Added trigger go code and executable

This is a trigger activation implementation that is added to the container for in container key-gen activation. This is intended to replace the key-gen endpoint for access restriction to the trigger. Change involves adding a second port opened by server.go that should not be opened to the outside world. Also a new trigger file is added to the makefile and copied into the controller image.
adevhammer · Feb 18, 2019 · 9be04e4 · 9be04e4
1 parent 69199c9
commit 9be04e4
Show file tree

Hide file tree

Showing 6 changed files with 54 additions and 3 deletions.
diff --git a/Makefile b/Makefile
@@ -31,14 +31,17 @@ endif
 
 GO_LD_FLAGS = -X main.VERSION=$(VERSION)
 
-all: controller kubeseal
+all: controller trigger kubeseal
 
 generate: $(GO_FILES)
 	$(GO) generate $(GO_PACKAGES)
 
 controller: $(GO_FILES)
 	$(GO) build -o $@ $(GO_FLAGS) -ldflags "$(GO_LD_FLAGS)" ./cmd/controller
 
+trigger: $(GO_FILES)
+	$(GO) build -o $@ $(GO_FLAGS) -ldflags "$(GO_LD_FLAGS)" ./cmd/trigger
+
 kubeseal: $(GO_FILES)
 	$(GO) build -o $@ $(GO_FLAGS) -ldflags "$(GO_LD_FLAGS)" ./cmd/kubeseal
 
@@ -48,7 +51,10 @@ kubeseal: $(GO_FILES)
 docker/controller: controller-static
 	cp $< $@
 
-controller.image: docker/Dockerfile docker/controller
+docker/trigger: trigger-static
+	cp $< $@
+
+controller.image: docker/Dockerfile docker/controller docker/trigger
 	$(DOCKER) build -t $(CONTROLLER_IMAGE) docker/
 	echo $(CONTROLLER_IMAGE) >$@.tmp
 	mv $@.tmp $@
@@ -77,7 +83,7 @@ fmt:
 	$(GOFMT) -s -w $(GO_FILES)
 
 clean:
-	$(RM) ./controller ./kubeseal
+	$(RM) ./controller ./kubeseal ./trigger
 	$(RM) *-static
 	$(RM) controller*.yaml
 	$(RM) docker/controller

diff --git a/cmd/controller/main.go b/cmd/controller/main.go
@@ -289,6 +289,11 @@ func main2() error {
 	cnp := func() (string, error) {
 		return keyRegistry.CurrentKeyName(), nil
 	}
+	close, err := triggerserver(keyGenTrigger)
+	if err != nil {
+		return err
+	}
+	defer close()
 	go httpserver(cp, cnp, controller.AttemptUnseal, controller.Rotate, keyGenTrigger)
 
 	sigterm := make(chan os.Signal, 1)

diff --git a/cmd/controller/server.go b/cmd/controller/server.go
@@ -5,7 +5,9 @@ import (
 	"io"
 	"io/ioutil"
 	"log"
+	"net"
 	"net/http"
+	"net/rpc"
 	"time"
 
 	flag "github.com/spf13/pflag"
@@ -15,6 +17,7 @@ import (
 )
 
 var (
+	triggerAddr  = flag.String("trigger-addr", ":8081", "trigger rpc serving address.")
 	listenAddr   = flag.String("listen-addr", ":8080", "HTTP serving address.")
 	readTimeout  = flag.Duration("read-timeout", 2*time.Minute, "HTTP request timeout.")
 	writeTimeout = flag.Duration("write-timeout", 2*time.Minute, "HTTP response timeout.")
@@ -25,8 +28,26 @@ type certProvider func(keyname string) ([]*x509.Certificate, error)
 type certNameProvider func() (string, error)
 type secretChecker func([]byte) (bool, error)
 type secretRotator func([]byte) ([]byte, error)
+
+// Called when needing to generate a new key on demand
 type keyGenTrigger func()
 
+func (t keyGenTrigger) Trigger(struct{}, *struct{}) error {
+	t()
+	return nil
+}
+
+func triggerserver(kg keyGenTrigger) (func() error, error) {
+	lis, err := net.Listen("tcp", *triggerAddr)
+	if err != nil {
+		return nil, err
+	}
+	server := rpc.NewServer()
+	server.RegisterName("trigger", kg)
+	go server.Accept(lis)
+	return lis.Close, nil
+}
+
 func httpserver(cp certProvider, cnp certNameProvider, sc secretChecker, sr secretRotator, kg keyGenTrigger) {
 	httpRateLimiter := rateLimter()
 

diff --git a/cmd/trigger/main.go b/cmd/trigger/main.go
@@ -0,0 +1,17 @@
+package main
+
+import (
+	"net"
+	"net/rpc"
+)
+
+func main() {
+	conn, err := net.Dial("tcp", ":8081")
+	if err != nil {
+		panic(err)
+	}
+	client := rpc.NewClient(conn)
+	if err = client.Call("trigger.Trigger", struct{}{}, &struct{}{}); err != nil {
+		panic(err)
+	}
+}
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -1,6 +1,8 @@
 FROM alpine
 MAINTAINER Angus Lees <gus@inodes.org>
 COPY controller /usr/local/bin/
+COPY trigger /usr/local/bin/
 
 EXPOSE 8080
+EXPOSE 8081
 ENTRYPOINT ["controller"]
diff --git a/docker/trigger b/docker/trigger