Skip to content

Commit 3420c22

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #8110 from pawanpinjarkar/generate-tokens
AGENT-872: Generate JWT token
2 parents d08c982 + 5efe707 commit 3420c22

File tree

8 files changed

+96
-27
lines changed

8 files changed

+96
-27
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ require (
4444
github.com/go-openapi/strfmt v0.23.0
4545
github.com/go-openapi/swag v0.22.9
4646
github.com/go-playground/validator/v10 v10.19.0
47+
github.com/golang-jwt/jwt/v4 v4.5.0
4748
github.com/golang/mock v1.7.0-rc.1
4849
github.com/golang/protobuf v1.5.4
4950
github.com/google/go-cmp v0.6.0
@@ -183,7 +184,6 @@ require (
183184
github.com/go-playground/universal-translator v0.18.1 // indirect
184185
github.com/gobuffalo/flect v1.0.2 // indirect
185186
github.com/gogo/protobuf v1.3.2 // indirect
186-
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
187187
github.com/golang-jwt/jwt/v5 v5.2.0 // indirect
188188
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
189189
github.com/google/btree v1.0.1 // indirect

‎pkg/asset/agent/common/infraenv.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package common
2+
3+
import (
4+
"github.com/google/uuid"
5+
6+
"github.com/openshift/installer/pkg/asset"
7+
)
8+
9+
// InfraEnvID is an asset that generates infraEnvID.
10+
type InfraEnvID struct {
11+
ID string
12+
}
13+
14+
var _ asset.Asset = (*InfraEnvID)(nil)
15+
16+
// Dependencies returns the assets on which the InfraEnv asset depends.
17+
func (a *InfraEnvID) Dependencies() []asset.Asset {
18+
return []asset.Asset{}
19+
}
20+
21+
// Generate generates the InfraEnvID for agent installer.
22+
func (a *InfraEnvID) Generate(dependencies asset.Parents) error {
23+
a.ID = uuid.New().String()
24+
return nil
25+
}
26+
27+
// Name returns the human-friendly name of the asset.
28+
func (a *InfraEnvID) Name() string {
29+
return "Agent Installer InfraEnv ID"
30+
}

‎pkg/asset/agent/gencrypto/authconfig.go‎

Lines changed: 43 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,51 @@ import (
88
"crypto/x509"
99
"encoding/pem"
1010

11+
"github.com/golang-jwt/jwt/v4"
12+
1113
"github.com/openshift/installer/pkg/asset"
14+
"github.com/openshift/installer/pkg/asset/agent/common"
1215
)
1316

14-
// AuthConfig is an asset that generates ECDSA public and private keys.
17+
// AuthConfig is an asset that generates ECDSA public/private keys, JWT token.
1518
type AuthConfig struct {
16-
PublicKey, PrivateKey string
19+
PublicKey, PrivateKey, Token string
1720
}
1821

19-
var _ asset.WritableAsset = (*AuthConfig)(nil)
22+
// LocalJWTKeyType suggests the key type to be used for the token.
23+
type LocalJWTKeyType string
24+
25+
const (
26+
// InfraEnvKey is used to generate token using infra env id.
27+
InfraEnvKey LocalJWTKeyType = "infra_env_id"
28+
)
29+
30+
var _ asset.Asset = (*AuthConfig)(nil)
2031

2132
// Dependencies returns the assets on which the AuthConfig asset depends.
2233
func (a *AuthConfig) Dependencies() []asset.Asset {
23-
return []asset.Asset{}
34+
return []asset.Asset{
35+
&common.InfraEnvID{},
36+
}
2437
}
2538

2639
// Generate generates the auth config for agent installer APIs.
2740
func (a *AuthConfig) Generate(dependencies asset.Parents) error {
41+
infraEnvID := &common.InfraEnvID{}
42+
dependencies.Get(infraEnvID)
2843
PublicKey, PrivateKey, err := keyPairPEM()
2944
if err != nil {
3045
return err
3146
}
3247
a.PublicKey = PublicKey
3348
a.PrivateKey = PrivateKey
3449

50+
token, err := localJWTForKey(infraEnvID.ID, a.PrivateKey)
51+
if err != nil {
52+
return err
53+
}
54+
a.Token = token
55+
3556
return nil
3657
}
3758

@@ -40,21 +61,6 @@ func (a *AuthConfig) Name() string {
4061
return "Agent Installer API Auth Config"
4162
}
4263

