Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extract gRPC TLS configuration into a shared package #1840

Merged
merged 10 commits into from
Oct 8, 2019
Merged

Extract gRPC TLS configuration into a shared package #1840

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
fbf781b
Extract TLS flags and cert loading logic
Oct 7, 2019
cb41f77
Rename package
Oct 7, 2019
10f6f6d
Refactor grpc
Oct 7, 2019
b3d7bcb
Repair tests
Oct 8, 2019
313cb6b
Refactor gRPC server in collector
Oct 8, 2019
9bb47db
Add ShowCA option
Oct 8, 2019
e8aae0a
Switch options order
Oct 8, 2019
328c2b6
Separate client and server TLS options
Oct 8, 2019
4cf2928
Update usage
Oct 8, 2019
207c01b
Rename test, add filepath.Clean
Oct 8, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 9 additions & 51 deletions cmd/agent/app/reporter/grpc/builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,20 +15,17 @@
package grpc

import (
"crypto/tls"
"crypto/x509"
"errors"
"fmt"
"io/ioutil"
"strings"

grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/retry"
"github.com/pkg/errors"
"go.uber.org/zap"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
"google.golang.org/grpc/resolver"
"google.golang.org/grpc/resolver/manual"

"github.com/jaegertracing/jaeger/pkg/config/tlscfg"
"github.com/jaegertracing/jaeger/pkg/discovery"
"github.com/jaegertracing/jaeger/pkg/discovery/grpcresolver"
)
Expand All @@ -38,12 +35,8 @@ type ConnBuilder struct {
// CollectorHostPorts is list of host:port Jaeger Collectors.
CollectorHostPorts []string `yaml:"collectorHostPorts"`

MaxRetry uint
TLS bool
TLSCA string
TLSServerName string
TLSCert string
TLSKey string
MaxRetry uint
TLS tlscfg.Options

DiscoveryMinPeers int
Notifier discovery.Notifier
Expand All @@ -59,49 +52,14 @@ func NewConnBuilder() *ConnBuilder {
func (b *ConnBuilder) CreateConnection(logger *zap.Logger) (*grpc.ClientConn, error) {
var dialOptions []grpc.DialOption
var dialTarget string
if b.TLS { // user requested a secure connection
if b.TLS.Enabled { // user requested a secure connection
logger.Info("Agent requested secure grpc connection to collector(s)")
var err error
var certPool *x509.CertPool
if len(b.TLSCA) == 0 { // no truststore given, use SystemCertPool
certPool, err = systemCertPool()
if err != nil {
return nil, err
}
} else { // setup user specified truststore
caPEM, err := ioutil.ReadFile(b.TLSCA)
if err != nil {
return nil, fmt.Errorf("reading client CA failed, %v", err)
}

certPool = x509.NewCertPool()
if !certPool.AppendCertsFromPEM(caPEM) {
return nil, fmt.Errorf("building client CA failed, %v", err)
}
}

tlsCfg := &tls.Config{
MinVersion: tls.VersionTLS12,
RootCAs: certPool,
ServerName: b.TLSServerName,
}

if (b.TLSKey == "" || b.TLSCert == "") &&
(b.TLSKey != "" || b.TLSCert != "") {
return nil, fmt.Errorf("for client auth, both client certificate and key must be supplied")
}

if b.TLSKey != "" && b.TLSCert != "" {
tlsCert, err := tls.LoadX509KeyPair(b.TLSCert, b.TLSKey)
if err != nil {
return nil, fmt.Errorf("could not load server TLS cert and key, %v", err)
}

logger.Info("client TLS authentication enabled")
tlsCfg.Certificates = []tls.Certificate{tlsCert}
tlsConf, err := b.TLS.Config()
if err != nil {
return nil, errors.Wrap(err, "failed to load TLS config")
}

creds := credentials.NewTLS(tlsCfg)
creds := credentials.NewTLS(tlsConf)
dialOptions = append(dialOptions, grpc.WithTransportCredentials(creds))
} else { // insecure connection
logger.Info("Agent requested insecure grpc connection to collector(s)")
Expand Down
Loading