mirror of https://github.com/grpc/grpc-java.git
xds: implement ZatarCertificateProviderProvider (#7526)
This commit is contained in:
sanjaypujare
GitHub
parent
0b6f29371b
commit
0e7cd05bf4
|
|
@ -177,4 +177,47 @@ final class ZatarCertificateProvider extends CertificateProvider {
|
|||
checkAndReloadCertificates();
|
||||
}
|
||||
}
|
||||
|
||||
abstract static class Factory {
|
||||
private static final Factory DEFAULT_INSTANCE =
|
||||
new Factory() {
|
||||
@Override
|
||||
ZatarCertificateProvider create(
|
||||
DistributorWatcher watcher,
|
||||
boolean notifyCertUpdates,
|
||||
String directory,
|
||||
String certFile,
|
||||
String privateKeyFile,
|
||||
String trustFile,
|
||||
long refreshIntervalInSeconds,
|
||||
ScheduledExecutorService scheduledExecutorService,
|
||||
TimeProvider timeProvider) {
|
||||
return new ZatarCertificateProvider(
|
||||
watcher,
|
||||
notifyCertUpdates,
|
||||
directory,
|
||||
certFile,
|
||||
privateKeyFile,
|
||||
trustFile,
|
||||
refreshIntervalInSeconds,
|
||||
scheduledExecutorService,
|
||||
timeProvider);
|
||||
}
|
||||
};
|
||||
|
||||
static Factory getInstance() {
|
||||
return DEFAULT_INSTANCE;
|
||||
}
|
||||
|
||||
abstract ZatarCertificateProvider create(
|
||||
DistributorWatcher watcher,
|
||||
boolean notifyCertUpdates,
|
||||
String directory,
|
||||
String certFile,
|
||||
String privateKeyFile,
|
||||
String trustFile,
|
||||
long refreshIntervalInSeconds,
|
||||
ScheduledExecutorService scheduledExecutorService,
|
||||
TimeProvider timeProvider);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,138 @@
|
|||
/*
|
||||
* Copyright 2020 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.internal.certprovider;
|
||||
|
||||
import static com.google.common.base.Preconditions.checkArgument;
|
||||
import static com.google.common.base.Preconditions.checkNotNull;
|
||||
|
||||
import com.google.common.annotations.VisibleForTesting;
|
||||
import com.google.common.util.concurrent.ThreadFactoryBuilder;
|
||||
import io.grpc.internal.JsonUtil;
|
||||
import io.grpc.internal.TimeProvider;
|
||||
import java.util.Map;
|
||||
import java.util.concurrent.Executors;
|
||||
import java.util.concurrent.ScheduledExecutorService;
|
||||
|
||||
/**
|
||||
* Provider of {@link ZatarCertificateProvider}s.
|
||||
*/
|
||||
final class ZatarCertificateProviderProvider implements CertificateProviderProvider {
|
||||
|
||||
private static final String DIRECTORY_KEY = "directory";
|
||||
private static final String CERT_FILE_KEY = "certificate-file";
|
||||
private static final String KEY_FILE_KEY = "private-key-file";
|
||||
private static final String ROOT_FILE_KEY = "ca-certificate-file";
|
||||
private static final String REFRESH_INTERVAL_KEY = "refresh-interval";
|
||||
|
||||
@VisibleForTesting static final long REFRESH_INTERVAL_DEFAULT = 600L;
|
||||
|
||||
|
||||
static final String ZATAR_PROVIDER_NAME = "gke-cas-certs";
|
||||
|
||||
static {
|
||||
CertificateProviderRegistry.getInstance()
|
||||
.register(
|
||||
new ZatarCertificateProviderProvider(
|
||||
ZatarCertificateProvider.Factory.getInstance(),
|
||||
ScheduledExecutorServiceFactory.DEFAULT_INSTANCE,
|
||||
TimeProvider.SYSTEM_TIME_PROVIDER));
|
||||
}
|
||||
|
||||
final ZatarCertificateProvider.Factory zatarCertificateProviderFactory;
|
||||
private final ScheduledExecutorServiceFactory scheduledExecutorServiceFactory;
|
||||
private final TimeProvider timeProvider;
|
||||
|
||||
@VisibleForTesting
|
||||
ZatarCertificateProviderProvider(
|
||||
ZatarCertificateProvider.Factory zatarCertificateProviderFactory,
|
||||
ScheduledExecutorServiceFactory scheduledExecutorServiceFactory,
