mirror of https://github.com/hashicorp/consul
Browse Source
* Define file-system-certificate config entry * Collect file-system-certificate(s) referenced by api-gateway onto snapshot * Add file-system-certificate to config entry kind allow lists * Remove inapplicable validation This validation makes sense for inline certificates since Consul server is holding the certificate; however, for file system certificates, Consul server never actually sees the certificate. * Support file-system-certificate as source for listener TLS certificate * Add more required mappings for the new config entry type * Construct proper TLS context based on certificate kind * Add support or SDS in xdscommon * Remove unused param * Adds back verification of certs for inline-certificates * Undo tangential changes to TLS config consumption * Remove stray curly braces * Undo some more tangential changes * Improve function name for generating API gateway secrets * Add changelog entry * Update .changelog/20873.txt Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Add some nil-checking, remove outdated TODO * Update test assertions to include file-system-certificate * Add documentation for file-system-certificate config entry Add new doc to nav * Fix grammar mistake * Rename watchmaps, remove outdated TODO --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com> Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>pull/20984/head
Nathan Coleman
7 months ago
committed by
GitHub
37 changed files with 2838 additions and 2169 deletions
@ -0,0 +1,3 @@ |
|||||||
|
```release-note:feature |
||||||
|
gateways: api-gateway can leverage listener TLS certificates available on the gateway's local filesystem by specifying the public certificate and private key path in the new file-system-certificate configuration entry |
||||||
|
``` |
||||||
@ -0,0 +1,73 @@ |
|||||||
|
// Copyright (c) HashiCorp, Inc.
|
||||||
|
// SPDX-License-Identifier: BUSL-1.1
|
||||||
|
|
||||||
|
package structs |
||||||
|
|
||||||
|
import ( |
||||||
|
"github.com/hashicorp/consul/acl" |
||||||
|
) |
||||||
|
|
||||||
|
// FileSystemCertificateConfigEntry manages the configuration for a certificate
|
||||||
|
// and private key located in the local file system.
|
||||||
|
type FileSystemCertificateConfigEntry struct { |
||||||
|
// Kind of config entry. This will be set to structs.FileSystemCertificate.
|
||||||
|
Kind string |
||||||
|
|
||||||
|
// Name is used to match the config entry with its associated file system certificate.
|
||||||
|
Name string |
||||||
|
|
||||||
|
// Certificate is the optional path to a client certificate to use for TLS connections.
|
||||||
|
Certificate string |
||||||
|
|
||||||
|
// PrivateKey is the optional path to a private key to use for TLS connections.
|
||||||
|
PrivateKey string |
||||||
|
|
||||||
|
Meta map[string]string `json:",omitempty"` |
||||||
|
Hash uint64 `json:",omitempty" hash:"ignore"` |
||||||
|
acl.EnterpriseMeta `hcl:",squash" mapstructure:",squash"` |
||||||
|
RaftIndex `hash:"ignore"` |
||||||
|
} |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) SetHash(h uint64) { |
||||||
|
e.Hash = h |
||||||
|
} |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) GetHash() uint64 { |
||||||
|
return e.Hash |
||||||
|
} |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) GetKind() string { return FileSystemCertificate } |
||||||
|
func (e *FileSystemCertificateConfigEntry) GetName() string { return e.Name } |
||||||
|
func (e *FileSystemCertificateConfigEntry) Normalize() error { |
||||||
|
h, err := HashConfigEntry(e) |
||||||
|
if err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
e.Hash = h |
||||||
|
return nil |
||||||
|
} |
||||||
|
func (e *FileSystemCertificateConfigEntry) GetMeta() map[string]string { return e.Meta } |
||||||
|
func (e *FileSystemCertificateConfigEntry) GetEnterpriseMeta() *acl.EnterpriseMeta { |
||||||
|
return &e.EnterpriseMeta |
||||||
|
} |
||||||
|
func (e *FileSystemCertificateConfigEntry) GetRaftIndex() *RaftIndex { return &e.RaftIndex } |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) Validate() error { |
||||||
|
return validateConfigEntryMeta(e.Meta) |
||||||
|
} |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) Hosts() ([]string, error) { |
||||||
|
return []string{}, nil |
||||||
|
} |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) CanRead(authz acl.Authorizer) error { |
||||||
|
var authzContext acl.AuthorizerContext |
||||||
|
e.FillAuthzContext(&authzContext) |
||||||
|
return authz.ToAllowAuthorizer().MeshReadAllowed(&authzContext) |
||||||
|
} |
||||||
|
|
||||||
|
func (e *FileSystemCertificateConfigEntry) CanWrite(authz acl.Authorizer) error { |
||||||
|
var authzContext acl.AuthorizerContext |
||||||
|
e.FillAuthzContext(&authzContext) |
||||||
|
return authz.ToAllowAuthorizer().MeshWriteAllowed(&authzContext) |
||||||
|
} |
||||||
@ -0,0 +1,44 @@ |
|||||||
|
// Copyright (c) HashiCorp, Inc.
