Skip to content
This repository was archived by the owner on Jan 26, 2023. It is now read-only.

Commit 3ca496c

Browse files
beautifulentropybeautifulentropy
authored
Make consul config TLS only and fix TLS consul client bug (#21)
- Fix nil pointer dereference in `attache-control` when configuring mTLS for the Consul client - Make Consul client mTLS only - Enable mTLS for Consul in example Terraform file - Add mTLS Consul and Nomad configs - Update REAMDE.md Fixes #19 Fixes #20
1 parent 9a9d44b commit 3ca496c

18 files changed

+274
-75
lines changed

‎README.md‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -56,29 +56,27 @@ Redis nodes (in the Await Consul Service) to do so.
5656
$ ./attache-control -help
5757
Usage of ./attache-control:
5858
-attempt-interval duration
59-
Duration to wait between attempts to join or create a cluster (default 3s)
59+
Duration to wait between attempts to join or create a cluster (e.g. '1s') (default 3s)
6060
-attempt-limit int
61-
Number of times to attempt joining or creating a cluster before exiting (default 20)
61+
Number of times to join or create a cluster before exiting (default 20)
6262
-await-service-name string
6363
Consul Service for newly created Redis Cluster Nodes, (required)
6464
-consul-acl-token string
6565
Consul client ACL token
6666
-consul-addr string
67-
Consul client address (default "127.0.0.1:8500")
67+
Consul client address (default "127.0.0.1:8501")
6868
-consul-dc string
6969
Consul client datacenter (default "dev-general")
70-
-consul-tls-ca-cert string
70+
-consul-tls-ca-cert string, (required)
7171
Consul client CA certificate file
72-
-consul-tls-cert string
72+
-consul-tls-cert string, (required)
7373
Consul client certificate file
74-
-consul-tls-enable
75-
Enable mTLS for the Consul client
76-
-consul-tls-key string
74+
-consul-tls-key string, (required)
7775
Consul client key file
7876
-dest-service-name string
7977
Consul Service for healthy Redis Cluster Nodes, (required)
8078
-lock-kv-path string
81-
Consul KV path used as a distributed lock for operations (default "service/attache/leader")
79+
Consul KV path to use as a leader lock for Redis Cluster operations (default "service/attache/leader")
8280
-log-level string
8381
Set the log level (default "info")
8482
-redis-auth-password-file string
@@ -106,12 +104,12 @@ $ go build -o attache-check ./cmd/attache-check/main.go && go build -o attache-c
106104

107105
In another shell, start the Consul server in `dev` mode:
108106
```shell
109-
$ consul agent -dev -datacenter dev-general -log-level ERROR
107+
$ consul agent -dev -config-format=hcl -config-file consul.conf.hcl
110108
```
111109

112110
In another shell, start the Nomad server in `dev` mode:
113111
```shell
114-
$ sudo nomad agent -dev -bind 0.0.0.0 -log-level ERROR -dc dev-general
112+
$ sudo nomad agent -dev -config nomad.conf.hcl
115113
```
116114

117115
Start a Nomad job deployment using Terraform:
@@ -125,7 +123,7 @@ terraform apply
125123
Open the Nomad UI: http://localhost:4646/ui to view information about the Redis
126124
Cluster deployment
127125

128-
Open the Consul UI: http://localhost:8500/ui to view health check information
126+
Open the Consul UI: http://localhost:8501/ui to view health check information
129127
for the Redis Cluster
130128

131129
### Useful Commands

‎cmd/attache-control/config.go‎

Lines changed: 13 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -58,22 +58,16 @@ func (c cliOpts) Validate() error {
5858
return errors.New("missing required opt: 'await-service-name'")
5959
}
6060

61-
if c.ConsulOpts.EnableTLS {
62-
if c.ConsulOpts.TLSCACertFile == "" {
63-
return errors.New("missing required opt: 'consul-tls-ca-cert")
64-
}
65-
66-
if c.ConsulOpts.TLSCertFile == "" {
67-
return errors.New("missing required opt: 'consul-tls-cert")
68-
}
69-
70-
if c.ConsulOpts.TLSKeyFile == "" {
71-
return errors.New("missing required opt: 'consul-tls-key")
72-
}
61+
if c.ConsulOpts.TLSCACertFile == "" {
62+
return errors.New("missing required opt: 'consul-tls-ca-cert")
7363
}
7464

75-
if !c.ConsulOpts.EnableTLS && (c.ConsulOpts.TLSCACertFile != "" || c.ConsulOpts.TLSCertFile != "" || c.ConsulOpts.TLSKeyFile != "") {
76-
return errors.New("missing required opt: 'consul-tls-enable")
65+
if c.ConsulOpts.TLSCertFile == "" {
66+
return errors.New("missing required opt: 'consul-tls-cert")
67+
}
68+
69+
if c.ConsulOpts.TLSKeyFile == "" {
70+
return errors.New("missing required opt: 'consul-tls-key")
7771
}
7872