|
||||
TimeProvider timeProvider) {
|
||||
this.zatarCertificateProviderFactory = zatarCertificateProviderFactory;
|
||||
this.scheduledExecutorServiceFactory = scheduledExecutorServiceFactory;
|
||||
this.timeProvider = timeProvider;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getName() {
|
||||
return ZATAR_PROVIDER_NAME;
|
||||
}
|
||||
|
||||
@Override
|
||||
public CertificateProvider createCertificateProvider(
|
||||
Object config, CertificateProvider.DistributorWatcher watcher, boolean notifyCertUpdates) {
|
||||
|
||||
Config configObj = validateAndTranslateConfig(config);
|
||||
return zatarCertificateProviderFactory.create(
|
||||
watcher,
|
||||
notifyCertUpdates,
|
||||
configObj.directory,
|
||||
configObj.certFile,
|
||||
configObj.keyFile,
|
||||
configObj.rootFile,
|
||||
configObj.refrehInterval,
|
||||
scheduledExecutorServiceFactory.create(),
|
||||
timeProvider);
|
||||
}
|
||||
|
||||
private static String checkForNullAndGet(Map<String, ?> map, String key) {
|
||||
return checkNotNull(JsonUtil.getString(map, key), "'" + key + "' is required in the config");
|
||||
}
|
||||
|
||||
private static Config validateAndTranslateConfig(Object config) {
|
||||
checkArgument(config instanceof Map, "Only Map supported for config");
|
||||
@SuppressWarnings("unchecked") Map<String, ?> map = (Map<String, ?>)config;
|
||||
|
||||
Config configObj = new Config();
|
||||
configObj.directory = checkForNullAndGet(map, DIRECTORY_KEY);
|
||||
configObj.certFile = checkForNullAndGet(map, CERT_FILE_KEY);
|
||||
configObj.keyFile = checkForNullAndGet(map, KEY_FILE_KEY);
|
||||
configObj.rootFile = checkForNullAndGet(map, ROOT_FILE_KEY);
|
||||
configObj.refrehInterval = JsonUtil.getNumberAsLong(map, REFRESH_INTERVAL_KEY);
|
||||
if (configObj.refrehInterval == null) {
|
||||
configObj.refrehInterval = REFRESH_INTERVAL_DEFAULT;
|
||||
}
|
||||
return configObj;
|
||||
}
|
||||
|
||||
abstract static class ScheduledExecutorServiceFactory {
|
||||
|
||||
private static final ScheduledExecutorServiceFactory DEFAULT_INSTANCE =
|
||||
new ScheduledExecutorServiceFactory() {
|
||||
|
||||
@Override
|
||||
ScheduledExecutorService create() {
|
||||
return Executors.newSingleThreadScheduledExecutor(
|
||||
new ThreadFactoryBuilder()
|
||||
.setNameFormat("zatar" + "-%d")
|
||||
.setDaemon(true)
|
||||
.build());
|
||||
}
|
||||
};
|
||||
|
||||
abstract ScheduledExecutorService create();
|
||||
}
|
||||
|
||||
/** POJO class for storing various config values. */
|
||||
@VisibleForTesting
|
||||
static class Config {
|
||||
String directory;
|
||||
String certFile;
|
||||
String keyFile;
|
||||
String rootFile;
|
||||
Long refrehInterval;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,214 @@
|
|||
/*
|
||||
* Copyright 2020 The gRPC Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package io.grpc.xds.internal.certprovider;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static org.junit.Assert.fail;
|
||||
import static org.mockito.ArgumentMatchers.eq;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.times;
|
||||
import static org.mockito.Mockito.verify;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
import io.grpc.internal.JsonParser;
|
||||
import io.grpc.internal.TimeProvider;
|
||||
import java.io.IOException;
|
||||
import java.util.Map;
|
||||
import java.util.concurrent.ScheduledExecutorService;
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
import org.mockito.Mock;
|
||||
import org.mockito.MockitoAnnotations;
|
||||
|
||||
/** Unit tests for {@link ZatarCertificateProviderProvider}. */
|
||||
@RunWith(JUnit4.class)
|
||||
public class ZatarCertificateProviderProviderTest {
