mirror of
https://github.com/siderolabs/talos.git
synced 2026-03-09 23:51:16 +01:00
2e64e9e4e0
Note: this issue never happens with default Talos worker configuration (generated by Omni, `talosctl gen config` or CABPT). Before change https://github.com/siderolabs/talos/pull/4294 3 years ago, worker nodes connected to trustd in "insecure" mode (without validating the trustd server certificate). The change kept backwards compatibility, so it still allowed insecure mode on upgrades. Now it's time to break this compatibility promise, and require accepted CAs to be always present. Adds validation for machine configuration, so if upgrade is attempeted, it would not validate the machine config without accepted CAs. Now lack of accepted CAs would lead to failure to connect to trustd. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package basic
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/tls"
|
|
stdx509 "crypto/x509"
|
|
|
|
"github.com/siderolabs/crypto/x509"
|
|
"github.com/siderolabs/gen/xslices"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials"
|
|
)
|
|
|
|
// Credentials describes an authorization method.
|
|
type Credentials interface {
|
|
credentials.PerRPCCredentials
|
|
|
|
UnaryInterceptor() grpc.UnaryServerInterceptor
|
|
}
|
|
|
|
// NewConnection initializes a grpc.ClientConn configured for basic
|
|
// authentication.
|
|
func NewConnection(address string, creds credentials.PerRPCCredentials, acceptedCAs []*x509.PEMEncodedCertificate) (conn *grpc.ClientConn, err error) {
|
|
tlsConfig := &tls.Config{}
|
|
|
|
tlsConfig.RootCAs = stdx509.NewCertPool()
|
|
tlsConfig.RootCAs.AppendCertsFromPEM(bytes.Join(
|
|
xslices.Map(
|
|
acceptedCAs,
|
|
func(cert *x509.PEMEncodedCertificate) []byte {
|
|
return cert.Crt
|
|
},
|
|
),
|
|
nil,
|
|
))
|
|
|
|
grpcOpts := []grpc.DialOption{
|
|
grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)),
|
|
grpc.WithPerRPCCredentials(creds),
|
|
grpc.WithSharedWriteBuffer(true),
|
|
}
|
|
|
|
conn, err = grpc.Dial(address, grpcOpts...)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
return conn, nil
|
|
}
|