feat(worker): save workerAuth request to a file

internal/cmd/base/servers.go

@@ -10,6 +10,7 @@ import (
 	"net"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
@@ -61,6 +62,9 @@ const (
 	// TODO: This value is temporary, it will be removed once we have a better
 	// story/direction on attributes and system defaults.
 	statusGracePeriodEnvVar = "BOUNDARY_STATUS_GRACE_PERIOD"
+
+	// File name to use for storing workerAuth requests
+	WorkerAuthReqFile = "auth_request_token"
 )
 
 func init() {
@@ -342,6 +346,29 @@ func (b *Server) RemovePidFile(pidPath string) error {
 	return os.Remove(pidPath)
 }
 
+func (b *Server) StoreWorkerAuthReq(authReq, workerAuthReqPath string) error {
+	// Quit fast if no workerAuthReqFile
+	if workerAuthReqPath == "" {
+		return nil
+	}
+	workerAuthReqFilePath := filepath.Join(workerAuthReqPath, WorkerAuthReqFile)
+
+	// Open the workerAuthReq file
+	workerAuthReqFile, err := os.OpenFile(workerAuthReqFilePath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o640)
+	if err != nil {
+		return fmt.Errorf("could not open file for worker auth request: %w", err)
+	}
+	defer workerAuthReqFile.Close()
+
+	// Write out the workerAuthRequest
+	_, err = workerAuthReqFile.WriteString(authReq)
+	if err != nil {
+		return fmt.Errorf("could not write to file for worker auth request: %w", err)
+	}
+
+	return nil
+}
+
 func (b *Server) PrintInfo(ui cli.Ui) {
 	verInfo := version.Get()
 	if verInfo.Version != "" {

internal/cmd/commands/dev/dev.go

@@ -718,6 +718,19 @@ func (c *Command) Run(args []string) int {
 			c.Info["worker auth current key id"] = c.worker.WorkerAuthCurrentKeyId
 			c.InfoKeys = append(c.InfoKeys, "worker auth storage path")
 			c.Info["worker auth storage path"] = c.worker.WorkerAuthStorage.BaseDir()
+			if err := c.StoreWorkerAuthReq(c.worker.WorkerAuthRegistrationRequest, c.worker.WorkerAuthStorage.BaseDir()); err != nil {
+				// Shutdown on failure
+				retErr := fmt.Errorf("Error storing worker auth request: %w", err)
+				if err := c.worker.Shutdown(); err != nil {
+					c.UI.Error(retErr.Error())
+					retErr = fmt.Errorf("Error shutting down worker: %w", err)
+				}
+				c.UI.Error(retErr.Error())
+				if err := c.controller.Shutdown(); err != nil {
+					c.UI.Error(fmt.Errorf("Error with controller shutdown: %w", err).Error())
+				}
+				return base.CommandCliError
+			}
 			go func() {
 				for {
 					select {

internal/cmd/commands/server/server.go

@@ -469,6 +469,21 @@ func (c *Command) Run(args []string) int {
 			c.Info["worker auth registration request"] = c.worker.WorkerAuthRegistrationRequest
 			c.InfoKeys = append(c.InfoKeys, "worker auth current key id")
 			c.Info["worker auth current key id"] = c.worker.WorkerAuthCurrentKeyId
+
+			// Write the WorkerAuth request to a file
+			if err := c.StoreWorkerAuthReq(c.worker.WorkerAuthRegistrationRequest, c.worker.WorkerAuthStorage.BaseDir()); err != nil {
+				// Shutdown on failure
+				retErr := fmt.Errorf("Error storing worker auth request: %w", err)
+				if err := c.worker.Shutdown(); err != nil {
+					c.UI.Error(retErr.Error())
+					retErr = fmt.Errorf("Error shutting down worker: %w", err)
+				}
+				c.UI.Error(retErr.Error())
+				if err := c.controller.Shutdown(); err != nil {
+					c.UI.Error(fmt.Errorf("Error with controller shutdown: %w", err).Error())
+				}
+				return base.CommandCliError
+			}
 		}
 	}
 

internal/daemon/worker/controller_connection.go

@@ -14,6 +14,8 @@ import (
 	"math/big"
 	mathrand "math/rand"
 	"net"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -77,6 +79,15 @@ func (w *Worker) controllerDialerFunc() func(context.Context, string) (net.Conn,
 			conn, err = w.v1KmsAuthDialFn(ctx, addr)
 		default:
 			conn, err = protocol.Dial(ctx, w.WorkerAuthStorage, addr, nodeenrollment.WithWrapper(w.conf.WorkerAuthStorageKms))
+			// No error and a valid connection means the WorkerAuthRegistrationRequest was populated
+			// We can remove the stored workerAuthRequest file
+			if err == nil && conn != nil {
+				if w.WorkerAuthStorage.BaseDir() != "" {
+					workerAuthReqFilePath := filepath.Join(w.WorkerAuthStorage.BaseDir(), base.WorkerAuthReqFile)
+					// Intentionally ignoring any error removing this file
+					_ = os.Remove(workerAuthReqFilePath)
+				}
+			}
 		}
 
 		if !w.everAuthenticated.Load() && err == nil && conn != nil {