Skip to content

smee: introduce bool tink-server-insecure-tls controlling tinkerbell_insecure_tls kernel parameter #479

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 27, 2024
Merged

smee: introduce bool tink-server-insecure-tls controlling tinkerbell_insecure_tls kernel parameter #479

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e803b4
smee: introduce bool `tink-server-insecure-tls` controlling `tinkerbe…
rpardini Jul 9, 2024
43f2e4a
Merge branch 'main' into add-tink-insecure-tls-flag
mergify[bot] Aug 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cmd/smee/flag.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ func ipxeHTTPScriptFlags(c *config, fs *flag.FlagSet) {
fs.StringVar(&c.ipxeHTTPScript.hookURL, "osie-url", "", "[http] URL where OSIE (HookOS) images are located")
fs.StringVar(&c.ipxeHTTPScript.tinkServer, "tink-server", "", "[http] IP:Port for the Tink server")
fs.BoolVar(&c.ipxeHTTPScript.tinkServerUseTLS, "tink-server-tls", false, "[http] use TLS for Tink server")
fs.BoolVar(&c.ipxeHTTPScript.tinkServerInsecureTLS, "tink-server-insecure-tls", false, "[http] use insecure TLS for Tink server")
fs.IntVar(&c.ipxeHTTPScript.retries, "ipxe-script-retries", 0, "[http] number of retries to attempt when fetching kernel and initrd files in the iPXE script")
fs.IntVar(&c.ipxeHTTPScript.retryDelay, "ipxe-script-retry-delay", 2, "[http] delay (in seconds) between retries when fetching kernel and initrd files in the iPXE script")
}
Expand Down
1 change: 1 addition & 0 deletions cmd/smee/flag_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ FLAGS
-ipxe-script-retry-delay [http] delay (in seconds) between retries when fetching kernel and initrd files in the iPXE script (default "2")
-osie-url [http] URL where OSIE (HookOS) images are located
-tink-server [http] IP:Port for the Tink server
-tink-server-insecure-tls [http] use insecure TLS for Tink server (default "false")
-tink-server-tls [http] use TLS for Tink server (default "false")
-trusted-proxies [http] comma separated list of trusted proxies in CIDR notation
-otel-endpoint [otel] OpenTelemetry collector endpoint
Expand Down
42 changes: 22 additions & 20 deletions cmd/smee/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,16 +82,17 @@ type ipxeHTTPBinary struct {
}

type ipxeHTTPScript struct {
enabled bool
bindAddr string
bindPort int
extraKernelArgs string
hookURL string
tinkServer string
tinkServerUseTLS bool
trustedProxies string
retries int
retryDelay int
enabled bool
bindAddr string
bindPort int
extraKernelArgs string
hookURL string
tinkServer string
tinkServerUseTLS bool
tinkServerInsecureTLS bool
trustedProxies string
retries int
retryDelay int
}

type dhcpMode string
Expand Down Expand Up @@ -221,16 +222,17 @@ func main() {
panic(fmt.Errorf("failed to create backend: %w", err))
}
jh := script.Handler{
Logger: log,
Backend: br,
OSIEURL: cfg.ipxeHTTPScript.hookURL,
ExtraKernelParams: strings.Split(cfg.ipxeHTTPScript.extraKernelArgs, " "),
PublicSyslogFQDN: cfg.dhcp.syslogIP,
TinkServerTLS: cfg.ipxeHTTPScript.tinkServerUseTLS,
TinkServerGRPCAddr: cfg.ipxeHTTPScript.tinkServer,
IPXEScriptRetries: cfg.ipxeHTTPScript.retries,
IPXEScriptRetryDelay: cfg.ipxeHTTPScript.retryDelay,
StaticIPXEEnabled: (dhcpMode(cfg.dhcp.mode) == dhcpModeAutoProxy),
Logger: log,
Backend: br,
OSIEURL: cfg.ipxeHTTPScript.hookURL,
ExtraKernelParams: strings.Split(cfg.ipxeHTTPScript.extraKernelArgs, " "),
PublicSyslogFQDN: cfg.dhcp.syslogIP,
TinkServerTLS: cfg.ipxeHTTPScript.tinkServerUseTLS,
TinkServerInsecureTLS: cfg.ipxeHTTPScript.tinkServerInsecureTLS,
TinkServerGRPCAddr: cfg.ipxeHTTPScript.tinkServer,
IPXEScriptRetries: cfg.ipxeHTTPScript.retries,
IPXEScriptRetryDelay: cfg.ipxeHTTPScript.retryDelay,
StaticIPXEEnabled: (dhcpMode(cfg.dhcp.mode) == dhcpModeAutoProxy),
}

