mirror of
https://github.com/siderolabs/talos.git
synced 2025-11-01 00:41:40 +01:00
d8c2bca1b5
This PR can be split into two parts: * controllers * apid binding into COSI world Controllers ----------- * `k8s.EndpointController` provides control plane endpoints on worker nodes (it isn't required for now on control plane nodes) * `secrets.RootController` now provides OS top-level secrets (CA cert) and secret configuration * `secrets.APIController` generates API secrets (certificates) in a bit different way for workers and control plane nodes: controlplane nodes generate directly, while workers reach out to `trustd` on control plane nodes via `k8s.Endpoint` resource apid Binding ------------ Resource `secrets.API` provides binding to protobuf by converting itself back and forth to protobuf spec. apid no longer receives machine configuration, instead it receives gRPC-backed socket to access Resource API. apid watches `secrets.API` resource, fetches certs and CA from it and uses that in its TLS configuration. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
148 lines
3.6 KiB
Go
148 lines
3.6 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package secrets
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"net/url"
|
|
|
|
"github.com/cosi-project/runtime/pkg/resource"
|
|
"github.com/cosi-project/runtime/pkg/resource/meta"
|
|
"github.com/talos-systems/crypto/x509"
|
|
"inet.af/netaddr"
|
|
)
|
|
|
|
// RootType is type of Root secret resource.
|
|
const RootType = resource.Type("RootSecrets.secrets.talos.dev")
|
|
|
|
// IDs of various resources of RootType.
|
|
const (
|
|
RootOSID = resource.ID("os")
|
|
RootEtcdID = resource.ID("etcd")
|
|
RootKubernetesID = resource.ID("k8s")
|
|
)
|
|
|
|
// Root contains root (not generated) secrets.
|
|
type Root struct {
|
|
md resource.Metadata
|
|
spec interface{}
|
|
}
|
|
|
|
// RootOSSpec describes operating system CA.
|
|
type RootOSSpec struct {
|
|
CA *x509.PEMEncodedCertificateAndKey `yaml:"ca"`
|
|
CertSANIPs []netaddr.IP `yaml:"certSANIPs"`
|
|
CertSANDNSNames []string `yaml:"certSANDNSNames"`
|
|
|
|
Token string `yaml:"token"`
|
|
}
|
|
|
|
// RootEtcdSpec describes etcd CA secrets.
|
|
type RootEtcdSpec struct {
|
|
EtcdCA *x509.PEMEncodedCertificateAndKey `yaml:"etcdCA"`
|
|
}
|
|
|
|
// RootKubernetesSpec describes root Kubernetes secrets.
|
|
type RootKubernetesSpec struct {
|
|
Name string `yaml:"name"`
|
|
Endpoint *url.URL `yaml:"endpoint"`
|
|
CertSANs []string `yaml:"certSANs"`
|
|
APIServerIPs []net.IP `yaml:"apiServerIPs"`
|
|
DNSDomain string `yaml:"dnsDomain"`
|
|
|
|
CA *x509.PEMEncodedCertificateAndKey `yaml:"ca"`
|
|
ServiceAccount *x509.PEMEncodedKey `yaml:"serviceAccount"`
|
|
AggregatorCA *x509.PEMEncodedCertificateAndKey `yaml:"aggregatorCA"`
|
|
|
|
AESCBCEncryptionSecret string `yaml:"aesCBCEncryptionSecret"`
|
|
|
|
BootstrapTokenID string `yaml:"bootstrapTokenID"`
|
|
BootstrapTokenSecret string `yaml:"bootstrapTokenSecret"`
|
|
}
|
|
|
|
// NewRoot initializes a Root resource.
|
|
func NewRoot(id resource.ID) *Root {
|
|
r := &Root{
|
|
md: resource.NewMetadata(NamespaceName, RootType, id, resource.VersionUndefined),
|
|
}
|
|
|
|
switch id {
|
|
case RootOSID:
|
|
r.spec = &RootOSSpec{}
|
|
case RootEtcdID:
|
|
r.spec = &RootEtcdSpec{}
|
|
case RootKubernetesID:
|
|
r.spec = &RootKubernetesSpec{}
|
|
}
|
|
|
|
r.md.BumpVersion()
|
|
|
|
return r
|
|
}
|
|
|
|
// Metadata implements resource.Resource.
|
|
func (r *Root) Metadata() *resource.Metadata {
|
|
return &r.md
|
|
}
|
|
|
|
// Spec implements resource.Resource.
|
|
func (r *Root) Spec() interface{} {
|
|
return r.spec
|
|
}
|
|
|
|
func (r *Root) String() string {
|
|
return fmt.Sprintf("secrets.RootSecret(%q)", r.md.ID())
|
|
}
|
|
|
|
// DeepCopy implements resource.Resource.
|
|
func (r *Root) DeepCopy() resource.Resource {
|
|
var specCopy interface{}
|
|
|
|
switch v := r.spec.(type) {
|
|
case *RootOSSpec:
|
|
vv := *v
|
|
specCopy = &vv
|
|
case *RootEtcdSpec:
|
|
vv := *v
|
|
specCopy = &vv
|
|
case *RootKubernetesSpec:
|
|
vv := *v
|
|
specCopy = &vv
|
|
default:
|
|
panic("unexpected spec type")
|
|
}
|
|
|
|
return &Root{
|
|
md: r.md,
|
|
spec: specCopy,
|
|
}
|
|
}
|
|
|
|
// ResourceDefinition implements meta.ResourceDefinitionProvider interface.
|
|
func (r *Root) ResourceDefinition() meta.ResourceDefinitionSpec {
|
|
return meta.ResourceDefinitionSpec{
|
|
Type: RootType,
|
|
Aliases: []resource.Type{"rootSecret", "rootSecrets"},
|
|
DefaultNamespace: NamespaceName,
|
|
Sensitivity: meta.Sensitive,
|
|
}
|
|
}
|
|
|
|
// OSSpec returns .spec.
|
|
func (r *Root) OSSpec() *RootOSSpec {
|
|
return r.spec.(*RootOSSpec)
|
|
}
|
|
|
|
// EtcdSpec returns .spec.
|
|
func (r *Root) EtcdSpec() *RootEtcdSpec {
|
|
return r.spec.(*RootEtcdSpec)
|
|
}
|
|
|
|
// KubernetesSpec returns .spec.
|
|
func (r *Root) KubernetesSpec() *RootKubernetesSpec {
|
|
return r.spec.(*RootKubernetesSpec)
|
|
}
|