43-
// Load returns the auth config from disk.
44-
func (a *AuthConfig) Load(f asset.FileFetcher) (bool, error) {
45-
// The AuthConfig will not be needed by another asset so load is noop.
46-
// This is implemented because it is required by WritableAsset
47-
return false, nil
48-
}
49-
50-
// Files returns the files generated by the asset.
51-
func (a *AuthConfig) Files() []*asset.File {
52-
// Return empty array because File will never be loaded.
53-
return []*asset.File{}
54-
}
55-
56-
// Reused from assisted-service.
57-
// https://github.com/openshift/assisted-service/blob/d3c0122452c74ad208055b8b6ee412812431a83f/internal/gencrypto/keys.go#L13-L54
5864
func keyPairPEM() (string, string, error) {
5965
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
6066
if err != nil {
@@ -97,3 +103,21 @@ func keyPairPEM() (string, string, error) {
97103

98104
return pubKeyPEM.String(), privKeyPEM.String(), nil
99105
}
106+
107+
func localJWTForKey(id string, privateKkeyPem string) (string, error) {
108+
priv, err := jwt.ParseECPrivateKeyFromPEM([]byte(privateKkeyPem))
109+
if err != nil {
110+
return "", err
111+
}
112+
113+
token := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
114+
string(InfraEnvKey): id,
115+
})
116+
117+
tokenString, err := token.SignedString(priv)
118+
if err != nil {
119+
return "", err
120+
}
121+
122+
return tokenString, nil
123+
}

‎pkg/asset/agent/gencrypto/authconfig_test.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ import (
44
"testing"
55

66
"github.com/stretchr/testify/assert"
7+
8+
"github.com/openshift/installer/pkg/asset"
9+
"github.com/openshift/installer/pkg/asset/agent/common"
710
)
811

912
func TestAuthConfig_Generate(t *testing.T) {
@@ -16,13 +19,17 @@ func TestAuthConfig_Generate(t *testing.T) {
1619
}
1720
for _, tc := range cases {
1821
t.Run(tc.name, func(t *testing.T) {
22+
parents := asset.Parents{}
23+
parents.Add(&common.InfraEnvID{})
24+
1925
authConfigAsset := &AuthConfig{}
20-
err := authConfigAsset.Generate(nil)
26+
err := authConfigAsset.Generate(parents)
2127

2228
assert.NoError(t, err)
2329

2430
assert.Contains(t, authConfigAsset.PrivateKey, "BEGIN EC PRIVATE KEY")
2531
assert.Contains(t, authConfigAsset.PublicKey, "BEGIN EC PUBLIC KEY")
32+
assert.NotEmpty(t, authConfigAsset.Token)
2633
})
2734
}
2835
}

‎pkg/asset/agent/image/ignition.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
igntypes "github.com/coreos/ignition/v2/config/v3_2/types"
1414
"github.com/coreos/stream-metadata-go/arch"
1515
"github.com/coreos/stream-metadata-go/stream"
16-
"github.com/google/uuid"
1716
"github.com/pkg/errors"
1817
"github.com/sirupsen/logrus"
1918
"gopkg.in/yaml.v2"
@@ -24,6 +23,7 @@ import (
2423
"github.com/openshift/installer/pkg/asset"
2524
agentcommon "github.com/openshift/installer/pkg/asset/agent"
2625
"github.com/openshift/installer/pkg/asset/agent/agentconfig"
26+
"github.com/openshift/installer/pkg/asset/agent/common"
2727
"github.com/openshift/installer/pkg/asset/agent/gencrypto"
2828
"github.com/openshift/installer/pkg/asset/agent/joiner"
2929
"github.com/openshift/installer/pkg/asset/agent/manifests"
@@ -100,6 +100,7 @@ func (a *Ignition) Dependencies() []asset.Asset {
100100
&mirror.RegistriesConf{},
101101
&mirror.CaBundle{},
102102
&gencrypto.AuthConfig{},
103+
&common.InfraEnvID{},
103104
}
104105
}
105106

@@ -113,7 +114,8 @@ func (a *Ignition) Generate(dependencies asset.Parents) error {
113114
agentHostsAsset := &agentconfig.AgentHosts{}
114115
extraManifests := &manifests.ExtraManifests{}
115116
keyPairAsset := &gencrypto.AuthConfig{}
116-
dependencies.Get(agentManifests, agentConfigAsset, agentHostsAsset, extraManifests, keyPairAsset, agentWorkflow, clusterInfo, addNodesConfig)
117+
infraEnvAsset := &common.InfraEnvID{}
118+
dependencies.Get(agentManifests, agentConfigAsset, agentHostsAsset, extraManifests, keyPairAsset, agentWorkflow, clusterInfo, addNodesConfig, infraEnvAsset)
117119

118120
pwd := &password.KubeadminPassword{}
119121
dependencies.Get(pwd)
@@ -229,7 +231,7 @@ func (a *Ignition) Generate(dependencies asset.Parents) error {
229231