|
||||||
|
// SPDX-License-Identifier: MPL-2.0
|
||||||
|
|
||||||
|
package api |
||||||
|
|
||||||
|
type FileSystemCertificateConfigEntry struct { |
||||||
|
// Kind of the config entry. This should be set to api.FileSystemCertificate.
|
||||||
|
Kind string |
||||||
|
|
||||||
|
Name string |
||||||
|
|
||||||
|
// Certificate is the path to a client certificate to use for TLS connections.
|
||||||
|
Certificate string `json:",omitempty" alias:"certificate"` |
||||||
|
|
||||||
|
// PrivateKey is the path to a private key to use for TLS connections.
|
||||||
|
PrivateKey string `json:",omitempty" alias:"private_key"` |
||||||
|
|
||||||
|
Meta map[string]string `json:",omitempty"` |
||||||
|
|
||||||
|
// CreateIndex is the Raft index this entry was created at. This is a
|
||||||
|
// read-only field.
|
||||||
|
CreateIndex uint64 |
||||||
|
|
||||||
|
// ModifyIndex is used for the Check-And-Set operations and can also be fed
|
||||||
|
// back into the WaitIndex of the QueryOptions in order to perform blocking
|
||||||
|
// queries.
|
||||||
|
ModifyIndex uint64 |
||||||
|
|
||||||
|
// Partition is the partition the config entry is associated with.
|
||||||
|
// Partitioning is a Consul Enterprise feature.
|
||||||
|
Partition string `json:",omitempty"` |
||||||
|
|
||||||
|
// Namespace is the namespace the config entry is associated with.
|
||||||
|
// Namespacing is a Consul Enterprise feature.
|
||||||
|
Namespace string `json:",omitempty"` |
||||||
|
} |
||||||
|
|
||||||
|
func (a *FileSystemCertificateConfigEntry) GetKind() string { return FileSystemCertificate } |
||||||
|
func (a *FileSystemCertificateConfigEntry) GetName() string { return a.Name } |
||||||
|
func (a *FileSystemCertificateConfigEntry) GetPartition() string { return a.Partition } |
||||||
|
func (a *FileSystemCertificateConfigEntry) GetNamespace() string { return a.Namespace } |
||||||
|
func (a *FileSystemCertificateConfigEntry) GetMeta() map[string]string { return a.Meta } |
||||||
|
func (a *FileSystemCertificateConfigEntry) GetCreateIndex() uint64 { return a.CreateIndex } |
||||||
|
func (a *FileSystemCertificateConfigEntry) GetModifyIndex() uint64 { return a.ModifyIndex } |
||||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,127 @@ |
|||||||
|
--- |
||||||
|
layout: docs |
||||||
|
page_title: File System Certificate Configuration Reference |
||||||
|
description: Learn how to configure a file system certificate bound to an API Gateway on VMs. |
||||||
|
--- |
||||||
|
|
||||||
|
# File system certificate configuration reference |
||||||
|
|
||||||
|
This topic provides reference information for the gateway file system certificate |
||||||
|
configuration entry. For information about certificate configuration for Kubernetes environments, refer to [Gateway Resource Configuration](/consul/docs/connect/gateways/api-gateway/configuration/gateway). |
||||||
|
|
||||||
|
## Configuration model |
||||||
|
|
||||||
|
The following list outlines field hierarchy, language-specific data types, and |
||||||
|
requirements in a `file-system-certificate` configuration entry. Click on a property name |
||||||
|
to view additional details, including default values. |
||||||
|
|
||||||
|
- [`Kind`](#kind): string | must be `"file-system-certificate"` |
||||||
|
- [`Name`](#name): string | no default |
||||||
|
- [`Namespace`](#namespace): string | no default <EnterpriseAlert inline /> |
||||||
|
- [`Partition`](#partition): string | no default <EnterpriseAlert inline /> |
