mirror of https://github.com/hashicorp/consul
Browse Source
* Define file-system-certificate config entry * Collect file-system-certificate(s) referenced by api-gateway onto snapshot * Add file-system-certificate to config entry kind allow lists * Remove inapplicable validation This validation makes sense for inline certificates since Consul server is holding the certificate; however, for file system certificates, Consul server never actually sees the certificate. * Support file-system-certificate as source for listener TLS certificate * Add more required mappings for the new config entry type * Construct proper TLS context based on certificate kind * Add support or SDS in xdscommon * Remove unused param * Adds back verification of certs for inline-certificates * Undo tangential changes to TLS config consumption * Remove stray curly braces * Undo some more tangential changes * Improve function name for generating API gateway secrets * Add changelog entry * Update .changelog/20873.txt Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Add some nil-checking, remove outdated TODO * Update test assertions to include file-system-certificate * Add documentation for file-system-certificate config entry Add new doc to nav * Fix grammar mistake * Rename watchmaps, remove outdated TODO --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com> Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>pull/20984/head
Nathan Coleman
7 months ago
committed by
GitHub
37 changed files with 2838 additions and 2169 deletions
@ -0,0 +1,3 @@
|
||||
```release-note:feature |
||||
gateways: api-gateway can leverage listener TLS certificates available on the gateway's local filesystem by specifying the public certificate and private key path in the new file-system-certificate configuration entry |
||||
``` |
||||
@ -0,0 +1,73 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package structs |
||||
|
||||
import ( |
||||
"github.com/hashicorp/consul/acl" |
||||
) |
||||
|
||||
// FileSystemCertificateConfigEntry manages the configuration for a certificate
|
||||
// and private key located in the local file system.
|
||||
type FileSystemCertificateConfigEntry struct { |
||||
// Kind of config entry. This will be set to structs.FileSystemCertificate.
|
||||
Kind string |
||||
|
||||
// Name is used to match the config entry with its associated file system certificate.
|
||||
Name string |
||||
|
||||
// Certificate is the optional path to a client certificate to use for TLS connections.
|
||||
Certificate string |
||||
|
||||
// PrivateKey is the optional path to a private key to use for TLS connections.
|
||||
PrivateKey string |
||||
|
||||
Meta map[string]string `json:",omitempty"` |
||||
Hash uint64 `json:",omitempty" hash:"ignore"` |
||||
acl.EnterpriseMeta `hcl:",squash" mapstructure:",squash"` |
||||
RaftIndex `hash:"ignore"` |
||||
} |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) SetHash(h uint64) { |
||||
e.Hash = h |
||||
} |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) GetHash() uint64 { |
||||
return e.Hash |
||||
} |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) GetKind() string { return FileSystemCertificate } |
||||
func (e *FileSystemCertificateConfigEntry) GetName() string { return e.Name } |
||||
func (e *FileSystemCertificateConfigEntry) Normalize() error { |
||||
h, err := HashConfigEntry(e) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
e.Hash = h |
||||
return nil |
||||
} |
||||
func (e *FileSystemCertificateConfigEntry) GetMeta() map[string]string { return e.Meta } |
||||
func (e *FileSystemCertificateConfigEntry) GetEnterpriseMeta() *acl.EnterpriseMeta { |
||||
return &e.EnterpriseMeta |
||||
} |
||||
func (e *FileSystemCertificateConfigEntry) GetRaftIndex() *RaftIndex { return &e.RaftIndex } |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) Validate() error { |
||||
return validateConfigEntryMeta(e.Meta) |
||||
} |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) Hosts() ([]string, error) { |
||||
return []string{}, nil |
||||
} |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) CanRead(authz acl.Authorizer) error { |
||||
var authzContext acl.AuthorizerContext |
||||
e.FillAuthzContext(&authzContext) |
||||
return authz.ToAllowAuthorizer().MeshReadAllowed(&authzContext) |
||||
} |
||||
|
||||
func (e *FileSystemCertificateConfigEntry) CanWrite(authz acl.Authorizer) error { |
||||
var authzContext acl.AuthorizerContext |
||||
e.FillAuthzContext(&authzContext) |
||||
return authz.ToAllowAuthorizer().MeshWriteAllowed(&authzContext) |
||||
} |
||||
@ -0,0 +1,44 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package api |
||||
|
||||
type FileSystemCertificateConfigEntry struct { |
||||
// Kind of the config entry. This should be set to api.FileSystemCertificate.
|
||||
Kind string |
||||
|
||||
Name string |
||||
|
||||
// Certificate is the path to a client certificate to use for TLS connections.
|
||||
Certificate string `json:",omitempty" alias:"certificate"` |
||||
|
||||
// PrivateKey is the path to a private key to use for TLS connections.
|
||||
PrivateKey string `json:",omitempty" alias:"private_key"` |
||||
|
||||
Meta map[string]string `json:",omitempty"` |
||||
|
||||
// CreateIndex is the Raft index this entry was created at. This is a
|
||||
// read-only field.
|
||||
CreateIndex uint64 |
||||
|
||||
// ModifyIndex is used for the Check-And-Set operations and can also be fed
|
||||
// back into the WaitIndex of the QueryOptions in order to perform blocking
|
||||
// queries.
|
||||
ModifyIndex uint64 |
||||
|
||||
// Partition is the partition the config entry is associated with.
|
||||
// Partitioning is a Consul Enterprise feature.
|
||||
Partition string `json:",omitempty"` |
||||
|
||||
// Namespace is the namespace the config entry is associated with.
