Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

server: Removing advanced TLS config parameters - BREAKING CHANGE #245

Merged
merged 1 commit into from
Jul 6, 2022
Merged

server: Removing advanced TLS config parameters - BREAKING CHANGE #245

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
26 changes: 22 additions & 4 deletions server/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,14 @@ type SignalHandler interface {
Stop()
}

// TLSConfig contains TLS parameters for Config.
type TLSConfig struct {
TLSCertPath string `yaml:"cert_file"`
TLSKeyPath string `yaml:"key_file"`
ClientAuth string `yaml:"client_auth_type"`
ClientCAs string `yaml:"client_ca_file"`
}

// Config for a Server
type Config struct {
MetricsNamespace string `yaml:"-"`
Expand All @@ -62,8 +70,8 @@ type Config struct {
GRPCListenPort int `yaml:"grpc_listen_port"`
GRPCConnLimit int `yaml:"grpc_listen_conn_limit"`

HTTPTLSConfig web.TLSStruct `yaml:"http_tls_config"`
GRPCTLSConfig web.TLSStruct `yaml:"grpc_tls_config"`
HTTPTLSConfig TLSConfig `yaml:"http_tls_config"`
GRPCTLSConfig TLSConfig `yaml:"grpc_tls_config"`

RegisterInstrumentation bool `yaml:"register_instrumentation"`
ExcludeRequestInLog bool `yaml:"-"`
Expand Down Expand Up @@ -239,15 +247,25 @@ func New(cfg Config) (*Server, error) {
var httpTLSConfig *tls.Config
if len(cfg.HTTPTLSConfig.TLSCertPath) > 0 && len(cfg.HTTPTLSConfig.TLSKeyPath) > 0 {
// Note: ConfigToTLSConfig from prometheus/exporter-toolkit is awaiting security review.
httpTLSConfig, err = web.ConfigToTLSConfig(&cfg.HTTPTLSConfig)
httpTLSConfig, err = web.ConfigToTLSConfig(&web.TLSStruct{
TLSCertPath: cfg.HTTPTLSConfig.TLSCertPath,
TLSKeyPath: cfg.HTTPTLSConfig.TLSKeyPath,
ClientAuth: cfg.HTTPTLSConfig.ClientAuth,
ClientCAs: cfg.HTTPTLSConfig.ClientCAs,
})
if err != nil {
return nil, fmt.Errorf("error generating http tls config: %v", err)
}
}
var grpcTLSConfig *tls.Config
if len(cfg.GRPCTLSConfig.TLSCertPath) > 0 && len(cfg.GRPCTLSConfig.TLSKeyPath) > 0 {
// Note: ConfigToTLSConfig from prometheus/exporter-toolkit is awaiting security review.
grpcTLSConfig, err = web.ConfigToTLSConfig(&cfg.GRPCTLSConfig)
grpcTLSConfig, err = web.ConfigToTLSConfig(&web.TLSStruct{
TLSCertPath: cfg.GRPCTLSConfig.TLSCertPath,
TLSKeyPath: cfg.GRPCTLSConfig.TLSKeyPath,
ClientAuth: cfg.GRPCTLSConfig.ClientAuth,
ClientCAs: cfg.GRPCTLSConfig.ClientCAs,
})
if err != nil {
return nil, fmt.Errorf("error generating grpc tls config: %v", err)
}
Expand Down
5 changes: 2 additions & 3 deletions server/server_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ import (
google_protobuf "github.com/golang/protobuf/ptypes/empty"
"github.com/gorilla/mux"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/exporter-toolkit/web"
"github.com/stretchr/testify/require"
"github.com/weaveworks/common/httpgrpc"
"github.com/weaveworks/common/logging"
Expand Down Expand Up @@ -522,13 +521,13 @@ func TestTLSServer(t *testing.T) {
HTTPListenNetwork: DefaultNetwork,
HTTPListenAddress: "localhost",
HTTPListenPort: 9193,
HTTPTLSConfig: web.TLSStruct{
HTTPTLSConfig: TLSConfig{
TLSCertPath: "certs/server.crt",
TLSKeyPath: "certs/server.key",
ClientAuth: "RequireAndVerifyClientCert",
ClientCAs: "certs/root.crt",
},
GRPCTLSConfig: web.TLSStruct{
GRPCTLSConfig: TLSConfig{
TLSCertPath: "certs/server.crt",
TLSKeyPath: "certs/server.key",
ClientAuth: "VerifyClientCertIfGiven",
Expand Down