// serve ipxe script from the "/" URI.
Expand Down
4 changes: 2 additions & 2 deletions internal/ipxe/script/auto_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ set retry_delay:int32 3
set idx:int32 0
:retry_kernel
kernel ${download-url}/vmlinuz-${arch} tink_worker_image=quay.io/tinkerbell/tink-worker:v0.8.0 tinkerbell=packet \
facility=onprem syslog_host=1.2.3.4 grpc_authority=1.2.3.4:42113 tinkerbell_tls=false worker_id=3c:ec:ef:4c:4f:54 hw_addr=3c:ec:ef:4c:4f:54 \
facility=onprem syslog_host=1.2.3.4 grpc_authority=1.2.3.4:42113 tinkerbell_tls=false tinkerbell_insecure_tls=false worker_id=3c:ec:ef:4c:4f:54 hw_addr=3c:ec:ef:4c:4f:54 \
modules=loop,squashfs,sd-mod,usb-storage intel_iommu=on iommu=pt initrd=initramfs-${arch} console=tty0 console=ttyS1,115200 && goto download_initrd || iseq ${idx} ${retries} && goto kernel-error || inc idx && echo retry in ${retry_delay} seconds ; sleep ${retry_delay} ; goto retry_kernel

:download_initrd
Expand Down Expand Up @@ -97,7 +97,7 @@ set retry_delay:int32 3
set idx:int32 0
:retry_kernel
kernel ${download-url}/vmlinuz-${arch} vlan_id=16 tink_worker_image=quay.io/tinkerbell/tink-worker:v0.8.0 tinkerbell=packet \
facility=onprem syslog_host=1.2.3.4 grpc_authority=1.2.3.4:42113 tinkerbell_tls=false worker_id=3c:ec:ef:4c:4f:54 hw_addr=3c:ec:ef:4c:4f:54 \
facility=onprem syslog_host=1.2.3.4 grpc_authority=1.2.3.4:42113 tinkerbell_tls=false tinkerbell_insecure_tls=false worker_id=3c:ec:ef:4c:4f:54 hw_addr=3c:ec:ef:4c:4f:54 \
modules=loop,squashfs,sd-mod,usb-storage intel_iommu=on iommu=pt initrd=initramfs-${arch} console=tty0 console=ttyS1,115200 && goto download_initrd || iseq ${idx} ${retries} && goto kernel-error || inc idx && echo retry in ${retry_delay} seconds ; sleep ${retry_delay} ; goto retry_kernel

:download_initrd
Expand Down
31 changes: 16 additions & 15 deletions internal/ipxe/script/hook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ set retry_delay:int32 {{ .RetryDelay }}
set idx:int32 0
:retry_kernel
kernel ${download-url}/vmlinuz-${arch} {{- if ne .VLANID "" }} vlan_id={{ .VLANID }} {{- end }} {{- range .ExtraKernelParams}} {{.}} {{- end}} \
facility={{ .Facility }} syslog_host={{ .SyslogHost }} grpc_authority={{ .TinkGRPCAuthority }} tinkerbell_tls={{ .TinkerbellTLS }} worker_id={{ .WorkerID }} hw_addr={{ .HWAddr }} \
facility={{ .Facility }} syslog_host={{ .SyslogHost }} grpc_authority={{ .TinkGRPCAuthority }} tinkerbell_tls={{ .TinkerbellTLS }} tinkerbell_insecure_tls={{ .TinkerbellInsecureTLS }} worker_id={{ .WorkerID }} hw_addr={{ .HWAddr }} \
modules=loop,squashfs,sd-mod,usb-storage intel_iommu=on iommu=pt initrd=initramfs-${arch} console=tty0 console=ttyS1,115200 && goto download_initrd || iseq ${idx} ${retries} && goto kernel-error || inc idx && echo retry in ${retry_delay} seconds ; sleep ${retry_delay} ; goto retry_kernel

