Skip to content

Commit b9ea57b

Browse files
rpardinirpardini
committed
smee: introduce bool tink-server-insecure-tls controlling tinkerbell_insecure_tls kernel parameter
- for usage with tinkerbell/tink#960 Signed-off-by: Ricardo Pardini <ricardo@pardini.net>
1 parent f707ef1 commit b9ea57b

File tree

4 files changed

+52
-46
lines changed

4 files changed

+52
-46
lines changed

‎cmd/smee/flag.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ func ipxeHTTPScriptFlags(c *config, fs *flag.FlagSet) {
106106
fs.StringVar(&c.ipxeHTTPScript.hookURL, "osie-url", "", "[http] URL where OSIE (HookOS) images are located")
107107
fs.StringVar(&c.ipxeHTTPScript.tinkServer, "tink-server", "", "[http] IP:Port for the Tink server")
108108
fs.BoolVar(&c.ipxeHTTPScript.tinkServerUseTLS, "tink-server-tls", false, "[http] use TLS for Tink server")
109+
fs.BoolVar(&c.ipxeHTTPScript.tinkServerInsecureTLS, "tink-server-insecure-tls", false, "[http] use insecure TLS for Tink server")
109110
fs.IntVar(&c.ipxeHTTPScript.retries, "ipxe-script-retries", 0, "[http] number of retries to attempt when fetching kernel and initrd files in the iPXE script")
110111
fs.IntVar(&c.ipxeHTTPScript.retryDelay, "ipxe-script-retry-delay", 2, "[http] delay (in seconds) between retries when fetching kernel and initrd files in the iPXE script")
111112
}

‎cmd/smee/main.go‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ type ipxeHTTPScript struct {
8181
hookURL string
8282
tinkServer string
8383
tinkServerUseTLS bool
84+
tinkServerInsecureTLS bool
8485
trustedProxies string
8586
disableDiscoverTrustedProxies bool
8687
retries int
@@ -214,15 +215,16 @@ func main() {
214215
}
215216

216217
jh := script.Handler{
217-
Logger: log,
218-
Backend: br,
219-
OSIEURL: cfg.ipxeHTTPScript.hookURL,
220-
ExtraKernelParams: strings.Split(cfg.ipxeHTTPScript.extraKernelArgs, " "),
221-
PublicSyslogFQDN: cfg.dhcp.syslogIP,
222-
TinkServerTLS: cfg.ipxeHTTPScript.tinkServerUseTLS,
223-
TinkServerGRPCAddr: cfg.ipxeHTTPScript.tinkServer,
224-
IPXEScriptRetries: cfg.ipxeHTTPScript.retries,
225-
IPXEScriptRetryDelay: cfg.ipxeHTTPScript.retryDelay,
218+
Logger: log,
219+
Backend: br,
220+
OSIEURL: cfg.ipxeHTTPScript.hookURL,
221+
ExtraKernelParams: strings.Split(cfg.ipxeHTTPScript.extraKernelArgs, " "),
222+
PublicSyslogFQDN: cfg.dhcp.syslogIP,
223+
TinkServerTLS: cfg.ipxeHTTPScript.tinkServerUseTLS,
224+
TinkServerInsecureTLS: cfg.ipxeHTTPScript.tinkServerInsecureTLS,
225+
TinkServerGRPCAddr: cfg.ipxeHTTPScript.tinkServer,
226+
IPXEScriptRetries: cfg.ipxeHTTPScript.retries,
227+
IPXEScriptRetryDelay: cfg.ipxeHTTPScript.retryDelay,
226228
}
227229
// serve ipxe script from the "/" URI.
228230
handlers["/"] = jh.HandlerFunc()

‎internal/ipxe/script/hook.go‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ set retry_delay:int32 {{ .RetryDelay }}
1616
set idx:int32 0
1717
:retry_kernel
1818
kernel ${download-url}/vmlinuz-${arch} {{- if ne .VLANID "" }} vlan_id={{ .VLANID }} {{- end }} {{- range .ExtraKernelParams}} {{.}} {{- end}} \
19-
facility={{ .Facility }} syslog_host={{ .SyslogHost }} grpc_authority={{ .TinkGRPCAuthority }} tinkerbell_tls={{ .TinkerbellTLS }} worker_id={{ .WorkerID }} hw_addr={{ .HWAddr }} \
19+
facility={{ .Facility }} syslog_host={{ .SyslogHost }} grpc_authority={{ .TinkGRPCAuthority }} tinkerbell_tls={{ .TinkerbellTLS }} tinkerbell_insecure_tls={{ .TinkerbellInsecureTLS }} worker_id={{ .WorkerID }} hw_addr={{ .HWAddr }} \
2020
modules=loop,squashfs,sd-mod,usb-storage intel_iommu=on iommu=pt initrd=initramfs-${arch} console=tty0 console=ttyS1,115200 && goto download_initrd || iseq ${idx} ${retries} && goto kernel-error || inc idx && echo retry in ${retry_delay} seconds ; sleep ${retry_delay} ; goto retry_kernel
2121
2222
:download_initrd
@@ -47,18 +47,19 @@ exit
4747

