[mesh] enable mTLS #281

benja-wu · 2021-09-28T04:42:45Z

For supporting mTLS inside Mesh
Design doc

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

codecov-commenter · 2021-10-11T13:28:12Z

Codecov Report

Merging #281 (4d79455) into main (c0f5200) will increase coverage by 0.01%.
The diff coverage is 70.21%.

@@            Coverage Diff             @@
##             main     #281      +/-   ##
==========================================
+ Coverage   80.22%   80.23%   +0.01%     
==========================================
  Files          53       53              
  Lines        5897     6098     +201     
==========================================
+ Hits         4731     4893     +162     
- Misses        907      943      +36     
- Partials      259      262       +3

Impacted Files	Coverage Δ
pkg/filter/proxy/proxy.go	`78.30% <55.55%> (-6.21%)`	⬇️
pkg/object/meshcontroller/spec/spec.go	`86.95% <78.31%> (-2.57%)`	⬇️
pkg/filter/proxy/pool.go	`84.02% <100.00%> (ø)`
pkg/object/mqttproxy/storage.go	`94.87% <0.00%> (-5.13%)`	⬇️
pkg/object/mqttproxy/session_manager.go	`86.36% <0.00%> (-3.81%)`	⬇️
pkg/object/mqttproxy/spec.go	`100.00% <0.00%> (ø)`
pkg/object/mqttproxy/topic.go	`100.00% <0.00%> (+0.46%)`	⬆️
pkg/object/mqttproxy/session.go	`82.31% <0.00%> (+0.83%)`	⬆️
pkg/object/mqttproxy/client.go	`81.09% <0.00%> (+2.15%)`	⬆️
... and 1 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c0f5200...4d79455. Read the comment docs.

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

pkg/filter/proxy/proxy.go

pkg/object/httpserver/spec.go

pkg/object/meshcontroller/certmanager/certmanager.go

pkg/object/meshcontroller/layout/layout.go

pkg/object/meshcontroller/master/master.go

pkg/object/meshcontroller/spec/spec.go

megaeasex

[TASK:easegress-pr-test FAILED]megaease/easegress Pull Request 281 Deploy Test failed

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

pkg/filter/proxy/proxy.go

pkg/object/meshcontroller/certmanager/certmanager.go

pkg/object/meshcontroller/certmanager/meshcertprovider.go

pkg/object/meshcontroller/certmanager/certmanager.go

pkg/object/meshcontroller/certmanager/meshcertprovider.go

pkg/object/meshcontroller/informer/informer.go

megaeasex

[TASK:easegress-pr-test FAILED]megaease/easegress Pull Request 281 Deploy Test failed

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

haoel · 2021-10-13T07:55:36Z

by the way, the unit testing code coverage looks decreased, please make sure we need to meet >80% coverage.

benja-wu · 2021-10-13T07:56:52Z

by the way, the unit testing code coverage looks decreased, please make sure we need to meet >80% coverage.

https://codecov.io/github/megaease/easegress/commit/2e9e0e77e82f5738744a176cd7b42882786f76c4
The latest commit brings the coverage rate back to 80.21% already.

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

Co-authored-by: Bomin Zhang <[email protected]>

Co-authored-by: Hao Chen <[email protected]>

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

pkg/object/httpserver/spec.go

xxx7xxxx · 2021-10-19T03:56:55Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ }
+
+ // CertProvider is the interface declaring the methods for the Certificate provider, such as
+ // easemesh-self-sign, Valt, and so on.


Suggested change

// easemesh-self-sign, Valt, and so on.

