Skip to content

Commit a594d3a

Browse files
pawanpinjarkarpawanpinjarkar
committed
AGENT-872: Generate non-expiring local JWT tokens and save it in the asset store
1 parent d29e3b9 commit a594d3a

File tree

6 files changed

+57
-8
lines changed

6 files changed

+57
-8
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ require (
4444
github.com/go-openapi/strfmt v0.23.0
4545
github.com/go-openapi/swag v0.22.9
4646
github.com/go-playground/validator/v10 v10.19.0
47+
github.com/golang-jwt/jwt/v4 v4.5.0
4748
github.com/golang/mock v1.7.0-rc.1
4849
github.com/golang/protobuf v1.5.4
4950
github.com/google/go-cmp v0.6.0
@@ -183,7 +184,6 @@ require (
183184
github.com/go-playground/universal-translator v0.18.1 // indirect
184185
github.com/gobuffalo/flect v1.0.2 // indirect
185186
github.com/gogo/protobuf v1.3.2 // indirect
186-
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
187187
github.com/golang-jwt/jwt/v5 v5.2.0 // indirect
188188
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
189189
github.com/google/btree v1.0.1 // indirect

‎pkg/asset/agent/common/utility.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package common
2+
3+
import "github.com/google/uuid"
4+
5+
// InfraEnvID holds an uniuqe identifier for infra env resource.
6+
var InfraEnvID string
7+
8+
func init() {
9+
// Generate a UUID during initialization
10+
InfraEnvID = uuid.New().String()
11+
}

‎pkg/asset/agent/gencrypto/authconfig.go‎

Lines changed: 40 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,25 @@ import (
88
"crypto/x509"
99
"encoding/pem"
1010

11+
"github.com/golang-jwt/jwt/v4"
12+
1113
"github.com/openshift/installer/pkg/asset"
14+
"github.com/openshift/installer/pkg/asset/agent/common"
1215
)
1316

14-
// AuthConfig is an asset that generates ECDSA public and private keys.
17+
// AuthConfig is an asset that generates ECDSA public/private keys, JWT token.
1518
type AuthConfig struct {
16-
PublicKey, PrivateKey string
19+
PublicKey, PrivateKey, Token string
1720
}
1821

22+
// LocalJWTKeyType suggests the key type to be used for the token.
23+
type LocalJWTKeyType string
24+
25+
const (
26+
// InfraEnvKey is used to generate token using infra env id.
27+
InfraEnvKey LocalJWTKeyType = "infra_env_id"
28+
)
29+
1930
var _ asset.WritableAsset = (*AuthConfig)(nil)
2031

2132
// Dependencies returns the assets on which the AuthConfig asset depends.
@@ -32,6 +43,12 @@ func (a *AuthConfig) Generate(dependencies asset.Parents) error {
3243
a.PublicKey = PublicKey
3344
a.PrivateKey = PrivateKey
3445

46+
token, err := localJWTForKey(common.InfraEnvID, a.PrivateKey)
47+
if err != nil {
48+
return err
49+
}
50+
a.Token = token
51+
3552
return nil
3653
}
3754

@@ -53,7 +70,7 @@ func (a *AuthConfig) Files() []*asset.File {
5370
return []*asset.File{}
5471
}
5572

56-
// Reused from assisted-service.
73+
// Referenced from assisted-service.
5774
// https://github.com/openshift/assisted-service/blob/d3c0122452c74ad208055b8b6ee412812431a83f/internal/gencrypto/keys.go#L13-L54
5875
func keyPairPEM() (string, string, error) {
5976
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
@@ -97,3 +114,23 @@ func keyPairPEM() (string, string, error) {
97114

98115
return pubKeyPEM.String(), privKeyPEM.String(), nil
99116
}
117+
118+
// Referenced from assisted-service.
119+
// https://github.com/openshift/assisted-service/blob/d3c0122452c74ad208055b8b6ee412812431a83f/internal/gencrypto/token.go#L33-L50
120+
func localJWTForKey(id string, privateKkeyPem string) (string, error) {
121+
priv, err := jwt.ParseECPrivateKeyFromPEM([]byte(privateKkeyPem))
122+
if err != nil {
123+
return "", err
124+
}
125+
126+
token := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
127+
string(InfraEnvKey): id,
128+
})
129+
130+
tokenString, err := token.SignedString(priv)
131+
if err != nil {
132+
return "", err
133+
}
134+
135+
return tokenString, nil
136+
}

‎pkg/asset/agent/gencrypto/authconfig_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ func TestAuthConfig_Generate(t *testing.T) {
2323

2424
assert.Contains(t, authConfigAsset.PrivateKey, "BEGIN EC PRIVATE KEY")
2525
assert.Contains(t, authConfigAsset.PublicKey, "BEGIN EC PUBLIC KEY")
26+
assert.NotEmpty(t, authConfigAsset.Token)
2627
})
2728
}
2829
}

‎pkg/asset/agent/image/ignition.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
igntypes "github.com/coreos/ignition/v2/config/v3_2/types"
1414
"github.com/coreos/stream-metadata-go/arch"
1515
"github.com/coreos/stream-metadata-go/stream"
16-
"github.com/google/uuid"
1716
"github.com/pkg/errors"
1817
"github.com/sirupsen/logrus"
1918
"gopkg.in/yaml.v2"
@@ -24,6 +23,7 @@ import (
2423
"github.com/openshift/installer/pkg/asset"
2524
agentcommon "github.com/openshift/installer/pkg/asset/agent"
2625
"github.com/openshift/installer/pkg/asset/agent/agentconfig"
26+
"github.com/openshift/installer/pkg/asset/agent/common"
2727
"github.com/openshift/installer/pkg/asset/agent/gencrypto"
2828
"github.com/openshift/installer/pkg/asset/agent/joiner"
2929
"github.com/openshift/installer/pkg/asset/agent/manifests"
@@ -229,7 +229,7 @@ func (a *Ignition) Generate(dependencies asset.Parents) error {
229229

230230
releaseImageMirror := mirror.GetMirrorFromRelease(agentManifests.ClusterImageSet.Spec.ReleaseImage, registriesConfig)
231231

232-
infraEnvID := uuid.New().String()
232+
infraEnvID := common.InfraEnvID
233233
logrus.Debug("Generated random infra-env id ", infraEnvID)
234234

235235
osImage, err := getOSImagesInfo(archName, openshiftVersion, streamGetter)

‎pkg/asset/agent/image/unconfigured_ignition.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ import (
77

88
igntypes "github.com/coreos/ignition/v2/config/v3_2/types"
99
"github.com/coreos/stream-metadata-go/arch"
10-
"github.com/google/uuid"
1110
"github.com/pkg/errors"
1211
"github.com/sirupsen/logrus"
1312

1413
"github.com/openshift/installer/pkg/asset"
14+
"github.com/openshift/installer/pkg/asset/agent/common"
1515
"github.com/openshift/installer/pkg/asset/agent/manifests"
1616
"github.com/openshift/installer/pkg/asset/agent/mirror"
1717
"github.com/openshift/installer/pkg/asset/ignition"
@@ -122,7 +122,7 @@ func (a *UnconfiguredIgnition) Generate(dependencies asset.Parents) error {
122122
registryCABundle := &mirror.CaBundle{}
123123
dependencies.Get(registriesConfig, registryCABundle)
124124

125-
infraEnvID := uuid.New().String()
125+
infraEnvID := common.InfraEnvID
126126
logrus.Debug("Generated random infra-env id ", infraEnvID)
127127

128128
openshiftVersion, err := version.Version()

0 commit comments

Comments
 (0)