Jeff Mitchell
163ce184b8
This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.
64 lines
1.6 KiB
Go
64 lines
1.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package worker
|
|
|
|
import (
|
|
"google.golang.org/grpc/resolver"
|
|
"google.golang.org/grpc/resolver/manual"
|
|
)
|
|
|
|
type receiverType uint
|
|
|
|
const (
|
|
UnknownReceiverType receiverType = iota
|
|
grpcResolverReceiverType
|
|
secondaryConnectionReceiverType
|
|
)
|
|
|
|
// String returns a string representation of the receiverType
|
|
func (s receiverType) String() string {
|
|
return [...]string{
|
|
"unknown",
|
|
"grpcResolver",
|
|
"secondaryConnections",
|
|
}[s]
|
|
}
|
|
|
|
// addressReceiver allows the initializing and setting of addresses. Since a
|
|
// main use case of this interface is to use it in grpc dialing it satisfies
|
|
// a grpc resolver.Builder interface as well.
|
|
type addressReceiver interface {
|
|
InitialAddresses([]string)
|
|
SetAddresses([]string)
|
|
Type() receiverType
|
|
}
|
|
|
|
// grpcResolverReceiver is an addressReceiver which wraps a grpc manual.Resolver
|
|
// InitialAddresses is passed onto the Resolver's InitialState method and
|
|
// SetAddresses is passed onto the Resolver's UpdateState call.
|
|
type grpcResolverReceiver struct {
|
|
*manual.Resolver
|
|
}
|
|
|
|
// IsDialingListener always returns
|
|
func (*grpcResolverReceiver) Type() receiverType {
|
|
return grpcResolverReceiverType
|
|
}
|
|
|
|
func (r grpcResolverReceiver) getState(addrs []string) resolver.State {
|
|
var rAddrs []resolver.Address
|
|
for _, a := range addrs {
|
|
rAddrs = append(rAddrs, resolver.Address{Addr: a})
|
|
}
|
|
return resolver.State{Addresses: rAddrs}
|
|
}
|
|
|
|
func (r *grpcResolverReceiver) InitialAddresses(addrs []string) {
|
|
r.Resolver.InitialState(r.getState(addrs))
|
|
}
|
|
|
|
func (r *grpcResolverReceiver) SetAddresses(addrs []string) {
|
|
r.Resolver.UpdateState(r.getState(addrs))
|
|
}
|