proxycfg: server-local config entry data sources
This is the OSS portion of enterprise PR 2056.
This commit provides server-local implementations of the proxycfg.ConfigEntry
and proxycfg.ConfigEntryList interfaces, that source data from streaming events.
It makes use of the LocalMaterializer type introduced for peering replication,
adding the necessary support for authorization.
It also adds support for "wildcard" subscriptions (within a topic) to the event
publisher, as this is needed to fetch service-resolvers for all services when
configuring mesh gateways.
Currently, events will be emitted for just the ingress-gateway, service-resolver,
and mesh config entry types, as these are the only entries required by proxycfg
— the events will be emitted on topics named IngressGateway, ServiceResolver,
and MeshConfig topics respectively.
Though these events will only be consumed "locally" for now, they can also be
consumed via the gRPC endpoint (confirmed using grpcurl) so using them from
client agents should be a case of swapping the LocalMaterializer for an
RPCMaterializer.
2022-07-01 15:09:47 +00:00
|
|
|
package pbconfigentry
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
2022-07-01 15:15:49 +00:00
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/golang/protobuf/ptypes/timestamp"
|
|
|
|
timestamppb "google.golang.org/protobuf/types/known/timestamppb"
|
proxycfg: server-local config entry data sources
This is the OSS portion of enterprise PR 2056.
This commit provides server-local implementations of the proxycfg.ConfigEntry
and proxycfg.ConfigEntryList interfaces, that source data from streaming events.
It makes use of the LocalMaterializer type introduced for peering replication,
adding the necessary support for authorization.
It also adds support for "wildcard" subscriptions (within a topic) to the event
publisher, as this is needed to fetch service-resolvers for all services when
configuring mesh gateways.
Currently, events will be emitted for just the ingress-gateway, service-resolver,
and mesh config entry types, as these are the only entries required by proxycfg
— the events will be emitted on topics named IngressGateway, ServiceResolver,
and MeshConfig topics respectively.
Though these events will only be consumed "locally" for now, they can also be
consumed via the gRPC endpoint (confirmed using grpcurl) so using them from
client agents should be a case of swapping the LocalMaterializer for an
RPCMaterializer.
2022-07-01 15:09:47 +00:00
|
|
|
|
|
|
|
"github.com/hashicorp/consul/acl"
|
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
|
|
|
"github.com/hashicorp/consul/proto/pbcommon"
|
|
|
|
"github.com/hashicorp/consul/types"
|
|
|
|
)
|
|
|
|
|
|
|
|
func ConfigEntryToStructs(s *ConfigEntry) structs.ConfigEntry {
|
|
|
|
switch s.Kind {
|
|
|
|
case Kind_KindMeshConfig:
|
|
|
|
var target structs.MeshConfigEntry
|
|
|
|
MeshConfigToStructs(s.GetMeshConfig(), &target)
|
|
|
|
pbcommon.RaftIndexToStructs(s.RaftIndex, &target.RaftIndex)
|
|
|
|
pbcommon.EnterpriseMetaToStructs(s.EnterpriseMeta, &target.EnterpriseMeta)
|
|
|
|
return &target
|
|
|
|
case Kind_KindServiceResolver:
|
|
|
|
var target structs.ServiceResolverConfigEntry
|
|
|
|
target.Name = s.Name
|
|
|
|
|
|
|
|
ServiceResolverToStructs(s.GetServiceResolver(), &target)
|
|
|
|
pbcommon.RaftIndexToStructs(s.RaftIndex, &target.RaftIndex)
|
|
|
|
pbcommon.EnterpriseMetaToStructs(s.EnterpriseMeta, &target.EnterpriseMeta)
|
|
|
|
return &target
|
|
|
|
case Kind_KindIngressGateway:
|
|
|
|
var target structs.IngressGatewayConfigEntry
|
|
|
|
target.Name = s.Name
|
|
|
|
|
|
|
|
IngressGatewayToStructs(s.GetIngressGateway(), &target)
|
|
|
|
pbcommon.RaftIndexToStructs(s.RaftIndex, &target.RaftIndex)
|
|
|
|
pbcommon.EnterpriseMetaToStructs(s.EnterpriseMeta, &target.EnterpriseMeta)
|
|
|
|
return &target
|
2022-07-01 15:15:49 +00:00
|
|
|
case Kind_KindServiceIntentions:
|
|
|
|
var target structs.ServiceIntentionsConfigEntry
|
|
|
|
target.Name = s.Name
|
|
|
|
|
|
|
|
ServiceIntentionsToStructs(s.GetServiceIntentions(), &target)
|
|
|
|
pbcommon.RaftIndexToStructs(s.RaftIndex, &target.RaftIndex)
|
|
|
|
pbcommon.EnterpriseMetaToStructs(s.EnterpriseMeta, &target.EnterpriseMeta)
|
|
|
|
return &target
|
proxycfg: server-local config entry data sources
This is the OSS portion of enterprise PR 2056.