7973
if c.RedisOpts.NodeAddr == "" {
@@ -108,7 +102,7 @@ func ParseFlags() cliOpts {
108102
// CLI
109103
flag.StringVar(&conf.lockPath, "lock-kv-path", "service/attache/leader", "Consul KV path to use as a leader lock for Redis Cluster operations")
110104
flag.DurationVar(&conf.attemptInterval, "attempt-interval", 3*time.Second, "Duration to wait between attempts to join or create a cluster (e.g. '1s')")
111-
flag.IntVar(&conf.attemptLimit, "attempt-limit", 20, "Number of times to attempt for or join a cluster before exiting")
105+
flag.IntVar(&conf.attemptLimit, "attempt-limit", 20, "Number of times to attempt join or create a cluster before exiting")
112106
flag.StringVar(&conf.awaitServiceName, "await-service-name", "", "Consul Service for newly created Redis Cluster Nodes, (required)")
113107
flag.StringVar(&conf.destServiceName, "dest-service-name", "", "Consul Service for healthy Redis Cluster Nodes, (required)")
114108
flag.StringVar(&conf.logLevel, "log-level", "info", "Set the log level")
@@ -123,12 +117,11 @@ func ParseFlags() cliOpts {
123117

124118
// Consul
125119
flag.StringVar(&conf.ConsulOpts.DC, "consul-dc", "dev-general", "Consul client datacenter")
126-
flag.StringVar(&conf.ConsulOpts.Address, "consul-addr", "127.0.0.1:8500", "Consul client address")
120+
flag.StringVar(&conf.ConsulOpts.Address, "consul-addr", "127.0.0.1:8501", "Consul client address")
127121
flag.StringVar(&conf.ConsulOpts.ACLToken, "consul-acl-token", "", "Consul client ACL token")
128-
flag.BoolVar(&conf.ConsulOpts.EnableTLS, "consul-tls-enable", false, "Enable mTLS for the Consul client (requires 'consul-tls-ca-cert', 'consul-tls-cert', 'consul-tls-key')")
129-
flag.StringVar(&conf.ConsulOpts.TLSCACertFile, "consul-tls-ca-cert", "", "Consul client CA certificate file")
130-
flag.StringVar(&conf.ConsulOpts.TLSCertFile, "consul-tls-cert", "", "Consul client certificate file")
131-
flag.StringVar(&conf.ConsulOpts.TLSKeyFile, "consul-tls-key", "", "Consul client key file")
122+
flag.StringVar(&conf.ConsulOpts.TLSCACertFile, "consul-tls-ca-cert", "", "Consul client CA certificate file, (required)")
123+
flag.StringVar(&conf.ConsulOpts.TLSCertFile, "consul-tls-cert", "", "Consul client certificate file, (required)")
124+
flag.StringVar(&conf.ConsulOpts.TLSKeyFile, "consul-tls-key", "", "Consul client key file, (required)")
132125

133126
flag.Parse()
134127
return conf

‎example/consul.conf.hcl‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
datacenter = "dev-general"
2+
log_level = "ERROR"
3+
verify_incoming = false
4+
verify_outgoing = true
5+
verify_server_hostname = true
6+
ca_file = "tls/consul/consul-agent-ca.pem"
7+
cert_file = "tls/consul/dev-general-server-consul-0.pem"
8+
key_file = "tls/consul/dev-general-server-consul-0-key.pem"
9+
ports {
10+
dns = 8600
11+
http = -1
12+
https = 8501
13+
grpc = 8502
14+
serf_lan = 8301
15+
serf_wan = -1
16+
server = 8300
17+
}

‎example/nomad.conf.hcl‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
datacenter = "dev-general"
2+
log_level = "ERROR"
3+
consul {
4+
address = "localhost:8501"
5+
ssl = true
6+
ca_file = "tls/consul/consul-agent-ca.pem"
7+
cert_file = "tls/attache/consul/dev-general-client-consul-0.pem"
8+
key_file = "tls/attache/consul/dev-general-client-consul-0-key.pem"
9+
}
10+
11+
# Enable CORS, retrieving logs is done via IP so we need CORS
12+
http_api_response_headers {
13+
Access-Control-Allow-Origin = "*"
14+
}

‎example/redis-cluster.hcl‎

Lines changed: 47 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -39,18 +39,18 @@ variable "redis-password" {
3939
}
4040

4141
// redis-tls-cacert is the contents of the CA cert file, in PEM format, used for
42-
// mutal TLS authentication between Redis Server and Attaché.
42+
// mutual TLS authentication between Redis Server and Attaché.
4343
variable "redis-tls-cacert" {
4444
type = string
4545
}
4646

4747
// redis-tls-cert is the contents of the cert file, in PEM format, used for
48-
// mutal TLS authentication between Redis Server and Attaché.
48+
// mutual TLS authentication between Redis Server and Attaché.
4949
variable "redis-tls-cert" {
5050
type = string
5151
}
5252

53-
// redis-tls-key is the contents of the key file, in PEM format, used for mutal
53+
// redis-tls-key is the contents of the key file, in PEM format, used for mutual
5454
// TLS authentication between Redis Server and Attaché.
5555
variable "redis-tls-key" {
5656
type = string
@@ -63,17 +63,35 @@ variable "redis-config-template" {
6363
}
6464