4848
// Hook holds the values used to generate the iPXE script that loads the Hook OS.
4949
type Hook struct {
50-
Arch string // example x86_64
51-
Console string // example ttyS1,115200
52-
DownloadURL string // example https://location:8080/to/kernel/and/initrd
53-
ExtraKernelParams []string // example tink_worker_image=quay.io/tinkerbell/tink-worker:v0.8.0
54-
Facility string
55-
HWAddr string // example 3c:ec:ef:4c:4f:54
56-
SyslogHost string
57-
TinkerbellTLS bool
58-
TinkGRPCAuthority string // example 192.168.2.111:42113
59-
TraceID string
60-
VLANID string // string number between 1-4095
61-
WorkerID string // example 3c:ec:ef:4c:4f:54 or worker1
62-
Retries int // number of retries to attempt when fetching kernel and initrd files
63-
RetryDelay int // number of seconds to wait between retries
50+
Arch string // example x86_64
51+
Console string // example ttyS1,115200
52+
DownloadURL string // example https://location:8080/to/kernel/and/initrd
53+
ExtraKernelParams []string // example tink_worker_image=quay.io/tinkerbell/tink-worker:v0.8.0
54+
Facility string
55+
HWAddr string // example 3c:ec:ef:4c:4f:54
56+
SyslogHost string
57+
TinkerbellTLS bool
58+
TinkerbellInsecureTLS bool
59+
TinkGRPCAuthority string // example 192.168.2.111:42113
60+
TraceID string
61+
VLANID string // string number between 1-4095
62+
WorkerID string // example 3c:ec:ef:4c:4f:54 or worker1
63+
Retries int // number of retries to attempt when fetching kernel and initrd files
64+
RetryDelay int // number of seconds to wait between retries
6465
}

‎internal/ipxe/script/ipxe.go‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,16 @@ import (
1919
)
2020

2121
type Handler struct {
22-
Logger logr.Logger
23-
Backend handler.BackendReader
24-
OSIEURL string
25-
ExtraKernelParams []string
26-
PublicSyslogFQDN string
27-
TinkServerTLS bool
28-
TinkServerGRPCAddr string
29-
IPXEScriptRetries int
30-
IPXEScriptRetryDelay int
22+
Logger logr.Logger
23+
Backend handler.BackendReader
24+
OSIEURL string
25+
ExtraKernelParams []string
26+
PublicSyslogFQDN string
27+
TinkServerTLS bool
28+
TinkServerInsecureTLS bool
29+
TinkServerGRPCAddr string
30+
IPXEScriptRetries int
31+
IPXEScriptRetryDelay int
3132
}
3233

3334
type data struct {
@@ -218,19 +219,20 @@ func (h *Handler) defaultScript(span trace.Span, hw data) (string, error) {
218219
}
219220

220221
auto := Hook{
221-
Arch: arch,
222-
Console: "",
223-
DownloadURL: h.OSIEURL,
224-
ExtraKernelParams: h.ExtraKernelParams,
225-
Facility: hw.Facility,
226-
HWAddr: mac.String(),
227-
SyslogHost: h.PublicSyslogFQDN,
228-
TinkerbellTLS: h.TinkServerTLS,
229-
TinkGRPCAuthority: h.TinkServerGRPCAddr,
230-
VLANID: hw.VLANID,
231-
WorkerID: wID,
232-
Retries: h.IPXEScriptRetries,
233-
RetryDelay: h.IPXEScriptRetryDelay,
222+
Arch: arch,
223+
Console: "",
224+
DownloadURL: h.OSIEURL,
225+
ExtraKernelParams: h.ExtraKernelParams,
226+
Facility: hw.Facility,
227+
HWAddr: mac.String(),
228+
SyslogHost: h.PublicSyslogFQDN,
229+
TinkerbellTLS: h.TinkServerTLS,
230+
TinkerbellInsecureTLS: h.TinkServerInsecureTLS,
231+
TinkGRPCAuthority: h.TinkServerGRPCAddr,
232+
VLANID: hw.VLANID,
233+
WorkerID: wID,
234+
Retries: h.IPXEScriptRetries,
235+
RetryDelay: h.IPXEScriptRetryDelay,
234236
}
235237
if sc := span.SpanContext(); sc.IsSampled() {
236238
auto.TraceID = sc.TraceID().String()

0 commit comments

Comments
 (0)