Skip to content

Commit 92e6e34

Browse files
boxofradboxofrad
authored
Integrate consul-server-connection-manager library (#7)
1 parent 2222f71 commit 92e6e34

27 files changed

+624
-2963
lines changed

‎Makefile‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,3 @@ copy-bootstrap-config:
9696
.PHONY: unit-tests
9797
unit-tests:
9898
go test ./...
99-
100-
# TODO: Install dependencies before running this target
101-
.PHONY: consul-proto
102-
consul-proto:
103-
buf generate "https://github.com/hashicorp/consul.git#branch=main,subdir=proto-public"

‎buf.gen.yaml‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎cmd/consul-dataplane/main.go‎

Lines changed: 57 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,16 @@ import (
1616
var (
1717
printVersion bool
1818

19-
addresses string
20-
grpcPort int
19+
addresses string
20+
grpcPort int
21+
serverWatchDisabled bool
22+
23+
tlsDisabled bool
24+
tlsCACertsPath string
25+
tlsServerName string
26+
tlsCertFile string
27+
tlsKeyFile string
28+
tlsInsecureSkipVerify bool
2129

2230
logLevel string
2331
logJSON bool
@@ -28,7 +36,15 @@ var (
2836
namespace string
2937
partition string
3038

31-
token string
39+
credentialType string
40+
token string
41+
loginAuthMethod string
42+
loginNamespace string
43+
loginPartition string
44+
loginDatacenter string
45+
loginBearerToken string
46+
loginBearerTokenPath string
47+
loginMeta map[string]string
3248

3349
useCentralTelemetryConfig bool
3450

@@ -54,6 +70,8 @@ func init() {
5470

5571
flag.IntVar(&grpcPort, "grpc-port", 8502, "gRPC port on Consul servers.")
5672

73+
flag.BoolVar(&serverWatchDisabled, "server-watch-disabled", false, "Setting this prevents consul-dataplane from consuming the server update stream. This is useful for situations where Consul servers are behind a load balancer.")
74+
5775
flag.StringVar(&logLevel, "log-level", "info", "Log level of the messages to print. "+
5876
"Available log levels are \"trace\", \"debug\", \"info\", \"warn\", and \"error\".")
5977

@@ -65,7 +83,15 @@ func init() {
6583
flag.StringVar(&namespace, "service-namespace", "", "The Consul Enterprise namespace in which the proxy service instance is registered.")
6684
flag.StringVar(&partition, "service-partition", "", "The Consul Enterprise partition in which the proxy service instance is registered.")
6785

68-
flag.StringVar(&token, "static-token", "", "The ACL token used to authenticate requests to Consul servers (when -login-method is set to static).")
86+
flag.StringVar(&credentialType, "credential-type", "", "The type of credentials that will be used to authenticate with Consul servers (static or login).")
87+
flag.StringVar(&token, "static-token", "", "The ACL token used to authenticate requests to Consul servers (when -credential-type is set to static).")
88+
flag.StringVar(&loginAuthMethod, "login-auth-method", "", "The auth method that will be used to log in.")
89+
flag.StringVar(&loginNamespace, "login-namespace", "", "The Consul Enterprise namespace containing the auth method.")
90+
flag.StringVar(&loginPartition, "login-partition", "", "The Consul Enterprise partition containing the auth method.")
91+
flag.StringVar(&loginDatacenter, "login-datacenter", "", "The datacenter containing the auth method.")
92+
flag.StringVar(&loginBearerToken, "login-bearer-token", "", "The bearer token that will be presented to the auth method.")
93+
flag.StringVar(&loginBearerTokenPath, "login-bearer-token-path", "", "The path to a file containing the bearer token that will be presented to the auth method.")
94+
flag.Var((*FlagMapValue)(&loginMeta), "login-meta", "An arbitrary set of key/value pairs that will be attached to the ACL token (formatted as key=value, may be given multiple times).")
6995

7096
flag.BoolVar(&useCentralTelemetryConfig, "telemetry-use-central-config", true, "Controls whether the proxy will apply the central telemetry configuration.")
7197

@@ -77,6 +103,13 @@ func init() {
77103

78104
flag.StringVar(&xdsBindAddr, "xds-bind-addr", "127.0.0.1", "The address on which the Envoy xDS server will be available.")
79105
flag.IntVar(&xdsBindPort, "xds-bind-port", 0, "The port on which the Envoy xDS server will be available.")
106+
107+
flag.BoolVar(&tlsDisabled, "tls-disabled", false, "Communicate with Consul servers over a plaintext connection. Useful for testing, but not recommended for production.")
108+
flag.StringVar(&tlsCACertsPath, "ca-certs", "", "The path to a file or directory containing CA certificates that will be used to verify the server's certificate.")
109+
flag.StringVar(&tlsCertFile, "tls-cert", "", "The path to a client certificate file (only required if tls.grpc.verify_incoming is enabled on the server).")
110+
flag.StringVar(&tlsKeyFile, "tls-key", "", "The path to a client private key file (only required if tls.grpc.verify_incoming is enabled on the server).")
111+
flag.StringVar(&tlsServerName, "tls-server-name", "", "The hostname to expect in the server certificate's subject (required if -addresses isn't a DNS name).")
112+
flag.BoolVar(&tlsInsecureSkipVerify, "tls-insecure-skip-verify", false, "Do not verify the server's certificate. Useful for testing, but not recommended for production.")
80113
}
81114

