Skip to content

Commit 5539445

Browse files
azdagronazdagron
authored
Plugin reconfiguration support (#5166)
* Plugin reconfiguration support Signed-off-by: Andrew Harding <[email protected]>
1 parent 111aa17 commit 5539445

25 files changed

+642
-187
lines changed

‎cmd/spire-agent/cli/run/run_posix_test.go

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -187,28 +187,28 @@ func TestParseConfigGood(t *testing.T) {
187187
// Check for plugins configurations
188188
expectedPluginConfigs := catalog.PluginConfigs{
189189
{
190-
Type: "plugin_type_agent",
191-
Name: "plugin_name_agent",
192-
Path: "./pluginAgentCmd",
193-
Checksum: "pluginAgentChecksum",
194-
Data: data,
195-
Disabled: false,
190+
Type: "plugin_type_agent",
191+
Name: "plugin_name_agent",
192+
Path: "./pluginAgentCmd",
193+
Checksum: "pluginAgentChecksum",
194+
DataSource: catalog.FixedData(data),
195+
Disabled: false,
196196
},
197197
{
198-
Type: "plugin_type_agent",
199-
Name: "plugin_disabled",
200-
Path: "./pluginAgentCmd",
201-
Checksum: "pluginAgentChecksum",
202-
Data: data,
203-
Disabled: true,
198+
Type: "plugin_type_agent",
199+
Name: "plugin_disabled",
200+
Path: "./pluginAgentCmd",
201+
Checksum: "pluginAgentChecksum",
202+
DataSource: catalog.FixedData(data),
203+
Disabled: true,
204204
},
205205
{
206-
Type: "plugin_type_agent",
207-
Name: "plugin_enabled",
208-
Path: "./pluginAgentCmd",
209-
Checksum: "pluginAgentChecksum",
210-
Data: data,
211-
Disabled: false,
206+
Type: "plugin_type_agent",
207+
Name: "plugin_enabled",
208+
Path: "./pluginAgentCmd",
209+
Checksum: "pluginAgentChecksum",
210+
DataSource: catalog.FileData("plugin.conf"),
211+
Disabled: false,
212212
},
213213
}
214214

‎cmd/spire-agent/cli/run/run_windows_test.go

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -173,28 +173,28 @@ func TestParseConfigGood(t *testing.T) {
173173
// Check for plugins configurations
174174
expectedPluginConfigs := catalog.PluginConfigs{
175175
{
176-
Type: "plugin_type_agent",
177-
Name: "plugin_name_agent",
178-
Path: "./pluginAgentCmd",
179-
Checksum: "pluginAgentChecksum",
180-
Data: data,
181-
Disabled: false,
176+
Type: "plugin_type_agent",
177+
Name: "plugin_name_agent",
178+
Path: "./pluginAgentCmd",
179+
Checksum: "pluginAgentChecksum",
180+
DataSource: catalog.FixedData(data),
181+
Disabled: false,
182182
},
183183
{
184-
Type: "plugin_type_agent",
185-
Name: "plugin_disabled",
186-
Path: ".\\pluginAgentCmd",
187-
Checksum: "pluginAgentChecksum",
188-
Data: data,
189-
Disabled: true,
184+
Type: "plugin_type_agent",
185+
Name: "plugin_disabled",
186+
Path: ".\\pluginAgentCmd",
187+
Checksum: "pluginAgentChecksum",
188+
DataSource: catalog.FixedData(data),
189+
Disabled: true,
190190
},
191191
{
192-
Type: "plugin_type_agent",
193-
Name: "plugin_enabled",
194-
Path: "c:/temp/pluginAgentCmd",
195-
Checksum: "pluginAgentChecksum",
196-
Data: data,
197-
Disabled: false,
192+
Type: "plugin_type_agent",
193+
Name: "plugin_enabled",
194+
Path: "c:/temp/pluginAgentCmd",
195+
Checksum: "pluginAgentChecksum",
196+
DataSource: catalog.FileData("plugin.conf"),
197+
Disabled: false,
198198
},
199199
}
200200