6565
// attache-redis-tls-cert is the contents of the cert file, in PEM format, used
66-
// for mutal TLS authentication between Attaché and the Redis Server.
66+
// for mutual TLS authentication between Attaché and the Redis Server.
6767
variable "attache-redis-tls-cert" {
6868
type = string
6969
}
7070

7171
// attache-redis-tls-key is the contents of the key file, in PEM format, used
72-
// for mutal TLS authentication between Attaché and the Redis Server.
72+
// for mutual TLS authentication between Attaché and the Redis Server.
7373
variable "attache-redis-tls-key" {
7474
type = string
7575
}
7676

77+
// consul-tls-ca-cert is the contents of the CA cert file, in PEM format, used
78+
// for mutual TLS authentication between Attaché and the Consul Server.
79+
variable "consul-tls-ca-cert" {
80+
type = string
81+
}
82+
83+
// attache-consul-tls-cert is the contents of the cert file, in PEM format, used
84+
// for mutual TLS authentication between Attaché and the Consul Server.
85+
variable "attache-consul-tls-cert" {
86+
type = string
87+
}
88+
89+
// attache-consul-tls-key is the contents of the key file, in PEM format, used
90+
// for mutual TLS authentication between Attaché and the Cosnul Server.
91+
variable "attache-consul-tls-key" {
92+
type = string
93+
}
94+
7795
job "redis-cluster" {
7896
datacenters = ["dev-general"]
7997
type = "service"
@@ -150,12 +168,27 @@ job "redis-cluster" {
150168
}
151169
template {
152170
data = var.attache-redis-tls-cert
153-
destination = "${NOMAD_ALLOC_DIR}/data/attache-tls/cert.pem"
171+
destination = "${NOMAD_ALLOC_DIR}/data/attache-redis-tls/cert.pem"
154172
change_mode = "restart"
155173
}
156174
template {
157175
data = var.attache-redis-tls-key
158-
destination = "${NOMAD_ALLOC_DIR}/data/attache-tls/key.pem"
176+
destination = "${NOMAD_ALLOC_DIR}/data/attache-redis-tls/key.pem"
177+
change_mode = "restart"
178+
}
179+
template {
180+
data = var.consul-tls-ca-cert
181+
destination = "${NOMAD_ALLOC_DIR}/data/consul-tls/ca-cert.pem"
182+
change_mode = "restart"
183+
}
184+
template {
185+
data = var.attache-consul-tls-cert
186+
destination = "${NOMAD_ALLOC_DIR}/data/attache-consul-tls/cert.pem"
187+
change_mode = "restart"
188+
}
189+
template {
190+
data = var.attache-consul-tls-key
191+
destination = "${NOMAD_ALLOC_DIR}/data/attache-consul-tls/key.pem"
159192
change_mode = "restart"
160193
}
161194
}
@@ -193,8 +226,11 @@ job "redis-cluster" {
193226
"-redis-auth-username", "${var.redis-username}",
194227
"-redis-auth-password-file", "${NOMAD_ALLOC_DIR}/data/password.txt",
195228
"-redis-tls-ca-cert", "${NOMAD_ALLOC_DIR}/data/redis-tls/ca-cert.pem",
196-
"-redis-tls-cert-file", "${NOMAD_ALLOC_DIR}/data/attache-tls/cert.pem",
197-
"-redis-tls-key-file", "${NOMAD_ALLOC_DIR}/data/attache-tls/key.pem"
229+
"-redis-tls-cert-file", "${NOMAD_ALLOC_DIR}/data/attache-redis-tls/cert.pem",
230+
"-redis-tls-key-file", "${NOMAD_ALLOC_DIR}/data/attache-redis-tls/key.pem",
231+
"-consul-tls-ca-cert", "${NOMAD_ALLOC_DIR}/data/consul-tls/ca-cert.pem",
232+
"-consul-tls-cert", "${NOMAD_ALLOC_DIR}/data/attache-consul-tls/cert.pem",
233+
"-consul-tls-key", "${NOMAD_ALLOC_DIR}/data/attache-consul-tls/key.pem"
198234
]
199235
}
200236
}
@@ -213,8 +249,8 @@ job "redis-cluster" {
213249
"-redis-auth-username", "${var.redis-username}",
214250
"-redis-auth-password-file", "${NOMAD_ALLOC_DIR}/data/password.txt",
215251
"-redis-tls-ca-cert", "${NOMAD_ALLOC_DIR}/data/redis-tls/ca-cert.pem",
216-
"-redis-tls-cert-file", "${NOMAD_ALLOC_DIR}/data/attache-tls/cert.pem",
217-
"-redis-tls-key-file", "${NOMAD_ALLOC_DIR}/data/attache-tls/key.pem"
252+
"-redis-tls-cert-file", "${NOMAD_ALLOC_DIR}/data/attache-redis-tls/cert.pem",
253+
"-redis-tls-key-file", "${NOMAD_ALLOC_DIR}/data/attache-redis-tls/key.pem"
218254
]
219255
}
220256
}

0 commit comments

Comments
 (0)