Skip to content

Commit 0a52dcb

Browse files
kayruskayrus
authored
Auth: add TLS client auth support (kubernetes#1123)
1 parent 9fad047 commit 0a52dcb

File tree

3 files changed

+28
-5
lines changed

3 files changed

+28
-5
lines changed

‎docs/using-manila-csi-plugin.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,8 @@ Mandatory secrets for _trustee authentication:_ `os-trustID`, `os-trusteeID`, `o
8080

8181
Optionally, a custom certificate may be sourced via `os-certAuthorityPath` (path to a PEM file inside the plugin container). By default, the usual TLS verification is performed. To override this behavior and accept insecure certificates, set `os-TLSInsecure` to `true` (defaults to `false`).
8282

83+
For a client TLS authentication use both `os-clientCertPath` and `os-clientKeyPath` (paths to TLS keypair PEM files inside the plugin container).
84+
8385
### Topology-aware dynamic provisioning
8486

8587
Topology-aware dynamic provisioning makes it possible to reliably provision and use shares that are _not_ equally accessible from all compute nodes due to storage topology constraints.

‎docs/using-openstack-cloud-controller-manager.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,10 @@ The options in `Global` section are used for openstack-cloud-controller-manager
9494
Required. Keystone service URL, e.g. http://128.110.154.166/identity
9595
* `ca-file`
9696
Optional. CA certificate bundle file for communication with Keystone service, this is required when using the https protocol in the Keystone service URL.
97+
* `cert-file`
98+
Optional. Client certificate path used for the client TLS authentication.
99+
* `key-file`
100+
Optional. Client private key path used for the client TLS authentication.
97101
* `username`
98102
Keystone user name. If you are using [Keystone application credential](https://docs.openstack.org/keystone/latest/user/application_credentials.html), this option is not required.
99103
* `password`

‎pkg/cloudprovider/providers/openstack/openstack.go‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -187,22 +187,26 @@ type OpenStack struct {
187187
}
188188

189189
type AuthOpts struct {
190-
AuthURL string `gcfg:"auth-url" mapstructure:"auth-url" name:"os-authURL" dependsOn:"os-password|os-trustID|os-applicationCredentialSecret"`
190+
AuthURL string `gcfg:"auth-url" mapstructure:"auth-url" name:"os-authURL" dependsOn:"os-password|os-trustID|os-applicationCredentialSecret|os-clientCertPath"`
191191
UserID string `gcfg:"user-id" mapstructure:"user-id" name:"os-userID" value:"optional" dependsOn:"os-password"`
192192
Username string `name:"os-userName" value:"optional" dependsOn:"os-password"`
193193
Password string `name:"os-password" value:"optional" dependsOn:"os-domainID|os-domainName,os-projectID|os-projectName,os-userID|os-userName"`
194-
TenantID string `gcfg:"tenant-id" mapstructure:"project-id" name:"os-projectID" value:"optional" dependsOn:"os-password"`
195-
TenantName string `gcfg:"tenant-name" mapstructure:"project-name" name:"os-projectName" value:"optional" dependsOn:"os-password"`
194+
TenantID string `gcfg:"tenant-id" mapstructure:"project-id" name:"os-projectID" value:"optional" dependsOn:"os-password|os-clientCertPath"`
195+
TenantName string `gcfg:"tenant-name" mapstructure:"project-name" name:"os-projectName" value:"optional" dependsOn:"os-password|os-clientCertPath"`
196196
TrustID string `gcfg:"trust-id" mapstructure:"trust-id" name:"os-trustID" value:"optional"`
197-
DomainID string `gcfg:"domain-id" mapstructure:"domain-id" name:"os-domainID" value:"optional" dependsOn:"os-password"`
198-
DomainName string `gcfg:"domain-name" mapstructure:"domain-name" name:"os-domainName" value:"optional" dependsOn:"os-password"`
197+
DomainID string `gcfg:"domain-id" mapstructure:"domain-id" name:"os-domainID" value:"optional" dependsOn:"os-password|os-clientCertPath"`
198+
DomainName string `gcfg:"domain-name" mapstructure:"domain-name" name:"os-domainName" value:"optional" dependsOn:"os-password|os-clientCertPath"`
199199
TenantDomainID string `gcfg:"tenant-domain-id" mapstructure:"project-domain-id" name:"os-projectDomainID" value:"optional"`
200200
TenantDomainName string `gcfg:"tenant-domain-name" mapstructure:"project-domain-name" name:"os-projectDomainName" value:"optional"`
201201
UserDomainID string `gcfg:"user-domain-id" mapstructure:"user-domain-id" name:"os-userDomainID" value:"optional"`
202202
UserDomainName string `gcfg:"user-domain-name" mapstructure:"user-domain-name" name:"os-userDomainName" value:"optional"`
203203
Region string `name:"os-region"`
204204
CAFile string `gcfg:"ca-file" mapstructure:"ca-file" name:"os-certAuthorityPath" value:"optional"`
205205