|
||||
|
||||
@Mock ZatarCertificateProvider.Factory zatarCertificateProviderFactory;
|
||||
@Mock private ZatarCertificateProviderProvider.ScheduledExecutorServiceFactory
|
||||
scheduledExecutorServiceFactory;
|
||||
@Mock private TimeProvider timeProvider;
|
||||
|
||||
private ZatarCertificateProviderProvider provider;
|
||||
|
||||
@Before
|
||||
public void setUp() throws IOException {
|
||||
MockitoAnnotations.initMocks(this);
|
||||
provider =
|
||||
new ZatarCertificateProviderProvider(
|
||||
zatarCertificateProviderFactory, scheduledExecutorServiceFactory, timeProvider);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void providerRegisteredName() {
|
||||
CertificateProviderProvider certProviderProvider =
|
||||
CertificateProviderRegistry.getInstance()
|
||||
.getProvider(ZatarCertificateProviderProvider.ZATAR_PROVIDER_NAME);
|
||||
assertThat(certProviderProvider).isInstanceOf(ZatarCertificateProviderProvider.class);
|
||||
ZatarCertificateProviderProvider zatarCertificateProviderProvider =
|
||||
(ZatarCertificateProviderProvider) certProviderProvider;
|
||||
assertThat(zatarCertificateProviderProvider.zatarCertificateProviderFactory)
|
||||
.isSameInstanceAs(ZatarCertificateProvider.Factory.getInstance());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createProvider_minimalConfig() throws IOException {
|
||||
CertificateProvider.DistributorWatcher distWatcher =
|
||||
new CertificateProvider.DistributorWatcher();
|
||||
@SuppressWarnings("unchecked")
|
||||
Map<String, ?> map = (Map<String, ?>) JsonParser.parse(MINIMAL_ZATAR_CONFIG);
|
||||
ScheduledExecutorService mockService = mock(ScheduledExecutorService.class);
|
||||
when(scheduledExecutorServiceFactory.create()).thenReturn(mockService);
|
||||
provider.createCertificateProvider(map, distWatcher, true);
|
||||
verify(zatarCertificateProviderFactory, times(1))
|
||||
.create(
|
||||
eq(distWatcher),
|
||||
eq(true),
|
||||
eq("/var/run/gke-spiffe/certs/..data"),
|
||||
eq("certificates.pem"),
|
||||
eq("private_key.pem"),
|
||||
eq("ca_certificates.pem"),
|
||||
eq(600L),
|
||||
eq(mockService),
|
||||
eq(timeProvider));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createProvider_fullConfig() throws IOException {
|
||||
CertificateProvider.DistributorWatcher distWatcher =
|
||||
new CertificateProvider.DistributorWatcher();
|
||||
@SuppressWarnings("unchecked")
|
||||
Map<String, ?> map = (Map<String, ?>) JsonParser.parse(FULL_ZATAR_CONFIG);
|
||||
ScheduledExecutorService mockService = mock(ScheduledExecutorService.class);
|
||||
when(scheduledExecutorServiceFactory.create()).thenReturn(mockService);
|
||||
provider.createCertificateProvider(map, distWatcher, true);
|
||||
verify(zatarCertificateProviderFactory, times(1))
|
||||
.create(
|
||||
eq(distWatcher),
|
||||
eq(true),
|
||||
eq("/var/run/gke-spiffe/certs/..data1"),
|
||||
eq("certificates2.pem"),
|
||||
eq("private_key3.pem"),
|
||||
eq("ca_certificates4.pem"),
|
||||
eq(7890L),
|
||||
eq(mockService),
|
||||
eq(timeProvider));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createProvider_missingDir_expectException() throws IOException {
|
||||
CertificateProvider.DistributorWatcher distWatcher =
|
||||
new CertificateProvider.DistributorWatcher();
|
||||
@SuppressWarnings("unchecked")
|
||||
Map<String, ?> map = (Map<String, ?>) JsonParser.parse(MISSING_DIR_CONFIG);
|
||||
try {
|
||||
provider.createCertificateProvider(map, distWatcher, true);
|
||||
fail("exception expected");
|
||||
} catch (NullPointerException npe) {
|
||||
assertThat(npe).hasMessageThat().isEqualTo("'directory' is required in the config");
