mirror of https://github.com/grafana/loki
operator: Configure gateway to honor the global TLS security profile (#6870)
Mohamed-Amine Bouqsimi
3 years ago
committed by
GitHub
parent
53e01a795a
commit
a068c1241d
@ -0,0 +1,74 @@ |
|||||||
|
package tlsprofile |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
|
||||||
|
"github.com/ViaQ/logerr/v2/kverrors" |
||||||
|
projectconfigv1 "github.com/grafana/loki/operator/apis/config/v1" |
||||||
|
"github.com/grafana/loki/operator/internal/external/k8s" |
||||||
|
openshiftv1 "github.com/openshift/api/config/v1" |
||||||
|
"github.com/openshift/library-go/pkg/crypto" |
||||||
|
apierrors "k8s.io/apimachinery/pkg/api/errors" |
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client" |
||||||
|
) |
||||||
|
|
||||||
|
// APIServerName is the apiserver resource name used to fetch it.
|
||||||
|
const APIServerName = "cluster" |
||||||
|
|
||||||
|
// GetSecurityProfileInfo gets the tls profile info to apply.
|
||||||
|
func GetSecurityProfileInfo(ctx context.Context, k k8s.Client, tlsProfileType projectconfigv1.TLSProfileType) (projectconfigv1.TLSProfileSpec, error) { |
||||||
|
var tlsProfile openshiftv1.TLSSecurityProfile |
||||||
|
|
||||||
|
if tlsProfileType != "" { |
||||||
|
tlsProfile = openshiftv1.TLSSecurityProfile{ |
||||||
|
Type: openshiftv1.TLSProfileType(tlsProfileType), |
||||||
|
} |
||||||
|
} else { |
||||||
|
tlsProfile = openshiftv1.TLSSecurityProfile{ |
||||||
|
Type: openshiftv1.TLSProfileIntermediateType, |
||||||
|
} |
||||||
|
|
||||||
|
var apiServer openshiftv1.APIServer |
||||||
|
if err := k.Get(ctx, client.ObjectKey{Name: APIServerName}, &apiServer); err != nil { |
||||||
|
if !apierrors.IsNotFound(err) { |
||||||
|
return projectconfigv1.TLSProfileSpec{}, kverrors.Wrap(err, "failed to lookup apiServer") |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
if apiServer.Spec.TLSSecurityProfile != nil { |
||||||
|
tlsProfile = *apiServer.Spec.TLSSecurityProfile |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
tlsMinVersion, ciphers := extractInfoFromTLSProfile(&tlsProfile) |
||||||
|
return projectconfigv1.TLSProfileSpec{ |
||||||
|
MinTLSVersion: tlsMinVersion, |
||||||
|
Ciphers: ciphers, |
||||||
|
}, nil |
||||||
|
} |
||||||
|
|
||||||
|
func extractInfoFromTLSProfile(profile *openshiftv1.TLSSecurityProfile) (string, []string) { |
||||||
|
var profileType openshiftv1.TLSProfileType |
||||||
|
if profile == nil { |
||||||
|
profileType = openshiftv1.TLSProfileIntermediateType |
||||||
|
} else { |
||||||
|
profileType = profile.Type |
||||||
|
} |
||||||
|
|
||||||
|
var profileSpec *openshiftv1.TLSProfileSpec |
||||||
|
if profileType == openshiftv1.TLSProfileCustomType { |
||||||
|
if profile.Custom != nil { |
||||||
|
profileSpec = &profile.Custom.TLSProfileSpec |
||||||
|
} |
||||||
|
} else { |
||||||
|
profileSpec = openshiftv1.TLSProfiles[profileType] |
||||||
|
} |
||||||
|
|
||||||
|
// nothing found / custom type set but no actual custom spec
|
||||||
|
if profileSpec == nil { |
||||||
|
profileSpec = openshiftv1.TLSProfiles[openshiftv1.TLSProfileIntermediateType] |
||||||
|
} |
||||||
|
|
||||||
|
// need to remap all Ciphers to their respective IANA names used by Go
|
||||||
|
return string(profileSpec.MinTLSVersion), crypto.OpenSSLToIANACipherSuites(profileSpec.Ciphers) |
||||||
|
} |
||||||
@ -0,0 +1,114 @@ |
|||||||
|
package tlsprofile_test |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"testing" |
||||||
|
|
||||||
|
projectconfigv1 "github.com/grafana/loki/operator/apis/config/v1" |
||||||
|
"github.com/grafana/loki/operator/internal/external/k8s/k8sfakes" |
