Serving cert file OIDC provider #4190
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,161 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "errors" | ||
| "fmt" | ||
| "io/fs" | ||
| "os" | ||
| "sync" | ||
| "time" | ||
|
|
||
| "github.com/andres-erbsen/clock" | ||
| "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| // DiskCertManager is a certificate manager that loads certificates from disk, and watches for changes. | ||
| type DiskCertManager struct { | ||
| certFilePath string | ||
| keyFilePath string | ||
| certLastModified time.Time | ||
| keyLastModified time.Time | ||
| fileSyncInterval time.Duration | ||
| certMtx sync.RWMutex | ||
| cert *tls.Certificate | ||
| clk clock.Clock | ||
| log logrus.FieldLogger | ||
| } | ||
|
|
||
| func NewDiskCertManager(config *ServingCertFileConfig, clk clock.Clock, log logrus.FieldLogger) (*DiskCertManager, error) { | ||
| if config == nil { | ||
| return nil, errors.New("missing serving cert file configuration") | ||
| } | ||
|
|
||
| if clk == nil { | ||
| clk = clock.New() | ||
| } | ||
|
|
||
| dm := &DiskCertManager{ | ||
| certFilePath: config.CertFilePath, | ||
| keyFilePath: config.KeyFilePath, | ||
| fileSyncInterval: config.FileSyncInterval, | ||
| log: log, | ||
| clk: clk, | ||
| } | ||
|
|
||
| if err := dm.loadCert(); err != nil { | ||
| return nil, fmt.Errorf("failed to load certificate: %w", err) | ||
| } | ||
|
|
||
| return dm, nil | ||
| } | ||
|
|
||
| // TLSConfig returns a TLS configuration that uses the provided certificate stored on disk. | ||
| func (m *DiskCertManager) TLSConfig() *tls.Config { | ||
| return &tls.Config{ | ||
| GetCertificate: m.getCertificate, | ||
| NextProtos: []string{ | ||
| "h2", "http/1.1", // enable HTTP/2 | ||
| }, | ||
| MinVersion: tls.VersionTLS12, | ||
| } | ||
| } | ||
|
|
||
| // getCertificate is called by the TLS stack when a new TLS connection is established. | ||
| func (m *DiskCertManager) getCertificate(chInfo *tls.ClientHelloInfo) (*tls.Certificate, error) { | ||
| m.certMtx.RLock() | ||
| defer m.certMtx.RUnlock() | ||
| cert := m.cert | ||
|
|
||
| return cert, nil | ||
| } | ||
|
|
||
| // WatchFileChanges starts a file watcher to watch for changes to the cert and key files. | ||
| func (m *DiskCertManager) WatchFileChanges(ctx context.Context) { | ||
| m.log.WithField("interval", m.fileSyncInterval).Info("Started watching certificate files") | ||
| ticker := m.clk.Ticker(m.fileSyncInterval) | ||
| defer ticker.Stop() | ||
| for { | ||
| select { | ||
| case <-ctx.Done(): | ||
| m.log.Info("Stopping file watcher") | ||
| return | ||
| case <-ticker.C: | ||
| m.syncCertificateFiles() | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // syncCertificateFiles checks if the cert and key files have been modified, and reloads the certificate if necessary. | ||
| func (m *DiskCertManager) syncCertificateFiles() { | ||
| certFileInfo, keyFileInfo, err := m.getFilesInfo() | ||
| if err != nil { | ||
| return | ||
| } | ||
|
|
||
| if certFileInfo.ModTime() != m.certLastModified || keyFileInfo.ModTime() != m.keyLastModified { | ||
| m.log.Info("File change detected, reloading certificate and key...") | ||
|
|
||
| if err := m.loadCert(); err != nil { | ||
| m.log.Errorf("Failed to load certificate: %v", err) | ||
| } else { | ||
| m.certLastModified = certFileInfo.ModTime() | ||
| m.keyLastModified = keyFileInfo.ModTime() | ||
| m.log.Info("Loaded provided certificate with success") | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // loadCert read the certificate and key files, and load the x509 certificate to memory. | ||
| func (m *DiskCertManager) loadCert() error { | ||
| cert, err := tls.LoadX509KeyPair(m.certFilePath, m.keyFilePath) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| cert.Leaf, err = x509.ParseCertificate(cert.Certificate[0]) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| m.certMtx.Lock() | ||
| defer m.certMtx.Unlock() | ||
|
|
||
| m.cert = &cert | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // getFilesInfo returns the file info of the cert and key files, or error if the files are unreadable or do not exist. | ||
| func (m *DiskCertManager) getFilesInfo() (os.FileInfo, os.FileInfo, error) { | ||
| certFileInfo, err := m.getFileInfo(m.certFilePath) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| keyFileInfo, err := m.getFileInfo(m.keyFilePath) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| return certFileInfo, keyFileInfo, nil | ||
| } | ||
|
|
||
| // getFileInfo returns the file info of the given path, or error if the file is unreadable or does not exist. | ||
| func (m *DiskCertManager) getFileInfo(path string) (os.FileInfo, error) { | ||
| fileInfo, err := os.Stat(path) | ||
| if err != nil { | ||
| errFs := new(fs.PathError) | ||
| switch { | ||
| case errors.Is(err, fs.ErrNotExist) && errors.As(err, &errFs): | ||
| m.log.Errorf("Failed to get file info, file path %q does not exist anymore; please check if the path is correct", errFs.Path) | ||
| default: | ||
| m.log.Errorf("Failed to get file info: %v", err) | ||
| } | ||
| return nil, err | ||
| } | ||
|
|
||
| return fileInfo, nil | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.