Skip to content

Commit 2ea5fc8

Browse files
michaelklishinmichaelklishin
committed
Kubernetes peer discovery improvements
 * Use file path validators to improve error messages when a certificate, key or another file does not exist or cannot be read by the node * Introduce a number of standard TLS options in addition to the Kubelet-provided CA certificate
1 parent 3486206 commit 2ea5fc8

File tree

8 files changed

+138
-12
lines changed

8 files changed

+138
-12
lines changed

‎deps/rabbitmq_peer_discovery_k8s/priv/schema/rabbitmq_peer_discovery_k8s.schema‎

Lines changed: 71 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ end}.
5151
%% (ACL) Token path
5252

5353
{mapping, "cluster_formation.k8s.token_path", "rabbit.cluster_formation.peer_discovery_k8s.k8s_token_path", [
54-
{datatype, string}
54+
{datatype, string}, {validators, ["file_accessible"]}
5555
]}.
5656

5757
{translation, "rabbit.cluster_formation.peer_discovery_k8s.k8s_token_path",
@@ -62,10 +62,14 @@ fun(Conf) ->
6262
end
6363
end}.
6464

65-
%% Certificate path
65+
%%
66+
%% TLS
67+
%%
68+
69+
%% deprecated
6670

6771
{mapping, "cluster_formation.k8s.cert_path", "rabbit.cluster_formation.peer_discovery_k8s.k8s_cert_path", [
68-
{datatype, string}
72+
{datatype, string}, {validators, ["file_accessible"]}
6973
]}.
7074

7175
{translation, "rabbit.cluster_formation.peer_discovery_k8s.k8s_cert_path",
@@ -76,10 +80,73 @@ fun(Conf) ->
7680
end
7781
end}.
7882

83+
%% modern keys
84+
85+
{mapping, "cluster_formation.k8s.tls.cacertfile", "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.cacertfile",
86+
[{datatype, string}, {validators, ["file_accessible"]}
87+
]}.
88+
89+
{translation, "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.cacertfile",
90+
fun(Conf) ->
91+
case cuttlefish:conf_get("cluster_formation.k8s.tls.cacertfile", Conf, undefined) of
92+
undefined -> cuttlefish:unset();
93+
Value -> Value
94+
end
95+
end}.
96+
97+
{mapping, "cluster_formation.k8s.tls.certfile", "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.certfile",
98+
[{datatype, string}, {validators, ["file_accessible"]}
99+
]}.
100+
101+
{translation, "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.certfile",
102+
fun(Conf) ->
103+
case cuttlefish:conf_get("cluster_formation.k8s.tls.certfile", Conf, undefined) of
104+
undefined -> cuttlefish:unset();
105+
Value -> Value
106+
end
107+
end}.
108+
109+
{mapping, "cluster_formation.k8s.tls.keyfile", "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.keyfile",
110+
[{datatype, string}, {validators, ["file_accessible"]}
111+
]}.
112+
113+
{translation, "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.keyfile",
114+
fun(Conf) ->
115+
case cuttlefish:conf_get("cluster_formation.k8s.tls.keyfile", Conf, undefined) of
116+
undefined -> cuttlefish:unset();
117+
Value -> Value
118+
end
119+
end}.
120+
121+
{mapping, "cluster_formation.k8s.tls.verify", "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.verify", [
122+
{datatype, {enum, [verify_peer, verify_none]}}
123+
]}.
124+
125+
{translation, "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.verify",
126+
fun(Conf) ->
127+
case cuttlefish:conf_get("cluster_formation.k8s.tls.verify", Conf, undefined) of
128+
undefined -> cuttlefish:unset();
129+
Value -> Value
130+
end
131+
end}.
132+
133+
{mapping, "cluster_formation.k8s.tls.fail_if_no_peer_cert", "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.fail_if_no_peer_cert", [
134+
{datatype, {enum, [true, false]}}
135+
]}.
136+
137+
{translation, "rabbit.cluster_formation.peer_discovery_k8s.ssl_options.fail_if_no_peer_cert",
138+
fun(Conf) ->
139+
case cuttlefish:conf_get("cluster_formation.k8s.tls.fail_if_no_peer_cert", Conf, undefined) of
140+
undefined -> cuttlefish:unset();
141+
Value -> Value
142+
end
143+
end}.
144+
145+
79146
%% Namespace path
80147

81148
{mapping, "cluster_formation.k8s.namespace_path", "rabbit.cluster_formation.peer_discovery_k8s.k8s_namespace_path", [
82-
{datatype, string}
149+
{datatype, string}, {validators, ["file_accessible"]}
83150
]}.
84151

85152
{translation, "rabbit.cluster_formation.peer_discovery_k8s.k8s_namespace_path",