||||||
|
"github.com/grafana/loki/operator/internal/handlers/internal/tlsprofile" |
||||||
|
openshiftv1 "github.com/openshift/api/config/v1" |
||||||
|
"github.com/stretchr/testify/assert" |
||||||
|
apierrors "k8s.io/apimachinery/pkg/api/errors" |
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
||||||
|
"k8s.io/apimachinery/pkg/runtime/schema" |
||||||
|
"k8s.io/apimachinery/pkg/types" |
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client" |
||||||
|
) |
||||||
|
|
||||||
|
var ( |
||||||
|
apiServer = openshiftv1.APIServer{ |
||||||
|
ObjectMeta: metav1.ObjectMeta{ |
||||||
|
Name: "cluster", |
||||||
|
}, |
||||||
|
} |
||||||
|
ciphersOld = []string{ |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", |
||||||
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", |
||||||
|
"TLS_RSA_WITH_AES_128_GCM_SHA256", |
||||||
|
"TLS_RSA_WITH_AES_256_GCM_SHA384", |
||||||
|
"TLS_RSA_WITH_AES_128_CBC_SHA256", |
||||||
|
"TLS_RSA_WITH_AES_128_CBC_SHA", |
||||||
|
"TLS_RSA_WITH_AES_256_CBC_SHA", |
||||||
|
"TLS_RSA_WITH_3DES_EDE_CBC_SHA", |
||||||
|
} |
||||||
|
ciphersIntermediate = []string{ |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", |
||||||
|
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", |
||||||
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", |
||||||
|
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", |
||||||
|
} |
||||||
|
) |
||||||
|
|
||||||
|
func TestGetSecurityProfileInfo(t *testing.T) { |
||||||
|
type tt struct { |
||||||
|
desc string |
||||||
|
profile projectconfigv1.TLSProfileType |
||||||
|
expected projectconfigv1.TLSProfileSpec |
||||||
|
} |
||||||
|
|
||||||
|
tc := []tt{ |
||||||
|
{ |
||||||
|
desc: "Old profile", |
||||||
|
profile: projectconfigv1.TLSProfileOldType, |
||||||
|
expected: projectconfigv1.TLSProfileSpec{ |
||||||
|
MinTLSVersion: "VersionTLS10", |
||||||
|
Ciphers: ciphersOld, |
||||||
|
}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
desc: "Intermediate profile", |
||||||
|
profile: projectconfigv1.TLSProfileIntermediateType, |
||||||
|
expected: projectconfigv1.TLSProfileSpec{ |
||||||
|
MinTLSVersion: "VersionTLS12", |
||||||
|
Ciphers: ciphersIntermediate, |
||||||
|
}, |
||||||
|
}, |
||||||
|
{ |
||||||
|
desc: "Modern profile", |
||||||
|
profile: projectconfigv1.TLSProfileModernType, |
||||||
|
expected: projectconfigv1.TLSProfileSpec{ |
||||||
|
MinTLSVersion: "VersionTLS13", |
||||||
|
// Go lib crypto doesn't allow ciphers to be configured for TLS 1.3
|
||||||
|
// (Read this and weep: https://github.com/golang/go/issues/29349)
|
||||||
|
Ciphers: []string{}, |
||||||
|
}, |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
sw := &k8sfakes.FakeStatusWriter{} |
||||||
|
k := &k8sfakes.FakeClient{} |
||||||
|
|
||||||
|
k.GetStub = func(_ context.Context, name types.NamespacedName, object client.Object) error { |
||||||
|
if apiServer.Name == name.Name { |
||||||
|
k.SetClientObject(object, &apiServer) |
||||||
|
return nil |
||||||
|
} |
||||||
|
return apierrors.NewNotFound(schema.GroupResource{}, "something wasn't found") |
||||||
|
} |
||||||
|
|
||||||
|
k.StatusStub = func() client.StatusWriter { return sw } |
||||||
|
|
||||||
|
for _, tc := range tc { |
||||||
|
tc := tc |
||||||
|
t.Run(tc.desc, func(t *testing.T) { |
||||||
|
t.Parallel() |
||||||
|
info, err := tlsprofile.GetSecurityProfileInfo(context.TODO(), k, tc.profile) |
||||||
|
assert.Nil(t, err) |
||||||
|
assert.NotNil(t, info) |
||||||
|
assert.EqualValues(t, tc.expected, info) |
||||||
|
}) |
||||||
|
} |
||||||
|
} |
||||||
Loading…
Reference in new issue