230232
releaseImageMirror := mirror.GetMirrorFromRelease(agentManifests.ClusterImageSet.Spec.ReleaseImage, registriesConfig)
231233

232-
infraEnvID := uuid.New().String()
234+
infraEnvID := infraEnvAsset.ID
233235
logrus.Debug("Generated random infra-env id ", infraEnvID)
234236

235237
osImage, err := getOSImagesInfo(archName, openshiftVersion, streamGetter)

‎pkg/asset/agent/image/ignition_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
hivev1 "github.com/openshift/hive/apis/hive/v1"
2222
"github.com/openshift/installer/pkg/asset"
2323
"github.com/openshift/installer/pkg/asset/agent/agentconfig"
24+
"github.com/openshift/installer/pkg/asset/agent/common"
2425
"github.com/openshift/installer/pkg/asset/agent/gencrypto"
2526
"github.com/openshift/installer/pkg/asset/agent/joiner"
2627
"github.com/openshift/installer/pkg/asset/agent/manifests"
@@ -670,6 +671,7 @@ func buildIgnitionAssetDefaultDependencies(t *testing.T) []asset.Asset {
670671
&tls.AdminKubeConfigSignerCertKey{},
671672
&tls.AdminKubeConfigClientCertKey{},
672673
&gencrypto.AuthConfig{},
674+
&common.InfraEnvID{},
673675
}
674676
}
675677

‎pkg/asset/agent/image/unconfigured_ignition.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ import (
77

88
igntypes "github.com/coreos/ignition/v2/config/v3_2/types"
99
"github.com/coreos/stream-metadata-go/arch"
10-
"github.com/google/uuid"
1110
"github.com/pkg/errors"
1211
"github.com/sirupsen/logrus"
1312

1413
"github.com/openshift/installer/pkg/asset"
14+
"github.com/openshift/installer/pkg/asset/agent/common"
1515
"github.com/openshift/installer/pkg/asset/agent/manifests"
1616
"github.com/openshift/installer/pkg/asset/agent/mirror"
1717
"github.com/openshift/installer/pkg/asset/ignition"
@@ -78,16 +78,18 @@ func (a *UnconfiguredIgnition) Dependencies() []asset.Asset {
7878
&manifests.NMStateConfig{},
7979
&mirror.RegistriesConf{},
8080
&mirror.CaBundle{},
81+
&common.InfraEnvID{},
8182
}
8283
}
8384

8485
// Generate generates the agent installer unconfigured ignition.
8586
func (a *UnconfiguredIgnition) Generate(dependencies asset.Parents) error {
8687
infraEnvAsset := &manifests.InfraEnv{}
88+
infraEnvIDAsset := &common.InfraEnvID{}
8789
clusterImageSetAsset := &manifests.ClusterImageSet{}
8890
pullSecretAsset := &manifests.AgentPullSecret{}
8991
nmStateConfigs := &manifests.NMStateConfig{}
90-
dependencies.Get(infraEnvAsset, clusterImageSetAsset, pullSecretAsset, nmStateConfigs)
92+
dependencies.Get(infraEnvAsset, clusterImageSetAsset, pullSecretAsset, nmStateConfigs, infraEnvIDAsset)
9193

9294
infraEnv := infraEnvAsset.Config
9395
clusterImageSet := clusterImageSetAsset.Config
@@ -122,7 +124,7 @@ func (a *UnconfiguredIgnition) Generate(dependencies asset.Parents) error {
122124
registryCABundle := &mirror.CaBundle{}
123125
dependencies.Get(registriesConfig, registryCABundle)
124126

125-
infraEnvID := uuid.New().String()
127+
infraEnvID := infraEnvIDAsset.ID
126128
logrus.Debug("Generated random infra-env id ", infraEnvID)
127129

128130
openshiftVersion, err := version.Version()

‎pkg/asset/agent/image/unconfigured_ignition_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/openshift/assisted-service/models"
1212
hivev1 "github.com/openshift/hive/apis/hive/v1"
1313
"github.com/openshift/installer/pkg/asset"
14+
"github.com/openshift/installer/pkg/asset/agent/common"
1415
"github.com/openshift/installer/pkg/asset/agent/manifests"
1516
"github.com/openshift/installer/pkg/asset/agent/mirror"
1617
)
@@ -115,6 +116,7 @@ func buildUnconfiguredIgnitionAssetDefaultDependencies(t *testing.T) []asset.Ass
115116
&manifests.NMStateConfig{},
116117
&mirror.RegistriesConf{},
117118
&mirror.CaBundle{},
119+
&common.InfraEnvID{},
118120
}
119121
}
120122

0 commit comments

Comments
 (0)