‎cmd/spire-server/cli/run/run_test.go

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -72,28 +72,28 @@ func TestParseConfigGood(t *testing.T) {
7272
// Check for plugins configurations
7373
expectedPluginConfigs := catalog.PluginConfigs{
7474
{
75-
Type: "plugin_type_server",
76-
Name: "plugin_name_server",
77-
Path: "./pluginServerCmd",
78-
Checksum: "pluginServerChecksum",
79-
Data: data,
80-
Disabled: false,
81-
},
82-
{
83-
Type: "plugin_type_server",
84-
Name: "plugin_disabled",
85-
Path: "./pluginServerCmd",
86-
Checksum: "pluginServerChecksum",
87-
Data: data,
88-
Disabled: true,
89-
},
90-
{
91-
Type: "plugin_type_server",
92-
Name: "plugin_enabled",
93-
Path: "./pluginServerCmd",
94-
Checksum: "pluginServerChecksum",
95-
Data: data,
96-
Disabled: false,
75+
Type: "plugin_type_server",
76+
Name: "plugin_name_server",
77+
Path: "./pluginServerCmd",
78+
Checksum: "pluginServerChecksum",
79+
DataSource: catalog.FixedData(data),
80+
Disabled: false,
81+
},
82+
{
83+
Type: "plugin_type_server",
84+
Name: "plugin_disabled",
85+
Path: "./pluginServerCmd",
86+
Checksum: "pluginServerChecksum",
87+
DataSource: catalog.FixedData(data),
88+
Disabled: true,
89+
},
90+
{
91+
Type: "plugin_type_server",
92+
Name: "plugin_enabled",
93+
Path: "./pluginServerCmd",
94+
Checksum: "pluginServerChecksum",
95+
DataSource: catalog.FileData("plugin.conf"),
96+
Disabled: false,
9797
},
9898
}
9999

‎conf/agent/agent_full.conf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,11 +127,14 @@ agent {
127127
# # not needed for built-ins)
128128
# plugin_checksum = <string>
129129
#
130-
# # plugin_data: Plugin-specific data
130+
# # plugin_data: Plugin-specific data (mutually exclusive with plugin_data_file)
131131
# plugin_data {
132132
# ...configuration options...
133133
# }
134134
#
135+
# # plugin_data_file: Path to file with plugin-specific data (mutually exclusive with plugin_data)
136+
# plugin_data_file = <string>
137+
#
135138
# # enabled: Enable or disable the plugin (enabled by default)
136139
# enabled = [true | false]
137140
# }

‎conf/server/server_full.conf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,11 +210,14 @@ server {
210210
# # not needed for built-ins)
211211
# plugin_checksum = <string>
212212
#
213-
# # plugin_data: Plugin-specific data
213+
# # plugin_data: Plugin-specific data (mutually exclusive with plugin_data_file)
214214
# plugin_data {
215215
# ...configuration options...
216216
# }
217217
#
218+
# # plugin_data_file: Path to file with plugin-specific data (mutually exclusive with plugin_data)
219+
# plugin_data_file = <string>
220+
#
218221
# # enabled: Enable or disable the plugin (enabled by default)
219222
# enabled = [true | false]
220223
# }

‎doc/spire_agent.md

Lines changed: 55 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -136,14 +136,61 @@ plugins {
136136

