Plugin reconfiguration support

cmd/spire-agent/cli/run/run_posix_test.go

@@ -187,28 +187,28 @@ func TestParseConfigGood(t *testing.T) {
 	// Check for plugins configurations
 	expectedPluginConfigs := catalog.PluginConfigs{
 		{
-			Type:     "plugin_type_agent",
-			Name:     "plugin_name_agent",
-			Path:     "./pluginAgentCmd",
-			Checksum: "pluginAgentChecksum",
-			Data:     data,
-			Disabled: false,
+			Type:       "plugin_type_agent",
+			Name:       "plugin_name_agent",
+			Path:       "./pluginAgentCmd",
+			Checksum:   "pluginAgentChecksum",
+			DataSource: catalog.FixedData(data),
+			Disabled:   false,
 		},
 		{
-			Type:     "plugin_type_agent",
-			Name:     "plugin_disabled",
-			Path:     "./pluginAgentCmd",
-			Checksum: "pluginAgentChecksum",
-			Data:     data,
-			Disabled: true,
+			Type:       "plugin_type_agent",
+			Name:       "plugin_disabled",
+			Path:       "./pluginAgentCmd",
+			Checksum:   "pluginAgentChecksum",
+			DataSource: catalog.FixedData(data),
+			Disabled:   true,
 		},
 		{
-			Type:     "plugin_type_agent",
-			Name:     "plugin_enabled",
-			Path:     "./pluginAgentCmd",
-			Checksum: "pluginAgentChecksum",
-			Data:     data,
-			Disabled: false,
+			Type:       "plugin_type_agent",
+			Name:       "plugin_enabled",
+			Path:       "./pluginAgentCmd",
+			Checksum:   "pluginAgentChecksum",
+			DataSource: catalog.FileData("plugin.conf"),
+			Disabled:   false,
 		},
 	}
 

cmd/spire-agent/cli/run/run_windows_test.go

@@ -173,28 +173,28 @@ func TestParseConfigGood(t *testing.T) {
 	// Check for plugins configurations
 	expectedPluginConfigs := catalog.PluginConfigs{
 		{
-			Type:     "plugin_type_agent",
-			Name:     "plugin_name_agent",
-			Path:     "./pluginAgentCmd",
-			Checksum: "pluginAgentChecksum",
-			Data:     data,
-			Disabled: false,
+			Type:       "plugin_type_agent",
+			Name:       "plugin_name_agent",
+			Path:       "./pluginAgentCmd",
+			Checksum:   "pluginAgentChecksum",
+			DataSource: catalog.FixedData(data),
+			Disabled:   false,
 		},
 		{
-			Type:     "plugin_type_agent",
-			Name:     "plugin_disabled",
-			Path:     ".\\pluginAgentCmd",
-			Checksum: "pluginAgentChecksum",
-			Data:     data,
-			Disabled: true,
+			Type:       "plugin_type_agent",
+			Name:       "plugin_disabled",
+			Path:       ".\\pluginAgentCmd",
+			Checksum:   "pluginAgentChecksum",
+			DataSource: catalog.FixedData(data),
+			Disabled:   true,
 		},
 		{
-			Type:     "plugin_type_agent",
-			Name:     "plugin_enabled",
-			Path:     "c:/temp/pluginAgentCmd",
-			Checksum: "pluginAgentChecksum",
-			Data:     data,
-			Disabled: false,
+			Type:       "plugin_type_agent",
+			Name:       "plugin_enabled",
+			Path:       "c:/temp/pluginAgentCmd",
+			Checksum:   "pluginAgentChecksum",
+			DataSource: catalog.FileData("plugin.conf"),
+			Disabled:   false,
 		},
 	}
 