‎deps/rabbitmq_peer_discovery_k8s/src/rabbit_peer_discovery_k8s.erl‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,14 +116,29 @@ make_request() ->
116116
M = ?CONFIG_MODULE:config_map(?BACKEND_CONFIG_KEY),
117117
{ok, Token} = rabbit_misc:raw_read_file(get_config_key(k8s_token_path, M)),
118118
Token1 = binary:replace(Token, <<"\n">>, <<>>),
119+
120+
rabbit_log:debug("Will issue a Kubernetes API request client with the following settings: ~tp", [M]),
121+
122+
TLSClientOpts0 = maps:get(ssl_options, M, []),
123+
LegacyCACertfilePath = get_config_key(k8s_cert_path, M),
124+
%% merge legacy CA certificate file argument if TLSClientOpts does not have its modern counterpart set
125+
TLSClientOpts = case proplists:get_value(cacertfile, TLSClientOpts0, undefined) of
126+
undefined ->
127+
[{cacertfile, LegacyCACertfilePath} | TLSClientOpts0];
128+
_Other ->
129+
TLSClientOpts0
130+
end,
131+
132+
rabbit_log:debug("Will issue a Kubernetes API request client with the following TLS options: ~tp", [TLSClientOpts]),
133+
119134
?HTTPC_MODULE:get(
120135
get_config_key(k8s_scheme, M),
121136
get_config_key(k8s_host, M),
122137
get_config_key(k8s_port, M),
123-
base_path(endpoints,get_config_key(k8s_service_name, M)),
138+
base_path(endpoints, get_config_key(k8s_service_name, M)),
124139
[],
125140
[{"Authorization", "Bearer " ++ binary_to_list(Token1)}],
126-
[{ssl, [{cacertfile, get_config_key(k8s_cert_path, M)}]}]).
141+
[{ssl, TLSClientOpts}]).
127142

128143
%% @spec node_name(k8s_endpoint) -> list()
129144
%% @doc Return a full rabbit node name, appending hostname suffix

‎deps/rabbitmq_peer_discovery_k8s/test/config_schema_SUITE_data/certs/cacert.pem‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
I'm not a certificate

‎deps/rabbitmq_peer_discovery_k8s/test/config_schema_SUITE_data/certs/cert.pem‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
I'm not a certificate

‎deps/rabbitmq_peer_discovery_k8s/test/config_schema_SUITE_data/certs/key.pem‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
I'm not a certificate

‎deps/rabbitmq_peer_discovery_k8s/test/config_schema_SUITE_data/namespace.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
example-namespace

‎deps/rabbitmq_peer_discovery_k8s/test/config_schema_SUITE_data/rabbitmq_peer_discovery_k8s.snippets‎

Lines changed: 45 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -101,33 +101,72 @@
101101
], [rabbitmq_peer_discovery_k8s]
102102
}
103103

104-
, {k8s_token_path, "cluster_formation.k8s.token_path = /a/b/c", [
104+
, {k8s_token_path, "cluster_formation.k8s.token_path = test/config_schema_SUITE_data/token.txt", [
105105
{rabbit, [
106106
{cluster_formation, [
107107
{peer_discovery_k8s, [
108-
{k8s_token_path, "/a/b/c"}
108+
{k8s_token_path, "test/config_schema_SUITE_data/token.txt"}
109109
]}
110110
]}
111111
]}
112112
], [rabbitmq_peer_discovery_k8s]
113113
}
114114

115-
, {k8s_token_path, "cluster_formation.k8s.cert_path = /a/b/c", [
115+
, {k8s_ca_certificate_legacy_cert_path, "cluster_formation.k8s.cert_path = test/config_schema_SUITE_data/certs/cacert.pem", [
116116
{rabbit, [
117117
{cluster_formation, [
118118
{peer_discovery_k8s, [
119-
{k8s_cert_path, "/a/b/c"}
119+
{k8s_cert_path, "test/config_schema_SUITE_data/certs/cacert.pem"}
120120
]}
121121
]}
122122
]}
123123
], [rabbitmq_peer_discovery_k8s]
124124
}
125125

126-
, {k8s_token_path, "cluster_formation.k8s.namespace_path = /a/b/c", [
126+
, {k8s_ca_certificate_modern_path, "cluster_formation.k8s.tls.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem", [
127127
{rabbit, [
128128
{cluster_formation, [
129129
{peer_discovery_k8s, [
130-
{k8s_namespace_path, "/a/b/c"}
130+
{ssl_options, [
131+
{cacertfile, "test/config_schema_SUITE_data/certs/cacert.pem"}
132+
]}
133+
]}
134+
]}
135+
]}
136+
], [rabbitmq_peer_discovery_k8s]
137+
}
138+
139+
, {k8s_client_certificate_modern_path, "cluster_formation.k8s.tls.certfile = test/config_schema_SUITE_data/certs/cert.pem", [
140+
{rabbit, [
141+
{cluster_formation, [
142+
{peer_discovery_k8s, [
143+
{ssl_options, [
144+
{certfile, "test/config_schema_SUITE_data/certs/cert.pem"}
145+
]}
146+
]}
147+
]}
148+
]}
149+
], [rabbitmq_peer_discovery_k8s]
150+
}
151+
152+
, {k8s_client_key_modern_path, "cluster_formation.k8s.tls.keyfile = test/config_schema_SUITE_data/certs/key.pem", [
153+
{rabbit, [
154+
{cluster_formation, [
155+
{peer_discovery_k8s, [
156+
{ssl_options, [
157+
{keyfile, "test/config_schema_SUITE_data/certs/key.pem"}
158+
]}
159+
]}
160+
]}
161+
]}
162+
], [rabbitmq_peer_discovery_k8s]
163+
}
164+
165+
, {k8s_namespace_path, "cluster_formation.k8s.namespace_path = test/config_schema_SUITE_data/namespace.txt", [
166+
{rabbit, [
167+
{cluster_formation, [
168+
{peer_discovery_k8s, [
169+
{k8s_namespace_path, "test/config_schema_SUITE_data/namespace.txt"}
131170
]}
132171
]}
133172
]}

‎deps/rabbitmq_peer_discovery_k8s/test/config_schema_SUITE_data/token.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
example-token

0 commit comments

Comments
 (0)