||||||
|
- [`Meta`](#meta): map | no default |
||||||
|
- [`Certificate`](#certificate): string | no default |
||||||
|
- [`PrivateKey`](#privatekey): string | no default |
||||||
|
|
||||||
|
## Complete configuration |
||||||
|
|
||||||
|
When every field is defined, a `file-system-certificate` configuration entry has the following form: |
||||||
|
|
||||||
|
<CodeTabs> |
||||||
|
|
||||||
|
```HCL |
||||||
|
Kind = "file-system-certificate" |
||||||
|
Name = "<name of certificate>" |
||||||
|
|
||||||
|
Meta = { |
||||||
|
"<any key>" = "<any value>" |
||||||
|
} |
||||||
|
|
||||||
|
Certificate = "<filepath to public certificate>" |
||||||
|
PrivateKey = "<filepath to private key>" |
||||||
|
``` |
||||||
|
|
||||||
|
```JSON |
||||||
|
{ |
||||||
|
"Kind": "file-system-certificate", |
||||||
|
"Name": "<name of certificate>", |
||||||
|
"Meta": { |
||||||
|
"any key": "any value" |
||||||
|
} |
||||||
|
"Certificate": "<filepath to public certificate>", |
||||||
|
"PrivateKey": "<filepath to private key>" |
||||||
|
} |
||||||
|
``` |
||||||
|
|
||||||
|
</CodeTabs> |
||||||
|
|
||||||
|
## Specification |
||||||
|
|
||||||
|
### `Kind` |
||||||
|
|
||||||
|
Specifies the type of configuration entry to implement. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: none |
||||||
|
- This field is required. |
||||||
|
- Data type: string that must equal `"file-system-certificate"` |
||||||
|
|
||||||
|
### `Name` |
||||||
|
|
||||||
|
Specifies a name for the configuration entry. The name is metadata that you can |
||||||
|
use to reference the configuration entry when performing Consul operations, such |
||||||
|
as applying a configuration entry to a specific cluster. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: none |
||||||
|
- This field is required. |
||||||
|
- Data type: string |
||||||
|
|
||||||
|
### `Namespace` <EnterpriseAlert inline /> |
||||||
|
|
||||||
|
Specifies the Enterprise [namespace](/consul/docs/enterprise/namespaces) to apply to the configuration entry. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: `"default"` in Enterprise |
||||||
|
- Data type: string |
||||||
|
|
||||||
|
### `Partition` <EnterpriseAlert inline /> |
||||||
|
|
||||||
|
Specifies the Enterprise [admin partition](/consul/docs/enterprise/admin-partitions) to apply to the configuration entry. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: `"default"` in Enterprise |
||||||
|
- Data type: string |
||||||
|
|
||||||
|
### `Meta` |
||||||
|
|
||||||
|
Specifies an arbitrary set of key-value pairs to associate with the gateway. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: none |
||||||
|
- Data type: map containing one or more keys and string values. |
||||||
|
|
||||||
|
### `Certificate` |
||||||
|
|
||||||
|
Specifies the filepath to a public certificate to use for TLS. This filepath must be accessible to the API gateway proxy at runtime. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: none |
||||||
|
- This field is required. |
||||||
|
- Data type: string value of the filepath to a public certificate |
||||||
|
|
||||||
|
### `PrivateKey` |
||||||
|
|
||||||
|
Specifies the filepath to a private key to use for TLS. This filepath must be accessible to the API gateway proxy at runtime. |
||||||
|
|
||||||
|
#### Values |
||||||
|
|
||||||
|
- Default: none |
||||||
|
- This field is required. |
||||||
|
- Data type: string value of the filepath to a private key |
||||||
Loading…
Reference in new issue