cmd/spire-server/cli/run/run_test.go

@@ -72,28 +72,28 @@ func TestParseConfigGood(t *testing.T) {
 	// Check for plugins configurations
 	expectedPluginConfigs := catalog.PluginConfigs{
 		{
-			Type:     "plugin_type_server",
-			Name:     "plugin_name_server",
-			Path:     "./pluginServerCmd",
-			Checksum: "pluginServerChecksum",
-			Data:     data,
-			Disabled: false,
-		},
-		{
-			Type:     "plugin_type_server",
-			Name:     "plugin_disabled",
-			Path:     "./pluginServerCmd",
-			Checksum: "pluginServerChecksum",
-			Data:     data,
-			Disabled: true,
-		},
-		{
-			Type:     "plugin_type_server",
-			Name:     "plugin_enabled",
-			Path:     "./pluginServerCmd",
-			Checksum: "pluginServerChecksum",
-			Data:     data,
-			Disabled: false,
+			Type:       "plugin_type_server",
+			Name:       "plugin_name_server",
+			Path:       "./pluginServerCmd",
+			Checksum:   "pluginServerChecksum",
+			DataSource: catalog.FixedData(data),
+			Disabled:   false,
+		},
+		{
+			Type:       "plugin_type_server",
+			Name:       "plugin_disabled",
+			Path:       "./pluginServerCmd",
+			Checksum:   "pluginServerChecksum",
+			DataSource: catalog.FixedData(data),
+			Disabled:   true,
+		},
+		{
+			Type:       "plugin_type_server",
+			Name:       "plugin_enabled",
+			Path:       "./pluginServerCmd",
+			Checksum:   "pluginServerChecksum",
+			DataSource: catalog.FileData("plugin.conf"),
+			Disabled:   false,
 		},
 	}
 

doc/spire_agent.md

@@ -136,14 +136,25 @@ plugins {
 
 The following configuration options are available to configure a plugin:
 
-| Configuration   | Description                                                                   |
-|-----------------|-------------------------------------------------------------------------------|
-| plugin_cmd      | Path to the plugin implementation binary (optional, not needed for built-ins) |
-| plugin_checksum | An optional sha256 of the plugin binary  (optional, not needed for built-ins) |
-| enabled         | Enable or disable the plugin (enabled by default)                             |
-| plugin_data     | Plugin-specific data                                                          |
-
-Please see the [built-in plugins](#built-in-plugins) section for information on plugins that are available out-of-the-box.
+| Configuration    | Description                                                                            |
+|------------------|----------------------------------------------------------------------------------------|
+| plugin_cmd       | Path to the plugin implementation binary (optional, not needed for built-ins)          |
+| plugin_checksum  | An optional sha256 of the plugin binary  (optional, not needed for built-ins)          |
+| enabled          | Enable or disable the plugin (enabled by default)                                      |
+| plugin_data      | Plugin-specific data (mutually exclusive with `plugin_data_file`)                      |
+| plugin_data_file | Path to a file containing plugin-specific data (mutually exclusive with `plugin_data`) |
+
+Please see the [built-in plugins](#built-in-plugins) section below for information on plugins that are available out-of-the-box.
+
+### Reconfiguring plugins (Posix only)
+
+Plugins that use dynamic configuration sources (i.e. `plugin_data_file`) can be reconfigured at runtime by sending a `SIGUSR1` signal to SPIRE Agent.
+
+SPIRE Agent, upon receipt of the signal, does the following:
+
+1. Reloads the plugin data
+2. Compares the plugin data to the previous data
+3. If changed, the plugin is reconfigured with the new data
 
 ## Telemetry configuration
 

doc/spire_server.md

@@ -139,15 +139,28 @@ plugins {
 
 The following configuration options are available to configure a plugin:
 
-| Configuration   | Description                                                                   |
-|-----------------|-------------------------------------------------------------------------------|
-| plugin_cmd      | Path to the plugin implementation binary (optional, not needed for built-ins) |
-| plugin_checksum | An optional sha256 of the plugin binary  (optional, not needed for built-ins) |
-| enabled         | Enable or disable the plugin (enabled by default)                             |
-| plugin_data     | Plugin-specific data                                                          |
+| Configuration    | Description                                                                            |
+|------------------|----------------------------------------------------------------------------------------|
+| plugin_cmd       | Path to the plugin implementation binary (optional, not needed for built-ins)          |
+| plugin_checksum  | An optional sha256 of the plugin binary  (optional, not needed for built-ins)          |
+| enabled          | Enable or disable the plugin (enabled by default)                                      |
+| plugin_data      | Plugin-specific data (mutually exclusive with `plugin_data_file`)                      |
+| plugin_data_file | Path to a file containing plugin-specific data (mutually exclusive with `plugin_data`) |
 
 Please see the [built-in plugins](#built-in-plugins) section below for information on plugins that are available out-of-the-box.
 