// easemesh-self-sign, Valt, and so on.

xxx7xxxx · 2021-10-19T03:57:38Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ // CertProvider is the interface declaring the methods for the Certificate provider, such as
+ // easemesh-self-sign, Valt, and so on.
+ CertProvider interface {
+ // SignAppCertAndKey signs a cert, key pair for one service's instance


Suggested change

// SignAppCertAndKey signs a cert, key pair for one service's instance

// SignAppCertAndKey signs a cert, key pair for one service's instance

xxx7xxxx · 2021-10-19T03:57:53Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ // easemesh-self-sign, Valt, and so on.
+ CertProvider interface {
+ // SignAppCertAndKey signs a cert, key pair for one service's instance
+ SignAppCertAndKey(serviceName string, HOST, IP string, ttl time.Duration) (cert *spec.Certificate, err error)


Suggested change

SignAppCertAndKey(serviceName string, HOST, IP string, ttl time.Duration) (cert *spec.Certificate, err error)

SignAppCertAndKey(serviceName string, host, ip string, ttl time.Duration) (cert *spec.Certificate, err error)

xxx7xxxx · 2021-10-19T03:58:11Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ SignRootCertAndKey(time.Duration) (cert *spec.Certificate, err error)
+
+ // GetAppCertAndKey gets cert and key for one service's instance
+ GetAppCertAndKey(serviceName, HOST, IP string) (cert *spec.Certificate, err error)


Suggested change

GetAppCertAndKey(serviceName, HOST, IP string) (cert *spec.Certificate, err error)

GetAppCertAndKey(serviceName, host, ip string) (cert *spec.Certificate, err error)

xxx7xxxx · 2021-10-19T03:58:38Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ GetRootCertAndKey() (cert *spec.Certificate, err error)
+
+ // ReleaseAppCertAndKey releases one service instance's cert and key
+ ReleaseAppCertAndKey(serviceName, HOST, IP string) error


Suggested change

ReleaseAppCertAndKey(serviceName, HOST, IP string) error

ReleaseAppCertAndKey(serviceName, host, ip string) error

xxx7xxxx · 2021-10-19T03:59:38Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ // ReleaseRootCertAndKey releases root CA cert and key
+ ReleaseRootCertAndKey() error
+
+ // SetRootCertAndKey sets exists app cert


Suggested change

// SetRootCertAndKey sets exists app cert

// SetRootCertAndKey sets existing app cert

xxx7xxxx · 2021-10-19T03:59:52Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ ReleaseRootCertAndKey() error
+
+ // SetRootCertAndKey sets exists app cert
+ SetAppCertAndKey(serviceName, HOST, IP string, cert *spec.Certificate) error


Suggested change

SetAppCertAndKey(serviceName, HOST, IP string, cert *spec.Certificate) error

SetAppCertAndKey(serviceName, host, ip string, cert *spec.Certificate) error

xxx7xxxx · 2021-10-19T04:00:23Z

pkg/object/meshcontroller/certmanager/certmanager.go

+ }
+)
+
+// NewCertManager creates a initialed certmanager.


Suggested change

// NewCertManager creates a initialed certmanager.

// NewCertManager creates a certmanager.

megaeasex

[TASK:easegress-pr-test SUCCESS]megaease/easegress Pull Request 281 Deploy Test Success