137137
The following configuration options are available to configure a plugin:
138138

139-
| Configuration | Description |
140-
|-----------------|-------------------------------------------------------------------------------|
141-
| plugin_cmd | Path to the plugin implementation binary (optional, not needed for built-ins) |
142-
| plugin_checksum | An optional sha256 of the plugin binary (optional, not needed for built-ins) |
143-
| enabled | Enable or disable the plugin (enabled by default) |
144-
| plugin_data | Plugin-specific data |
145-
146-
Please see the [built-in plugins](#built-in-plugins) section for information on plugins that are available out-of-the-box.
139+
| Configuration | Description |
140+
|------------------|----------------------------------------------------------------------------------------|
141+
| plugin_cmd | Path to the plugin implementation binary (optional, not needed for built-ins) |
142+
| plugin_checksum | An optional sha256 of the plugin binary (optional, not needed for built-ins) |
143+
| enabled | Enable or disable the plugin (enabled by default) |
144+
| plugin_data | Plugin-specific data (mutually exclusive with `plugin_data_file`) |
145+
| plugin_data_file | Path to a file containing plugin-specific data (mutually exclusive with `plugin_data`) |
146+
147+
Please see the [built-in plugins](#built-in-plugins) section below for information on plugins that are available out-of-the-box.
148+
149+
### Examples
150+
151+
#### Built-in Plugin with Static Configuration
152+
153+
```hcl
154+
plugins {
155+
SomeType "some_plugin" {
156+
plugin_data = {
157+
option1 = "foo"
158+
option2 = 3
159+
}
160+
}
161+
}
162+
```
163+
164+
#### External Plugin with Dynamic Configuration
165+
166+
In the `agent.conf`, declare the plugin using the `plugin_data_file` option to source the plugin configuration from file.
167+
168+
```hcl
169+
plugins {
170+
SomeType "some_plugin" {
171+
plugin_cmd = "./path/to/plugin"
172+
plugin_checksum = "4e1243bd22c66e76c2ba9eddc1f91394e57f9f83"
173+
plugin_data_file = "some_plugin.conf"
174+
}
175+
}
176+
```
177+
178+
And then in `some_plugin.conf` you place the plugin configuration:
179+
180+
```hcl
181+
option1 = "foo"
182+
option2 = 3
183+
```
184+
185+
### Reconfiguring plugins (Posix only)
186+
187+
Plugins that use dynamic configuration sources (i.e. `plugin_data_file`) can be reconfigured at runtime by sending a `SIGUSR1` signal to SPIRE Agent. This is true for both built-in and external plugins.
188+
189+
SPIRE Agent, upon receipt of the signal, does the following:
190+
191+
1. Reloads the plugin data
192+
2. Compares the plugin data to the previous data
193+
3. If changed, the plugin is reconfigured with the new data
147194

148195
## Telemetry configuration
149196

‎doc/spire_server.md

Lines changed: 55 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -139,15 +139,64 @@ plugins {
139139

140140
The following configuration options are available to configure a plugin:
141141

142-
| Configuration | Description |
143-
|-----------------|-------------------------------------------------------------------------------|
144-
| plugin_cmd | Path to the plugin implementation binary (optional, not needed for built-ins) |
145-
| plugin_checksum | An optional sha256 of the plugin binary (optional, not needed for built-ins) |
146-
| enabled | Enable or disable the plugin (enabled by default) |
147-
| plugin_data | Plugin-specific data |
142+
| Configuration | Description |
143+
|------------------|----------------------------------------------------------------------------------------|
144+
| plugin_cmd | Path to the plugin implementation binary (optional, not needed for built-ins) |
145+
| plugin_checksum | An optional sha256 of the plugin binary (optional, not needed for built-ins) |
146+
| enabled | Enable or disable the plugin (enabled by default) |
147+
| plugin_data | Plugin-specific data (mutually exclusive with `plugin_data_file`) |
148+
| plugin_data_file | Path to a file containing plugin-specific data (mutually exclusive with `plugin_data`) |
148149

149150
Please see the [built-in plugins](#built-in-plugins) section below for information on plugins that are available out-of-the-box.
150151