+### Reconfiguring plugins (Posix only)
+
+Plugins that use dynamic configuration sources (i.e. `plugin_data_file`) can be reconfigured at runtime by sending a `SIGUSR1` signal to SPIRE Server.
+
+SPIRE Server, upon receipt of the signal, does the following:
+
+1. Reloads the plugin data
+2. Compares the plugin data to the previous data
+3. If changed, the plugin is reconfigured with the new data
+
+**Note** The DataStore is not reconfigurable even when configured with a dynamic data source (e.g. `plugin_data_file`).
+
 ## Federation configuration
 
 SPIRE Server can be configured to federate with others SPIRE Servers living in different trust domains. SPIRE supports configuring federation relationships in the SPIRE Server configuration file (static relationships) and through the [Trust Domain API](https://github.com/spiffe/spire-api-sdk/blob/main/proto/spire/api/server/trustdomain/v1/trustdomain.proto) (dynamic relationships). This section describes how to configure statically defined relationships in the configuration file.

pkg/agent/agent.go

@@ -167,6 +167,7 @@ func (a *Agent) Run(ctx context.Context) error {
 		storeService.Run,
 		endpoints.ListenAndServe,
 		metrics.ListenAndServe,
+		catalog.ReconfigureTask(cat),
 		util.SerialRun(a.waitForTestDial, healthChecker.ListenAndServe),
 	}
 

pkg/agent/catalog/catalog.go

@@ -3,7 +3,6 @@ package catalog
 import (
 	"context"
 	"fmt"
-	"io"
 
 	"github.com/sirupsen/logrus"
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
@@ -27,6 +26,8 @@ const (
 	workloadattestorType = "WorkloadAttestor"
 )
 
+var ReconfigureTask = catalog.ReconfigureTask
+
 type Catalog interface {
 	GetKeyManager() keymanager.KeyManager
 	GetNodeAttestor() nodeattestor.NodeAttestor
@@ -51,8 +52,8 @@ type Repository struct {
 	svidStoreRepository
 	workloadAttestorRepository
 
-	log           logrus.FieldLogger
-	catalogCloser io.Closer
+	log     logrus.FieldLogger
+	catalog *catalog.Catalog
 }
 
 func (repo *Repository) Plugins() map[string]catalog.PluginRepo {
@@ -68,9 +69,13 @@ func (repo *Repository) Services() []catalog.ServiceRepo {
 	return nil
 }
 
+func (repo *Repository) Reconfigure(ctx context.Context) {
+	repo.catalog.Reconfigure(ctx)
+}
+
 func (repo *Repository) Close() {
 	repo.log.Debug("Closing catalog")
-	if err := repo.catalogCloser.Close(); err == nil {
+	if err := repo.catalog.Close(); err == nil {
 		repo.log.Info("Catalog closed")
 	} else {
 		repo.log.WithError(err).Error("Failed to close catalog")
@@ -86,7 +91,7 @@ func Load(ctx context.Context, config Config) (_ *Repository, err error) {
 	repo := &Repository{
 		log: config.Log,
 	}
-	repo.catalogCloser, err = catalog.Load(ctx, catalog.Config{
+	repo.catalog, err = catalog.Load(ctx, catalog.Config{
 		Log: config.Log,
 		CoreConfig: catalog.CoreConfig{
 			TrustDomain: config.TrustDomain,

pkg/common/catalog/catalog.go

@@ -12,8 +12,8 @@ import (
 	"google.golang.org/grpc"
 )
 
-// Catalog is a set of plugin and service repositories.
-type Catalog interface {
+// Repository is a set of plugin and service repositories.
+type Repository interface {
 	// Plugins returns a map of plugin repositories, keyed by the plugin type.
 	Plugins() map[string]PluginRepo
 