:download_initrd
Expand Down Expand Up @@ -47,18 +47,19 @@ exit

// Hook holds the values used to generate the iPXE script that loads the Hook OS.
type Hook struct {
Arch string // example x86_64
Console string // example ttyS1,115200
DownloadURL string // example https://location:8080/to/kernel/and/initrd
ExtraKernelParams []string // example tink_worker_image=quay.io/tinkerbell/tink-worker:v0.8.0
Facility string
HWAddr string // example 3c:ec:ef:4c:4f:54
SyslogHost string
TinkerbellTLS bool
TinkGRPCAuthority string // example 192.168.2.111:42113
TraceID string
VLANID string // string number between 1-4095
WorkerID string // example 3c:ec:ef:4c:4f:54 or worker1
Retries int // number of retries to attempt when fetching kernel and initrd files
RetryDelay int // number of seconds to wait between retries
Arch string // example x86_64
Console string // example ttyS1,115200
DownloadURL string // example https://location:8080/to/kernel/and/initrd
ExtraKernelParams []string // example tink_worker_image=quay.io/tinkerbell/tink-worker:v0.8.0
Facility string
HWAddr string // example 3c:ec:ef:4c:4f:54
SyslogHost string
TinkerbellTLS bool
TinkerbellInsecureTLS bool
TinkGRPCAuthority string // example 192.168.2.111:42113
TraceID string
VLANID string // string number between 1-4095
WorkerID string // example 3c:ec:ef:4c:4f:54 or worker1
Retries int // number of retries to attempt when fetching kernel and initrd files
RetryDelay int // number of seconds to wait between retries
}
48 changes: 25 additions & 23 deletions internal/ipxe/script/ipxe.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,16 +19,17 @@ import (
)

type Handler struct {
Logger logr.Logger
Backend handler.BackendReader
OSIEURL string
ExtraKernelParams []string
PublicSyslogFQDN string
TinkServerTLS bool
TinkServerGRPCAddr string
IPXEScriptRetries int
IPXEScriptRetryDelay int
StaticIPXEEnabled bool
Logger logr.Logger
Backend handler.BackendReader
OSIEURL string
ExtraKernelParams []string
PublicSyslogFQDN string
TinkServerTLS bool
TinkServerInsecureTLS bool
TinkServerGRPCAddr string
IPXEScriptRetries int
IPXEScriptRetryDelay int
StaticIPXEEnabled bool
}

type data struct {
Expand Down Expand Up @@ -258,19 +259,20 @@ func (h *Handler) defaultScript(span trace.Span, hw data) (string, error) {
}

auto := Hook{
Arch: arch,
Console: "",
DownloadURL: h.OSIEURL,
ExtraKernelParams: h.ExtraKernelParams,
Facility: hw.Facility,
HWAddr: mac.String(),
SyslogHost: h.PublicSyslogFQDN,
TinkerbellTLS: h.TinkServerTLS,
TinkGRPCAuthority: h.TinkServerGRPCAddr,
VLANID: hw.VLANID,
WorkerID: wID,
Retries: h.IPXEScriptRetries,
RetryDelay: h.IPXEScriptRetryDelay,
Arch: arch,
Console: "",
DownloadURL: h.OSIEURL,
ExtraKernelParams: h.ExtraKernelParams,
Facility: hw.Facility,
HWAddr: mac.String(),
SyslogHost: h.PublicSyslogFQDN,
TinkerbellTLS: h.TinkServerTLS,
TinkerbellInsecureTLS: h.TinkServerInsecureTLS,
TinkGRPCAuthority: h.TinkServerGRPCAddr,
VLANID: hw.VLANID,
WorkerID: wID,
Retries: h.IPXEScriptRetries,
RetryDelay: h.IPXEScriptRetryDelay,
}
if sc := span.SpanContext(); sc.IsSampled() {
auto.TraceID = sc.TraceID().String()
Expand Down
2 changes: 1 addition & 1 deletion internal/ipxe/script/ipxe_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ set retry_delay:int32 3
set idx:int32 0
:retry_kernel
kernel ${download-url}/vmlinuz-${arch} vlan_id=1234 \
facility=onprem syslog_host= grpc_authority= tinkerbell_tls=false worker_id=00:01:02:03:04:05 hw_addr=00:01:02:03:04:05 \
facility=onprem syslog_host= grpc_authority= tinkerbell_tls=false tinkerbell_insecure_tls=false worker_id=00:01:02:03:04:05 hw_addr=00:01:02:03:04:05 \
modules=loop,squashfs,sd-mod,usb-storage intel_iommu=on iommu=pt initrd=initramfs-${arch} console=tty0 console=ttyS1,115200 && goto download_initrd || iseq ${idx} ${retries} && goto kernel-error || inc idx && echo retry in ${retry_delay} seconds ; sleep ${retry_delay} ; goto retry_kernel

:download_initrd
Expand Down