|
||||
// Namespacing is a Consul Enterprise feature.
|
||||
Namespace string `json:",omitempty"` |
||||
} |
||||
|
||||
func (a *FileSystemCertificateConfigEntry) GetKind() string { return FileSystemCertificate } |
||||
func (a *FileSystemCertificateConfigEntry) GetName() string { return a.Name } |
||||
func (a *FileSystemCertificateConfigEntry) GetPartition() string { return a.Partition } |
||||
func (a *FileSystemCertificateConfigEntry) GetNamespace() string { return a.Namespace } |
||||
func (a *FileSystemCertificateConfigEntry) GetMeta() map[string]string { return a.Meta } |
||||
func (a *FileSystemCertificateConfigEntry) GetCreateIndex() uint64 { return a.CreateIndex } |
||||
func (a *FileSystemCertificateConfigEntry) GetModifyIndex() uint64 { return a.ModifyIndex } |
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,127 @@
|
||||
--- |
||||
layout: docs |
||||
page_title: File System Certificate Configuration Reference |
||||
description: Learn how to configure a file system certificate bound to an API Gateway on VMs. |
||||
--- |
||||
|
||||
# File system certificate configuration reference |
||||
|
||||
This topic provides reference information for the gateway file system certificate |
||||
configuration entry. For information about certificate configuration for Kubernetes environments, refer to [Gateway Resource Configuration](/consul/docs/connect/gateways/api-gateway/configuration/gateway). |
||||
|
||||
## Configuration model |
||||
|
||||
The following list outlines field hierarchy, language-specific data types, and |
||||
requirements in a `file-system-certificate` configuration entry. Click on a property name |
||||
to view additional details, including default values. |
||||
|
||||
- [`Kind`](#kind): string | must be `"file-system-certificate"` |
||||
- [`Name`](#name): string | no default |
||||
- [`Namespace`](#namespace): string | no default <EnterpriseAlert inline /> |
||||
- [`Partition`](#partition): string | no default <EnterpriseAlert inline /> |
||||
- [`Meta`](#meta): map | no default |
||||
- [`Certificate`](#certificate): string | no default |
||||
- [`PrivateKey`](#privatekey): string | no default |
||||
|
||||
## Complete configuration |
||||
|
||||
When every field is defined, a `file-system-certificate` configuration entry has the following form: |
||||
|
||||
<CodeTabs> |
||||
|
||||
```HCL |
||||
Kind = "file-system-certificate" |
||||
Name = "<name of certificate>" |
||||
|
||||
Meta = { |
||||
"<any key>" = "<any value>" |
||||
} |
||||
|
||||
Certificate = "<filepath to public certificate>" |
||||
PrivateKey = "<filepath to private key>" |
||||
``` |
||||
|
||||
```JSON |
||||
{ |
||||
"Kind": "file-system-certificate", |
||||
"Name": "<name of certificate>", |
||||
"Meta": { |
||||
"any key": "any value" |
||||
} |
||||
"Certificate": "<filepath to public certificate>", |
||||
"PrivateKey": "<filepath to private key>" |
||||
} |
||||
``` |
||||
|
||||
</CodeTabs> |
||||
|
||||
## Specification |
||||
|
||||
### `Kind` |
||||
|
||||
Specifies the type of configuration entry to implement. |
||||
|
||||
#### Values |
||||
|
||||
- Default: none |
||||
- This field is required. |
||||
- Data type: string that must equal `"file-system-certificate"` |
||||
|
||||
### `Name` |
||||
|
||||
Specifies a name for the configuration entry. The name is metadata that you can |
||||
use to reference the configuration entry when performing Consul operations, such |
||||
as applying a configuration entry to a specific cluster. |
||||
|
||||
#### Values |
||||
|
||||
- Default: none |
||||
- This field is required. |
||||
- Data type: string |
||||
|
||||
### `Namespace` <EnterpriseAlert inline /> |
||||
|
||||
Specifies the Enterprise [namespace](/consul/docs/enterprise/namespaces) to apply to the configuration entry. |
||||
|
||||
#### Values |
||||
|
||||
- Default: `"default"` in Enterprise |
||||
- Data type: string |
||||
|
||||
### `Partition` <EnterpriseAlert inline /> |
||||
|
||||
Specifies the Enterprise [admin partition](/consul/docs/enterprise/admin-partitions) to apply to the configuration entry. |
||||
|
||||
#### Values |
||||
|
||||
- Default: `"default"` in Enterprise |
||||
- Data type: string |
||||
|
||||
### `Meta` |
||||
|
||||
Specifies an arbitrary set of key-value pairs to associate with the gateway. |
||||
|
||||
#### Values |
||||
|
||||
- Default: none |
||||
- Data type: map containing one or more keys and string values. |
||||
|
||||
### `Certificate` |
||||
|
||||
Specifies the filepath to a public certificate to use for TLS. This filepath must be accessible to the API gateway proxy at runtime. |
||||
|
||||
#### Values |
||||
|
||||
- Default: none |
||||
- This field is required. |
||||
- Data type: string value of the filepath to a public certificate |
||||
|
||||
### `PrivateKey` |
||||
|
||||
Specifies the filepath to a private key to use for TLS. This filepath must be accessible to the API gateway proxy at runtime. |
||||
|
||||
#### Values |
||||
|
||||
- Default: none |
||||
- This field is required. |
||||
- Data type: string value of the filepath to a private key |
||||
Loading…
Reference in new issue