82115
// validateFlags performs semantic validation of the flag values
@@ -104,9 +137,28 @@ func main() {
104137
Addresses: addresses,
105138
GRPCPort: grpcPort,
106139
Credentials: &consuldp.CredentialsConfig{
107-
Static: &consuldp.StaticCredentialsConfig{
140+
Type: consuldp.CredentialsType(credentialType),
141+
Static: consuldp.StaticCredentialsConfig{
108142
Token: token,
109143
},
144+
Login: consuldp.LoginCredentialsConfig{
145+
AuthMethod: loginAuthMethod,
146+
Namespace: loginNamespace,
147+
Partition: loginPartition,
148+
Datacenter: loginDatacenter,
149+
BearerToken: loginBearerToken,
150+
BearerTokenPath: loginBearerTokenPath,
151+
Meta: loginMeta,
152+
},
153+
},
154+
ServerWatchDisabled: serverWatchDisabled,
155+
TLS: &consuldp.TLSConfig{
156+
Disabled: tlsDisabled,
157+
CACertsPath: tlsCACertsPath,
158+
ServerName: tlsServerName,
159+
CertFile: tlsCertFile,
160+
KeyFile: tlsKeyFile,
161+
InsecureSkipVerify: tlsInsecureSkipVerify,
110162
},
111163
},
112164
Service: &consuldp.ServiceConfig{

‎cmd/consul-dataplane/map_flag.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
package main
2+
3+
import (
4+
"flag"
5+
"fmt"
6+
"strings"
7+
)
8+
9+
var _ flag.Value = (*FlagMapValue)(nil)
10+
11+
// FlagMapValue is a flag implementation used to provide key=value semantics
12+
// multiple times.
13+
type FlagMapValue map[string]string
14+
15+
func (h *FlagMapValue) String() string {
16+
return fmt.Sprintf("%v", *h)
17+
}
18+
19+
func (h *FlagMapValue) Set(value string) error {
20+
idx := strings.Index(value, "=")
21+
if idx == -1 {
22+
return fmt.Errorf("Missing \"=\" value in argument: %s", value)
23+
}
24+
25+
key, value := value[0:idx], value[idx+1:]
26+
27+
if *h == nil {
28+
*h = make(map[string]string)
29+
}
30+
31+
headers := *h
32+
headers[key] = value
33+
*h = headers
34+
35+
return nil
36+
}

‎cmd/consul-dataplane/map_flag_test.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"testing"
6+
)
7+
8+
func TestFlagMapValueSet(t *testing.T) {
9+
t.Parallel()
10+
11+
t.Run("missing =", func(t *testing.T) {
12+
13+
f := new(FlagMapValue)
14+
if err := f.Set("foo"); err == nil {
15+
t.Fatal("expected error, got nil")
16+
}
17+
})
18+
19+
t.Run("sets", func(t *testing.T) {
20+
21+
f := new(FlagMapValue)
22+
if err := f.Set("foo=bar"); err != nil {
23+
t.Fatal(err)
24+
}
25+
26+
r, ok := (*f)["foo"]
27+
if !ok {
28+
t.Errorf("missing value: %#v", f)
29+
}
30+
if exp := "bar"; r != exp {
31+
t.Errorf("expected %q to be %q", r, exp)
32+
}
33+
})
34+
35+
t.Run("sets multiple", func(t *testing.T) {
36+
37+
f := new(FlagMapValue)
38+
39+
r := map[string]string{
40+
"foo": "bar",
41+
"zip": "zap",
42+
"cat": "dog",
43+
}
44+
45+
for k, v := range r {
46+
if err := f.Set(fmt.Sprintf("%s=%s", k, v)); err != nil {
47+
t.Fatal(err)
48+
}
49+
}
50+
51+
for k, v := range r {
52+
r, ok := (*f)[k]
53+
if !ok {
54+
t.Errorf("missing value %q: %#v", k, f)
55+
}
56+
if exp := v; r != exp {
57+
t.Errorf("expected %q to be %q", r, exp)
58+
}
59+
}
60+
})
61+
62+
t.Run("overwrites", func(t *testing.T) {
63+
64+
f := new(FlagMapValue)
65+
if err := f.Set("foo=bar"); err != nil {
66+
t.Fatal(err)
67+
}
68+
if err := f.Set("foo=zip"); err != nil {
69+
t.Fatal(err)
70+
}
71+
72+
r, ok := (*f)["foo"]
73+
if !ok {
74+
t.Errorf("missing value: %#v", f)
75+
}
76+
if exp := "zip"; r != exp {
77+
t.Errorf("expected %q to be %q", r, exp)
78+
}
79+
})
80+
}

