv.Config.Etcd.PeerCertFile, "etcd.tls-peer-cert-file", srv.Config.Etcd.PeerCertFile, "Peer certificate (required for tls)") - flags.StringVar(&srv.Config.Etcd.PeerKeyFile, "etcd.tls-peer-key-file", srv.Config.Etcd.PeerKeyFile, "Peer key file (required for tls)") // AntiEntropy flags.DurationVar((*time.Duration)(&srv.Config.AntiEntropy.Interval), "anti-entropy.interval", (time.Duration)(srv.Config.AntiEntropy.Interval), "Interval at which to run anti-entropy routine.") diff --git a/server/server.go b/server/server.go index 40ff3a7ec..d4b47a6e1 100644 --- a/server/server.go +++ b/server/server.go @@ -381,6 +381,12 @@ func (m *Command) SetupServer() error { // // Use name for etcd.name m.Config.Etcd.Name = m.Config.Name + // use the pilosa provided tls credentials if available + m.Config.Etcd.TrustedCAFile = m.Config.TLS.CACertPath + m.Config.Etcd.ClientCertFile = m.Config.TLS.CertificatePath + m.Config.Etcd.ClientKeyFile = m.Config.TLS.CertificateKeyPath + m.Config.Etcd.PeerCertFile = m.Config.TLS.CertificatePath + m.Config.Etcd.PeerKeyFile = m.Config.TLS.CertificateKeyPath // // If an Etcd.Dir is not provided, nest a default under the pilosa data dir. if m.Config.Etcd.Dir == "" { From 6bafa989e0cc85e6bbdeba6f18a26e375d2c0b0a Mon Sep 17 00:00:00 2001 From: Todd Gruben Date: Wed, 24 Mar 2021 10:43:28 -0500 Subject: [PATCH 3/3] adjust etcd config comments --- ctl/server.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ctl/server.go b/ctl/server.go index 7116b8790..fd5365bc8 100644 --- a/ctl/server.go +++ b/ctl/server.go @@ -56,8 +56,9 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) { flags.IntVar(&srv.Config.Translation.MapSize, "translation.map-size", srv.Config.Translation.MapSize, "Size in bytes of mmap to allocate for key translation.") // Etcd - // Etcd.Name used Config.Name for it's value. + // Etcd.Name used Config.Name for its value. // Etcd.Dir defaults to a directory under the pilosa data directory. + // Etcd.ClusterName uses Cluster.Name for its value flags.StringVar(&srv.Config.Etcd.LClientURL, "etcd.listen-client-address", srv.Config.Etcd.LClientURL, "Listen client address.") flags.StringVar(&srv.Config.Etcd.AClientURL, "etcd.advertise-client-address", srv.Config.Etcd.AClientURL, "Advertise client address. If not provided, uses the listen client address.") flags.StringVar(&srv.Config.Etcd.LPeerURL, "etcd.listen-peer-address", srv.Config.Etcd.LPeerURL, "Listen peer address.")