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createProvider_missingCert_expectException() throws IOException {
|
||||
CertificateProvider.DistributorWatcher distWatcher =
|
||||
new CertificateProvider.DistributorWatcher();
|
||||
@SuppressWarnings("unchecked")
|
||||
Map<String, ?> map = (Map<String, ?>) JsonParser.parse(MISSING_CERT_CONFIG);
|
||||
try {
|
||||
provider.createCertificateProvider(map, distWatcher, true);
|
||||
fail("exception expected");
|
||||
} catch (NullPointerException npe) {
|
||||
assertThat(npe).hasMessageThat().isEqualTo("'certificate-file' is required in the config");
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createProvider_missingKey_expectException() throws IOException {
|
||||
CertificateProvider.DistributorWatcher distWatcher =
|
||||
new CertificateProvider.DistributorWatcher();
|
||||
@SuppressWarnings("unchecked")
|
||||
Map<String, ?> map = (Map<String, ?>) JsonParser.parse(MISSING_KEY_CONFIG);
|
||||
try {
|
||||
provider.createCertificateProvider(map, distWatcher, true);
|
||||
fail("exception expected");
|
||||
} catch (NullPointerException npe) {
|
||||
assertThat(npe).hasMessageThat().isEqualTo("'private-key-file' is required in the config");
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createProvider_missingRoot_expectException() throws IOException {
|
||||
CertificateProvider.DistributorWatcher distWatcher =
|
||||
new CertificateProvider.DistributorWatcher();
|
||||
@SuppressWarnings("unchecked")
|
||||
Map<String, ?> map = (Map<String, ?>) JsonParser.parse(MISSING_ROOT_CONFIG);
|
||||
try {
|
||||
provider.createCertificateProvider(map, distWatcher, true);
|
||||
fail("exception expected");
|
||||
} catch (NullPointerException npe) {
|
||||
assertThat(npe).hasMessageThat().isEqualTo("'ca-certificate-file' is required in the config");
|
||||
}
|
||||
}
|
||||
|
||||
private static final String MINIMAL_ZATAR_CONFIG =
|
||||
"{\n"
|
||||
+ " \"directory\": \"/var/run/gke-spiffe/certs/..data\","
|
||||
+ " \"certificate-file\": \"certificates.pem\","
|
||||
+ " \"private-key-file\": \"private_key.pem\","
|
||||
+ " \"ca-certificate-file\": \"ca_certificates.pem\""
|
||||
+ " }";
|
||||
|
||||
private static final String FULL_ZATAR_CONFIG =
|
||||
"{\n"
|
||||
+ " \"directory\": \"/var/run/gke-spiffe/certs/..data1\","
|
||||
+ " \"certificate-file\": \"certificates2.pem\","
|
||||
+ " \"private-key-file\": \"private_key3.pem\","
|
||||
+ " \"ca-certificate-file\": \"ca_certificates4.pem\","
|
||||
+ " \"refresh-interval\": 7890"
|
||||
+ " }";
|
||||
|
||||
private static final String MISSING_DIR_CONFIG =
|
||||
"{\n"
|
||||
+ " \"certificate-file\": \"certificates.pem\","
|
||||
+ " \"private-key-file\": \"private_key.pem\","
|
||||
+ " \"ca-certificate-file\": \"ca_certificates.pem\""
|
||||
+ " }";
|
||||
|
||||
private static final String MISSING_CERT_CONFIG =
|
||||
"{\n"
|
||||
+ " \"directory\": \"/var/run/gke-spiffe/certs/..data\","
|
||||
+ " \"private-key-file\": \"private_key.pem\","
|
||||
+ " \"ca-certificate-file\": \"ca_certificates.pem\""
|
||||
+ " }";
|
||||
|
||||
private static final String MISSING_KEY_CONFIG =
|
||||
"{\n"
|
||||
+ " \"directory\": \"/var/run/gke-spiffe/certs/..data\","
|
||||
+ " \"certificate-file\": \"certificates.pem\","
|
||||
+ " \"ca-certificate-file\": \"ca_certificates.pem\""
|
||||
+ " }";
|
||||
|
||||
private static final String MISSING_ROOT_CONFIG =
|
||||
"{\n"
|
||||
+ " \"directory\": \"/var/run/gke-spiffe/certs/..data\","
|
||||
+ " \"certificate-file\": \"certificates.pem\","
|
||||
+ " \"private-key-file\": \"private_key.pem\""
|
||||
+ " }";
|
||||
}
|
||||
Loading…
Reference in New Issue