‎go.mod‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,26 @@ go 1.19
44

55
require (
66
github.com/adamthesax/grpc-proxy v0.0.0-20220525203857-13e92d14f87a
7+
github.com/hashicorp/consul-server-connection-manager v0.0.0-20220920152341-d96d0f93c5d9
8+
github.com/hashicorp/consul/proto-public v0.1.0
79
github.com/hashicorp/go-hclog v1.2.2
8-
github.com/hashicorp/go-netaddrs v0.0.0-20220509001840-90ed9d26ec46
10+
github.com/hashicorp/go-rootcerts v1.0.2
911
github.com/mitchellh/mapstructure v1.5.0
1012
github.com/stretchr/testify v1.8.0
1113
google.golang.org/grpc v1.48.0
1214
google.golang.org/protobuf v1.28.1
1315
)
1416

1517
require (
18+
github.com/cenkalti/backoff/v4 v4.1.3 // indirect
1619
github.com/davecgh/go-spew v1.1.1 // indirect
1720
github.com/fatih/color v1.13.0 // indirect
1821
github.com/golang/protobuf v1.5.2 // indirect
1922
github.com/google/go-cmp v0.5.8 // indirect
23+
github.com/hashicorp/go-netaddrs v0.0.0-20220509001840-90ed9d26ec46 // indirect
2024
github.com/mattn/go-colorable v0.1.12 // indirect
2125
github.com/mattn/go-isatty v0.0.14 // indirect
26+
github.com/mitchellh/go-homedir v1.1.0 // indirect
2227
github.com/pmezard/go-difflib v1.0.0 // indirect
2328
github.com/stretchr/objx v0.4.0 // indirect
2429
golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect

‎go.sum‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
44
github.com/adamthesax/grpc-proxy v0.0.0-20220525203857-13e92d14f87a h1:8fjfNnk9RLn3F4R4XEljSOZARy1+h1f0KTh6xGFefjw=
55
github.com/adamthesax/grpc-proxy v0.0.0-20220525203857-13e92d14f87a/go.mod h1:Aku9EjGILrB1V88F+yfJ8CaIVaKqDeWkW2vkCbY2WSA=
66
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
7+
github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
8+
github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
79
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
810
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
911
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
@@ -53,19 +55,31 @@ github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
5355
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
5456
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
5557
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
58+
github.com/hashicorp/consul-server-connection-manager v0.0.0-20220920152341-d96d0f93c5d9 h1:1e2vy4aPfxun9DG808QjXtShksPoaQsHvyxhVOyjeRI=
59+
github.com/hashicorp/consul-server-connection-manager v0.0.0-20220920152341-d96d0f93c5d9/go.mod h1:I56VZ1V7WN8/oPHswKDywfepvD7rB1RrTE4fRrNz3Wc=
60+
github.com/hashicorp/consul/proto-public v0.1.0 h1:O0LSmCqydZi363hsqc6n2v5sMz3usQMXZF6ziK3SzXU=
61+
github.com/hashicorp/consul/proto-public v0.1.0/go.mod h1:vs2KkuWwtjkIgA5ezp4YKPzQp4GitV+q/+PvksrA92k=
62+
github.com/hashicorp/consul/sdk v0.11.0 h1:HRzj8YSCln2yGgCumN5CL8lYlD3gBurnervJRJAZyC4=
63+
github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=
5664
github.com/hashicorp/go-hclog v1.2.2 h1:ihRI7YFwcZdiSD7SIenIhHfQH3OuDvWerAUBZbeQS3M=
5765
github.com/hashicorp/go-hclog v1.2.2/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
5866
github.com/hashicorp/go-netaddrs v0.0.0-20220509001840-90ed9d26ec46 h1:BysEAd6g+0HNJ0v99u7KbSObjzxC7rfVQ6yVx6HxrvU=
5967
github.com/hashicorp/go-netaddrs v0.0.0-20220509001840-90ed9d26ec46/go.mod h1:TjKbv4FhIra0YJ82mws5+4QXOhzv09eAWs4jtOBI4IU=
68+
github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
69+
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
70+
github.com/hashicorp/go-uuid v1.0.1 h1:fv1ep09latC32wFoVwnqcnKJGnMSdBanPczbHAYm1BE=
6071
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
6172
github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
6273
github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
6374
github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
6475
github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
6576
github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
6677
github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
78+
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
79+
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
6780
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
6881
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
82+
github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
6983
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
7084
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
7185
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=

0 commit comments

Comments
 (0)