This commit provides server-local implementations of the proxycfg.ConfigEntry
and proxycfg.ConfigEntryList interfaces, that source data from streaming events.
It makes use of the LocalMaterializer type introduced for peering replication,
adding the necessary support for authorization.
It also adds support for "wildcard" subscriptions (within a topic) to the event
publisher, as this is needed to fetch service-resolvers for all services when
configuring mesh gateways.
Currently, events will be emitted for just the ingress-gateway, service-resolver,
and mesh config entry types, as these are the only entries required by proxycfg
— the events will be emitted on topics named IngressGateway, ServiceResolver,
and MeshConfig topics respectively.
Though these events will only be consumed "locally" for now, they can also be
consumed via the gRPC endpoint (confirmed using grpcurl) so using them from
client agents should be a case of swapping the LocalMaterializer for an
RPCMaterializer.
2022-07-01 15:09:47 +00:00
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("unable to convert ConfigEntry of kind %s to structs", s.Kind))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func ConfigEntryFromStructs(s structs.ConfigEntry) *ConfigEntry {
|
|
|
|
configEntry := &ConfigEntry{
|
|
|
|
Name: s.GetName(),
|
|
|
|
EnterpriseMeta: pbcommon.NewEnterpriseMetaFromStructs(*s.GetEnterpriseMeta()),
|
|
|
|
}
|
|
|
|
|
|
|
|
var raftIndex pbcommon.RaftIndex
|
|
|
|
pbcommon.RaftIndexFromStructs(s.GetRaftIndex(), &raftIndex)
|
|
|
|
configEntry.RaftIndex = &raftIndex
|
|
|
|
|
|
|
|
switch v := s.(type) {
|
|
|
|
case *structs.MeshConfigEntry:
|
|
|
|
var meshConfig MeshConfig
|
|
|
|
MeshConfigFromStructs(v, &meshConfig)
|
|
|
|
|
|
|
|
configEntry.Kind = Kind_KindMeshConfig
|
|
|
|
configEntry.Entry = &ConfigEntry_MeshConfig{
|
|
|
|
MeshConfig: &meshConfig,
|
|
|
|
}
|
|
|
|
case *structs.ServiceResolverConfigEntry:
|
|
|
|
var serviceResolver ServiceResolver
|
|
|
|
ServiceResolverFromStructs(v, &serviceResolver)
|
|
|
|
|
|
|
|
configEntry.Kind = Kind_KindServiceResolver
|
|
|
|
configEntry.Entry = &ConfigEntry_ServiceResolver{
|
|
|
|
ServiceResolver: &serviceResolver,
|
|
|
|
}
|
|
|
|
case *structs.IngressGatewayConfigEntry:
|
|
|
|
var ingressGateway IngressGateway
|
|
|
|
IngressGatewayFromStructs(v, &ingressGateway)
|
|
|
|
|
|
|
|
configEntry.Kind = Kind_KindIngressGateway
|
|
|
|
configEntry.Entry = &ConfigEntry_IngressGateway{
|
|
|
|
IngressGateway: &ingressGateway,
|
|
|
|
}
|
2022-07-01 15:15:49 +00:00
|
|
|
case *structs.ServiceIntentionsConfigEntry:
|
|
|
|
var serviceIntentions ServiceIntentions
|
|
|
|
ServiceIntentionsFromStructs(v, &serviceIntentions)
|
|
|
|
|
|
|
|
configEntry.Kind = Kind_KindServiceIntentions
|
|
|
|
configEntry.Entry = &ConfigEntry_ServiceIntentions{
|
|
|
|
ServiceIntentions: &serviceIntentions,
|
|
|
|
}
|
proxycfg: server-local config entry data sources
This is the OSS portion of enterprise PR 2056.