206+
// TLS client auth
207+
CertFile string `gcfg:"cert-file" mapstructure:"cert-file" name:"os-clientCertPath" value:"optional" dependsOn:"os-clientKeyPath"`
208+
KeyFile string `gcfg:"key-file" mapstructure:"key-file" name:"os-clientKeyPath" value:"optional" dependsOn:"os-clientCertPath"`
209+
206210
// Manila only options
207211
TLSInsecure string `name:"os-TLSInsecure" value:"optional" matches:"^true|false$"`
208212
// backward compatibility with the manila-csi-plugin
@@ -245,6 +249,8 @@ func LogCfg(cfg Config) {
245249
klog.V(5).Infof("UserDomainName: %s", cfg.Global.UserDomainName)
246250
klog.V(5).Infof("Region: %s", cfg.Global.Region)
247251
klog.V(5).Infof("CAFile: %s", cfg.Global.CAFile)
252+
klog.V(5).Infof("CertFile: %s", cfg.Global.CertFile)
253+
klog.V(5).Infof("KeyFile: %s", cfg.Global.KeyFile)
248254
klog.V(5).Infof("UseClouds: %t", cfg.Global.UseClouds)
249255
klog.V(5).Infof("CloudsFile: %s", cfg.Global.CloudsFile)
250256
klog.V(5).Infof("Cloud: %s", cfg.Global.Cloud)
@@ -442,6 +448,8 @@ func ReadClouds(cfg *Config) error {
442448
cfg.Global.UserDomainName = replaceEmpty(cfg.Global.UserDomainName, cloud.AuthInfo.UserDomainName)
443449
cfg.Global.Region = replaceEmpty(cfg.Global.Region, cloud.RegionName)
444450
cfg.Global.CAFile = replaceEmpty(cfg.Global.CAFile, cloud.CACertFile)
451+
cfg.Global.CertFile = replaceEmpty(cfg.Global.CertFile, cloud.ClientCertFile)
452+
cfg.Global.KeyFile = replaceEmpty(cfg.Global.KeyFile, cloud.ClientKeyFile)
445453
cfg.Global.ApplicationCredentialID = replaceEmpty(cfg.Global.ApplicationCredentialID, cloud.AuthInfo.ApplicationCredentialID)
446454
cfg.Global.ApplicationCredentialName = replaceEmpty(cfg.Global.ApplicationCredentialName, cloud.AuthInfo.ApplicationCredentialName)
447455
cfg.Global.ApplicationCredentialSecret = replaceEmpty(cfg.Global.ApplicationCredentialSecret, cloud.AuthInfo.ApplicationCredentialSecret)
@@ -526,6 +534,15 @@ func NewOpenStackClient(cfg *AuthOpts, userAgent string, extraUserAgent ...strin
526534
config.RootCAs = caPool
527535
}
528536

537+
// configure TLS client auth
538+
if cfg.CertFile != "" && cfg.KeyFile != "" {
539+
cert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile)
540+
if err != nil {
541+
return nil, fmt.Errorf("error loading TLS key pair: %s", err)
542+
}
543+
config.Certificates = []tls.Certificate{cert}
544+
}
545+
529546
provider.HTTPClient.Transport = netutil.SetOldTransportDefaults(&http.Transport{TLSClientConfig: config})
530547

531548
if klog.V(6).Enabled() {

0 commit comments

Comments
 (0)