152+
### Examples
153+
154+
#### Built-in Plugin with Static Configuration
155+
156+
```hcl
157+
plugins {
158+
SomeType "some_plugin" {
159+
plugin_data = {
160+
option1 = "foo"
161+
option2 = 3
162+
}
163+
}
164+
}
165+
```
166+
167+
#### External Plugin with Dynamic Configuration
168+
169+
In the `agent.conf`, declare the plugin using the `plugin_data_file` option to source the plugin configuration from file.
170+
171+
```hcl
172+
plugins {
173+
SomeType "some_plugin" {
174+
plugin_cmd = "./path/to/plugin"
175+
plugin_checksum = "4e1243bd22c66e76c2ba9eddc1f91394e57f9f83"
176+
plugin_data_file = "some_plugin.conf"
177+
}
178+
}
179+
```
180+
181+
And then in `some_plugin.conf` you place the plugin configuration:
182+
183+
```hcl
184+
option1 = "foo"
185+
option2 = 3
186+
```
187+
188+
### Reconfiguring plugins (Posix only)
189+
190+
Plugins that use dynamic configuration sources (i.e. `plugin_data_file`) can be reconfigured at runtime by sending a `SIGUSR1` signal to SPIRE Server. This is true for both built-in and external plugins.
191+
192+
SPIRE Server, upon receipt of the signal, does the following:
193+
194+
1. Reloads the plugin data
195+
2. Compares the plugin data to the previous data
196+
3. If changed, the plugin is reconfigured with the new data
197+
198+
**Note** The DataStore is not reconfigurable even when configured with a dynamic data source (e.g. `plugin_data_file`).
199+
151200
## Federation configuration
152201

153202
SPIRE Server can be configured to federate with others SPIRE Servers living in different trust domains. SPIRE supports configuring federation relationships in the SPIRE Server configuration file (static relationships) and through the [Trust Domain API](https://github.com/spiffe/spire-api-sdk/blob/main/proto/spire/api/server/trustdomain/v1/trustdomain.proto) (dynamic relationships). This section describes how to configure statically defined relationships in the configuration file.

‎pkg/agent/agent.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ func (a *Agent) Run(ctx context.Context) error {
167167
storeService.Run,
168168
endpoints.ListenAndServe,
169169
metrics.ListenAndServe,
170+
catalog.ReconfigureTask(a.c.Log.WithField(telemetry.SubsystemName, "reconfigurer"), cat),
170171
util.SerialRun(a.waitForTestDial, healthChecker.ListenAndServe),
171172
}
172173

‎pkg/agent/catalog/catalog.go

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package catalog
33
import (
44
"context"
55
"fmt"
6-
"io"
76

87
"github.com/sirupsen/logrus"
98
"github.com/spiffe/go-spiffe/v2/spiffeid"
@@ -27,6 +26,8 @@ const (
2726
workloadattestorType = "WorkloadAttestor"
2827
)
2928

29+
var ReconfigureTask = catalog.ReconfigureTask
30+
3031
type Catalog interface {
3132
GetKeyManager() keymanager.KeyManager
3233
GetNodeAttestor() nodeattestor.NodeAttestor
@@ -51,8 +52,8 @@ type Repository struct {
5152
svidStoreRepository
5253
workloadAttestorRepository
5354

54-
log logrus.FieldLogger
55-
catalogCloser io.Closer
55+
log logrus.FieldLogger
56+
catalog *catalog.Catalog
5657
}
5758

5859
func (repo *Repository) Plugins() map[string]catalog.PluginRepo {
@@ -68,9 +69,13 @@ func (repo *Repository) Services() []catalog.ServiceRepo {
6869
return nil
6970
}
7071

72+
func (repo *Repository) Reconfigure(ctx context.Context) {
73+
repo.catalog.Reconfigure(ctx)
74+
}
75+
7176
func (repo *Repository) Close() {
7277
repo.log.Debug("Closing catalog")
73-
if err := repo.catalogCloser.Close(); err == nil {
78+
if err := repo.catalog.Close(); err == nil {
7479
repo.log.Info("Catalog closed")
7580
} else {
7681
repo.log.WithError(err).Error("Failed to close catalog")
@@ -86,7 +91,7 @@ func Load(ctx context.Context, config Config) (_ *Repository, err error) {
8691
repo := &Repository{
8792
log: config.Log,
8893
}
89-
repo.catalogCloser, err = catalog.Load(ctx, catalog.Config{
94+
repo.catalog, err = catalog.Load(ctx, catalog.Config{
9095
Log: config.Log,
9196
CoreConfig: catalog.CoreConfig{
9297
TrustDomain: config.TrustDomain,

0 commit comments

Comments
 (0)