This commit provides server-local implementations of the proxycfg.ConfigEntry
and proxycfg.ConfigEntryList interfaces, that source data from streaming events.
It makes use of the LocalMaterializer type introduced for peering replication,
adding the necessary support for authorization.
It also adds support for "wildcard" subscriptions (within a topic) to the event
publisher, as this is needed to fetch service-resolvers for all services when
configuring mesh gateways.
Currently, events will be emitted for just the ingress-gateway, service-resolver,
and mesh config entry types, as these are the only entries required by proxycfg
— the events will be emitted on topics named IngressGateway, ServiceResolver,
and MeshConfig topics respectively.
Though these events will only be consumed "locally" for now, they can also be
consumed via the gRPC endpoint (confirmed using grpcurl) so using them from
client agents should be a case of swapping the LocalMaterializer for an
RPCMaterializer.
2022-07-01 15:09:47 +00:00
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("unable to convert %T to proto", s))
|
|
|
|
}
|
|
|
|
|
|
|
|
return configEntry
|
|
|
|
}
|
|
|
|
|
|
|
|
func tlsVersionToStructs(s string) types.TLSVersion {
|
|
|
|
return types.TLSVersion(s)
|
|
|
|
}
|
|
|
|
|
|
|
|
func tlsVersionFromStructs(t types.TLSVersion) string {
|
|
|
|
return t.String()
|
|
|
|
}
|
|
|
|
|
|
|
|
func cipherSuitesToStructs(cs []string) []types.TLSCipherSuite {
|
|
|
|
cipherSuites := make([]types.TLSCipherSuite, len(cs))
|
|
|
|
for idx, suite := range cs {
|
|
|
|
cipherSuites[idx] = types.TLSCipherSuite(suite)
|
|
|
|
}
|
|
|
|
return cipherSuites
|
|
|
|
}
|
|
|
|
|
|
|
|
func cipherSuitesFromStructs(cs []types.TLSCipherSuite) []string {
|
|
|
|
cipherSuites := make([]string, len(cs))
|
|
|
|
for idx, suite := range cs {
|
|
|
|
cipherSuites[idx] = suite.String()
|
|
|
|
}
|
|
|
|
return cipherSuites
|
|
|
|
}
|
|
|
|
|
|
|
|
func enterpriseMetaToStructs(m *pbcommon.EnterpriseMeta) acl.EnterpriseMeta {
|
|
|
|
var entMeta acl.EnterpriseMeta
|
|
|
|
pbcommon.EnterpriseMetaToStructs(m, &entMeta)
|
|
|
|
return entMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
func enterpriseMetaFromStructs(m acl.EnterpriseMeta) *pbcommon.EnterpriseMeta {
|
|
|
|
return pbcommon.NewEnterpriseMetaFromStructs(m)
|
|
|
|
}
|
2022-07-01 15:15:49 +00:00
|
|
|
|
|
|
|
func timeFromStructs(t *time.Time) *timestamp.Timestamp {
|
|
|
|
if t == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return timestamppb.New(*t)
|
|
|
|
}
|
|
|
|
|
|
|
|
func timeToStructs(ts *timestamp.Timestamp) *time.Time {
|
|
|
|
if ts == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
t := ts.AsTime()
|
|
|
|
return &t
|
|
|
|
}
|
|
|
|
|
|
|
|
func intentionActionFromStructs(a structs.IntentionAction) IntentionAction {
|
|
|
|
if a == structs.IntentionActionAllow {
|
|
|
|
return IntentionAction_Allow
|
|
|
|
}
|
|
|
|
return IntentionAction_Deny
|
|
|
|
}
|
|
|
|
|
|
|
|
func intentionActionToStructs(a IntentionAction) structs.IntentionAction {
|
|
|
|
if a == IntentionAction_Allow {
|
|
|
|
return structs.IntentionActionAllow
|
|
|
|
}
|
|
|
|
return structs.IntentionActionDeny
|
|
|
|
}
|
|
|
|
|
|
|
|
func intentionSourceTypeFromStructs(structs.IntentionSourceType) IntentionSourceType {
|
|
|
|
return IntentionSourceType_Consul
|
|
|
|
}
|
|
|
|
|
|
|
|
func intentionSourceTypeToStructs(IntentionSourceType) structs.IntentionSourceType {
|
|
|
|
return structs.IntentionSourceConsul
|
|
|
|
}
|