@@ -109,39 +109,53 @@ type Config struct {
 	CoreConfig CoreConfig
 }
 
+type Catalog struct {
+	closers       io.Closer
+	reconfigurers Reconfigurers
+}
+
+func (c *Catalog) Reconfigure(ctx context.Context) {
+	c.reconfigurers.Reconfigure(ctx)
+}
+
+func (c *Catalog) Close() error {
+	return c.closers.Close()
+}
+
 // Load loads and configures plugins defined in the configuration. The given
 // catalog is populated with plugin and service facades for versions
 // implemented by the loaded plugins. The returned io.Closer can be used to
 // close down the loaded plugins, at which point, all facades bound to the
 // given catalog are considered invalidated. If any plugin fails to load or
 // configure, all plugins are unloaded, the catalog is cleared, and the
 // function returns an error.
-func Load(ctx context.Context, config Config, cat Catalog) (_ io.Closer, err error) {
+func Load(ctx context.Context, config Config, repo Repository) (_ *Catalog, err error) {
 	closers := make(closerGroup, 0)
 	defer func() {
 		// If loading fails, clear out the catalog and close down all plugins
 		// that have been loaded thus far.
 		if err != nil {
-			for _, pluginRepo := range cat.Plugins() {
+			for _, pluginRepo := range repo.Plugins() {
 				pluginRepo.Clear()
 			}
-			for _, serviceRepo := range cat.Services() {
+			for _, serviceRepo := range repo.Services() {
 				serviceRepo.Clear()
 			}
 			closers.Close()
 		}
 	}()
 
-	pluginRepos, err := makeBindablePluginRepos(cat.Plugins())
+	pluginRepos, err := makeBindablePluginRepos(repo.Plugins())
 	if err != nil {
 		return nil, err
 	}
-	serviceRepos, err := makeBindableServiceRepos(cat.Services())
+	serviceRepos, err := makeBindableServiceRepos(repo.Services())
 	if err != nil {
 		return nil, err
 	}
 
 	pluginCounts := make(map[string]int)
+	var reconfigurers Reconfigurers
 
 	for _, pluginConfig := range config.PluginConfigs {
 		pluginLog := makePluginLog(config.Log, pluginConfig)
@@ -175,15 +189,13 @@ func Load(ctx context.Context, config Config, cat Catalog) (_ io.Closer, err err
 			return nil, fmt.Errorf("failed to bind plugin %q: %w", pluginConfig.Name, err)
 		}
 
-		switch {
-		case configurer != nil:
-			if err := configurer.Configure(ctx, config.CoreConfig, pluginConfig.Data); err != nil {
-				pluginLog.WithError(err).Error("Failed to configure plugin")
-				return nil, fmt.Errorf("failed to configure plugin %q: %w", pluginConfig.Name, err)
-			}
-		case pluginConfig.Data != "":
-			pluginLog.WithField(telemetry.Reason, "no supported configuration interface").Error("Failed to configure plugin")
-			return nil, fmt.Errorf("failed to configure plugin %q: no supported configuration interface found", pluginConfig.Name)
+		reconfigurer, err := configurePlugin(ctx, pluginLog, config.CoreConfig, configurer, pluginConfig.DataSource)
+		if err != nil {
+			pluginLog.WithError(err).Error("Failed to configure plugin")
+			return nil, fmt.Errorf("failed to configure plugin %q: %w", pluginConfig.Name, err)
+		}
+		if reconfigurer != nil {
+			reconfigurers = append(reconfigurers, reconfigurer)
 		}
 
 		pluginLog.Info("Plugin loaded")
@@ -197,7 +209,10 @@ func Load(ctx context.Context, config Config, cat Catalog) (_ io.Closer, err err
 		}
 	}
 
-	return closers, nil
+	return &Catalog{
+		closers:       closers,
+		reconfigurers: reconfigurers,
+	}, nil
 }
 
 func makePluginLog(log logrus.FieldLogger, pluginConfig PluginConfig) logrus.FieldLogger {