mirror of
https://github.com/siderolabs/talos.git
synced 2025-08-18 21:21:10 +02:00
a068acfbe4
New service `routerd` performs exactly single task: based on incoming API call service name, it routes the requests to the appropriate Talos service (`networkd`, `osd`, etc.) Service `routerd` listens of file socket and routes requests to file sockets. Service `apid` now does single task as well: * it either fans out request to other `apid` services running on other nodes and aggregates responses * or it forwards requests to local `routerd` (when request destination is local node) Cons: * one more proxying layer on request path Pros: * more clear service roles * `routerd` is part of core Talos, services should register with it to expose their API; no auth in the service (not exposed to the world) * `apid` might be replaced with other implementation, it depends on TLS infra, auth, etc. * `apid` is better segregated from other Talos services (can only access `routerd`, can't talk to other Talos services directly, so less exposure in case of a bug) This change is no-op to the end users. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
116 lines
3.0 KiB
Go
116 lines
3.0 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"log"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/talos-systems/grpc-proxy/proxy"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials"
|
|
|
|
apidbackend "github.com/talos-systems/talos/internal/app/apid/pkg/backend"
|
|
"github.com/talos-systems/talos/internal/app/apid/pkg/director"
|
|
"github.com/talos-systems/talos/internal/app/apid/pkg/provider"
|
|
"github.com/talos-systems/talos/internal/pkg/runtime"
|
|
"github.com/talos-systems/talos/pkg/config"
|
|
"github.com/talos-systems/talos/pkg/constants"
|
|
"github.com/talos-systems/talos/pkg/grpc/factory"
|
|
"github.com/talos-systems/talos/pkg/grpc/proxy/backend"
|
|
"github.com/talos-systems/talos/pkg/startup"
|
|
)
|
|
|
|
var (
|
|
configPath *string
|
|
endpoints *string
|
|
)
|
|
|
|
func init() {
|
|
log.SetFlags(log.Lshortfile | log.Ldate | log.Lmicroseconds | log.Ltime)
|
|
|
|
configPath = flag.String("config", "", "the path to the config")
|
|
endpoints = flag.String("endpoints", "", "the IPs of the control plane nodes")
|
|
|
|
flag.Parse()
|
|
}
|
|
|
|
func main() {
|
|
if err := startup.RandSeed(); err != nil {
|
|
log.Fatalf("failed to seed RNG: %v", err)
|
|
}
|
|
|
|
config, err := loadConfig()
|
|
if err != nil {
|
|
log.Fatalf("open config: %v", err)
|
|
}
|
|
|
|
tlsConfig, err := provider.NewTLSConfig(config, strings.Split(*endpoints, ","))
|
|
if err != nil {
|
|
log.Fatalf("failed to create remote certificate provider: %+v", err)
|
|
}
|
|
|
|
serverTLSConfig, err := tlsConfig.ServerConfig()
|
|
if err != nil {
|
|
log.Fatalf("failed to create OS-level TLS configuration: %v", err)
|
|
}
|
|
|
|
clientTLSConfig, err := tlsConfig.ClientConfig()
|
|
if err != nil {
|
|
log.Fatalf("failed to create client TLS config: %v", err)
|
|
}
|
|
|
|
backendFactory := apidbackend.NewAPIDFactory(clientTLSConfig)
|
|
localBackend := backend.NewLocal("routerd", constants.RouterdSocketPath)
|
|
|
|
router := director.NewRouter(backendFactory.Get, localBackend)
|
|
|
|
// all existing streaming methods
|
|
for _, methodName := range []string{
|
|
"/machine.MachineService/Copy",
|
|
"/machine.MachineService/Kubeconfig",
|
|
"/machine.MachineService/List",
|
|
"/machine.MachineService/Logs",
|
|
"/machine.MachineService/Read",
|
|
"/os.OSService/Dmesg",
|
|
} {
|
|
router.RegisterStreamedRegex("^" + regexp.QuoteMeta(methodName) + "$")
|
|
}
|
|
|
|
// register future pattern: method should have suffix "Stream"
|
|
router.RegisterStreamedRegex("Stream$")
|
|
|
|
err = factory.ListenAndServe(
|
|
router,
|
|
factory.Port(constants.ApidPort),
|
|
factory.WithDefaultLog(),
|
|
factory.ServerOptions(
|
|
grpc.Creds(
|
|
credentials.NewTLS(serverTLSConfig),
|
|
),
|
|
grpc.CustomCodec(proxy.Codec()),
|
|
grpc.UnknownServiceHandler(
|
|
proxy.TransparentHandler(
|
|
router.Director,
|
|
proxy.WithStreamedDetector(router.StreamedDetector),
|
|
)),
|
|
),
|
|
)
|
|
if err != nil {
|
|
log.Fatalf("listen: %v", err)
|
|
}
|
|
}
|
|
|
|
func loadConfig() (runtime.Configurator, error) {
|
|
content, err := config.FromFile(*configPath)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return config.New(content)
|
|
}
|