benja-wu added the enhancement New feature or request label Sep 28, 2021

megaeasex approved these changes Sep 28, 2021

View reviewed changes

megaeasex approved these changes Oct 11, 2021

View reviewed changes

benja-wu marked this pull request as ready for review October 11, 2021 13:54

benja-wu requested review from xxx7xxxx and localvar October 11, 2021 13:55

benja-wu marked this pull request as draft October 11, 2021 14:08

megaeasex approved these changes Oct 12, 2021

View reviewed changes

benja-wu marked this pull request as ready for review October 12, 2021 03:14

localvar reviewed Oct 13, 2021

View reviewed changes

megaeasex suggested changes Oct 13, 2021

View reviewed changes

megaeasex approved these changes Oct 13, 2021

View reviewed changes

haoel suggested changes Oct 13, 2021

View reviewed changes

megaeasex suggested changes Oct 13, 2021

View reviewed changes

megaeasex approved these changes Oct 13, 2021

View reviewed changes

megaeasex approved these changes Oct 14, 2021

View reviewed changes

megaeasex approved these changes Oct 15, 2021

View reviewed changes

benja-wu added 4 commits October 15, 2021 13:30

[mesh] add cert manager

4f2b19e

[mesh] fix conflict

f7fddd6

[mesh] add define

641ccb3

[mesh] add ingress controller cert handling

ead2cc1

benja-wu and others added 18 commits October 15, 2021 13:30

[mesh] refactor and raise coverage rate

6c7169f

[mesh] fix provider bug

3f91db9

[mesh] fix mTLS cert bug

41f3384

Apply suggestions from localvar's code review

6fa71ca

Co-authored-by: Bomin Zhang <[email protected]>

[mesh] refactor according to localvar's comments

4f098e0

[mesh] raise coverage rate

9f21ffb

Update pkg/filter/proxy/proxy.go

8acf532

Co-authored-by: Hao Chen <[email protected]>

[mesh] update with haoel's comments

feabf4c

[mesh] refactor informer server and ingresscontroller onCert func

7a25939

[mesh] fix typo

5c700c1

[mesh] fix ingress httpserver bug and update spec test

80f1075

[mesh] solve conflict

2219f47

[mesh] fix warning and bug

bfa1adf

[mesh] fix typo

b070002

[mesh] fix init bug and add more info log

da40e57

[mesh] fix mTLS bugs

7cc86b8

[mesh] fix auto test

72b2c1b

[mesh] ingress/egress use its own informer

cc9ff8d

megaeasex approved these changes Oct 15, 2021

View reviewed changes

[mesh] add closing informer in ingress/egress

39fb8d2

megaeasex approved these changes Oct 15, 2021

View reviewed changes

xxx7xxxx reviewed Oct 19, 2021

View reviewed changes

[mesh] udpate according to yunlong's comments

4d79455

megaeasex approved these changes Oct 19, 2021

View reviewed changes

xxx7xxxx approved these changes Oct 19, 2021

View reviewed changes

localvar approved these changes Oct 19, 2021

View reviewed changes

localvar requested a review from haoel October 19, 2021 07:58

localvar merged commit 514ba09 into easegress-io:main Oct 19, 2021

benja-wu deleted the security branch October 23, 2021 11:18

samutamm mentioned this pull request Jan 18, 2022

Support mTLS client certificate authenticating #467

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[mesh] enable mTLS #281

[mesh] enable mTLS #281

benja-wu commented Sep 28, 2021

megaeasex left a comment

megaeasex left a comment

codecov-commenter commented Oct 11, 2021 •

edited

Loading

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

haoel commented Oct 13, 2021

benja-wu commented Oct 13, 2021 •

edited

Loading

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

megaeasex left a comment

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

xxx7xxxx Oct 19, 2021

megaeasex left a comment

	// easemesh-self-sign, Valt, and so on.
	// easemesh-self-sign, Valt, and so on.

	// SignAppCertAndKey signs a cert, key pair for one service's instance
	// SignAppCertAndKey signs a cert, key pair for one service's instance

	SignAppCertAndKey(serviceName string, HOST, IP string, ttl time.Duration) (cert *spec.Certificate, err error)
	SignAppCertAndKey(serviceName string, host, ip string, ttl time.Duration) (cert *spec.Certificate, err error)

	GetAppCertAndKey(serviceName, HOST, IP string) (cert *spec.Certificate, err error)
	GetAppCertAndKey(serviceName, host, ip string) (cert *spec.Certificate, err error)

	ReleaseAppCertAndKey(serviceName, HOST, IP string) error
	ReleaseAppCertAndKey(serviceName, host, ip string) error

	// SetRootCertAndKey sets exists app cert
	// SetRootCertAndKey sets existing app cert

	SetAppCertAndKey(serviceName, HOST, IP string, cert *spec.Certificate) error
	SetAppCertAndKey(serviceName, host, ip string, cert *spec.Certificate) error

	// NewCertManager creates a initialed certmanager.
	// NewCertManager creates a certmanager.

[mesh] enable mTLS #281

[mesh] enable mTLS #281

Conversation

benja-wu commented Sep 28, 2021

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

codecov-commenter commented Oct 11, 2021 • edited Loading

Codecov Report

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

haoel commented Oct 13, 2021

benja-wu commented Oct 13, 2021 • edited Loading

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

megaeasex left a comment

Choose a reason for hiding this comment

codecov-commenter commented Oct 11, 2021 •

edited

Loading

benja-wu commented Oct 13, 2021 •

edited

Loading