|
1 | | -// Copyright 2019 NetApp, Inc. All Rights Reserved. |
| 1 | +// Copyright 2025 NetApp, Inc. All Rights Reserved. |
2 | 2 |
|
3 | 3 | package metrics |
4 | 4 |
|
5 | 5 | import ( |
6 | 6 | "context" |
| 7 | + "crypto/tls" |
| 8 | + "crypto/x509" |
7 | 9 | "fmt" |
8 | 10 | "net/http" |
| 11 | + "os" |
| 12 | + "time" |
9 | 13 |
|
10 | 14 | "github.com/prometheus/client_golang/prometheus/promhttp" |
11 | 15 |
|
@@ -68,3 +72,103 @@ func (s *Server) GetName() string { |
68 | 72 | func (s *Server) Version() string { |
69 | 73 | return config.OrchestratorAPIVersion |
70 | 74 | } |
| 75 | + |
| 76 | +// HTTPSServer represents an HTTPS metrics server |
| 77 | +type HTTPSServer struct { |
| 78 | + server *http.Server |
| 79 | + caCertFile string |
| 80 | + serverCertFile string |
| 81 | + serverKeyFile string |
| 82 | +} |
| 83 | + |
| 84 | +// NewHTTPSMetricsServer creates a new HTTPS metrics server with TLS configuration |
| 85 | +func NewHTTPSMetricsServer(address, port, caCertFile, serverCertFile, serverKeyFile string, enableMutualTLS bool, writeTimeout time.Duration) (*HTTPSServer, error) { |
| 86 | + ctx := GenerateRequestContext(nil, "", ContextSourceInternal, WorkflowPluginCreate, LogLayerMetricsFrontend) |
| 87 | + |
| 88 | + httpsServer := &HTTPSServer{ |
| 89 | + server: &http.Server{ |
| 90 | + Addr: fmt.Sprintf("%s:%s", address, port), |
| 91 | + Handler: &metricsAuthHandler{handler: promhttp.Handler()}, |
| 92 | + TLSConfig: &tls.Config{ |
| 93 | + ClientAuth: tls.RequireAndVerifyClientCert, |
| 94 | + MinVersion: config.MinServerTLSVersion, |
| 95 | + }, |
| 96 | + ReadTimeout: config.HTTPTimeout, |
| 97 | + WriteTimeout: writeTimeout, |
| 98 | + }, |
| 99 | + caCertFile: caCertFile, |
| 100 | + serverCertFile: serverCertFile, |
| 101 | + serverKeyFile: serverKeyFile, |
| 102 | + } |
| 103 | + |
| 104 | + // Configure for non-mutual TLS if needed |
| 105 | + if !enableMutualTLS { |
| 106 | + httpsServer.server.Handler = promhttp.Handler() |
| 107 | + httpsServer.server.TLSConfig.ClientAuth = tls.NoClientCert |
| 108 | + } |
| 109 | + |
| 110 | + // Load CA certificate if provided |
| 111 | + if caCertFile != "" { |
| 112 | + caCert, err := os.ReadFile(caCertFile) |
| 113 | + if err != nil { |
| 114 | + return nil, fmt.Errorf("could not read CA certificate file: %v", err) |
| 115 | + } |
| 116 | + caCertPool := x509.NewCertPool() |
| 117 | + caCertPool.AppendCertsFromPEM(caCert) |
| 118 | + httpsServer.server.TLSConfig.ClientCAs = caCertPool |
| 119 | + } |
| 120 | + |
| 121 | + Logc(ctx).WithField("address", httpsServer.server.Addr).Info("Initializing HTTPS metrics frontend.") |
| 122 | + |
| 123 | + return httpsServer, nil |
| 124 | +} |
| 125 | + |
| 126 | +func (s *HTTPSServer) Activate() error { |
| 127 | + go func() { |
| 128 | + ctx := GenerateRequestContext(nil, "", ContextSourceInternal, WorkflowPluginActivate, LogLayerMetricsFrontend) |
| 129 | + |
| 130 | + Logc(ctx).WithField("address", s.server.Addr).Info("Activating HTTPS metrics frontend.") |
| 131 | + |
| 132 | + err := s.server.ListenAndServeTLS(s.serverCertFile, s.serverKeyFile) |
| 133 | + if err == http.ErrServerClosed { |
| 134 | + Logc(ctx).WithField("address", s.server.Addr).Info("HTTPS metrics frontend server has closed.") |
| 135 | + } else if err != nil { |
| 136 | + Logc(ctx).Fatal(err) |
| 137 | + } |
| 138 | + }() |
| 139 | + return nil |
| 140 | +} |
| 141 | + |
| 142 | +func (s *HTTPSServer) Deactivate() error { |
| 143 | + ctx := GenerateRequestContext(nil, "", ContextSourceInternal, WorkflowPluginDeactivate, LogLayerMetricsFrontend) |
| 144 | + |
| 145 | + Logc(ctx).WithField("address", s.server.Addr).Info("Deactivating HTTPS metrics frontend.") |
| 146 | + ctx, cancel := context.WithTimeout(ctx, config.HTTPTimeout) |
| 147 | + defer cancel() |
| 148 | + return s.server.Shutdown(ctx) |
| 149 | +} |
| 150 | + |
| 151 | +func (s *HTTPSServer) GetName() string { |
| 152 | + return "HTTPS metrics" |
| 153 | +} |
| 154 | + |
| 155 | +func (s *HTTPSServer) Version() string { |
| 156 | + return config.OrchestratorAPIVersion |
| 157 | +} |
| 158 | + |
| 159 | +// metricsAuthHandler handles TLS authentication for metrics endpoints |
| 160 | +type metricsAuthHandler struct { |
| 161 | + handler http.Handler |
| 162 | +} |
| 163 | + |
| 164 | +func (h *metricsAuthHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { |
| 165 | + // Service requests from Trident nodes with a valid client certificate |
| 166 | + if len(r.TLS.PeerCertificates) > 0 && r.TLS.PeerCertificates[0].Subject.CommonName == config.ClientCertName { |
| 167 | + ctx := GenerateRequestContext(nil, "", ContextSourceInternal, WorkflowPluginActivate, LogLayerMetricsFrontend) |
| 168 | + Logc(ctx).WithField("peerCert", config.ClientCertName).Debug("Authenticated by HTTPS metrics frontend.") |
| 169 | + h.handler.ServeHTTP(w, r) |
| 170 | + } else { |
| 171 | + w.Header().Set("WWW-Authenticate", fmt.Sprintf("Basic realm=\"%s\"", config.OrchestratorName)) |
| 172 | + w.WriteHeader(http.StatusUnauthorized) |
| 173 | + } |
| 174 | +} |
0 commit comments