particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

worker: Add identity filter and client oauth support

Browse source
This commit is contained in:
sanne 2021-06-07 09:33:21 +02:00 • committed by Sanne Raymaekers
parent 968e7b210f
commit 0ea31c39d5
11 changed files with 277 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

26
cmd/osbuild-composer/composer.go
View file

@ -68,7 +68,7 @@ func NewComposer(config *ComposerConfigFile, stateDir, cacheDir string, logger *
return nil, fmt.Errorf("cannot create jobqueue: %v", err)
}
c.workers = worker.NewServer(c.logger, jobs, artifactsDir)
c.workers = worker.NewServer(c.logger, jobs, artifactsDir, c.config.WorkerAPI.IdentityFilter)
return &c, nil
}
@ -135,17 +135,21 @@ func (c *Composer) InitLocalWorker(l net.Listener) {
}
func (c *Composer) InitRemoteWorkers(cert, key string, l net.Listener) error {
tlsConfig, err := createTLSConfig(&connectionConfig{
CACertFile: c.config.Worker.CA,
ServerKeyFile: key,
ServerCertFile: cert,
AllowedDomains: c.config.Worker.AllowedDomains,
})
if err != nil {
return fmt.Errorf("Error creating TLS configuration for remote worker API: %v", err)
}
if len(c.config.WorkerAPI.IdentityFilter) > 0 {
c.workerListener = l
} else {
tlsConfig, err := createTLSConfig(&connectionConfig{
CACertFile: c.config.Worker.CA,
ServerKeyFile: key,
ServerCertFile: cert,
AllowedDomains: c.config.Worker.AllowedDomains,
})
if err != nil {
return fmt.Errorf("Error creating TLS configuration for remote worker API: %v", err)
}
c.workerListener = tls.NewListener(l, tlsConfig)
c.workerListener = tls.NewListener(l, tlsConfig)
}
return nil
}

3
cmd/osbuild-composer/config.go
View file

@ -18,6 +18,9 @@ type ComposerConfigFile struct {
ComposerAPI struct {
IdentityFilter []string `toml:"identity_filter"`
} `toml:"composer_api"`
WorkerAPI struct {
IdentityFilter []string `toml:"identity_filter"`
} `toml:"worker_api"`
}
func LoadConfig(name string) (*ComposerConfigFile, error) {

23
cmd/osbuild-worker/main.go
View file

@ -90,12 +90,16 @@ func main() {
Azure *struct {
Credentials string `toml:"credentials"`
} `toml:"azure"`
Authentication *struct {
OAuthURL string `toml:"oauth_url"`
OfflineTokenPath string `toml:"offline_token"`
} `toml:"authentication"`
}
var unix bool
flag.BoolVar(&unix, "unix", false, "Interpret 'address' as a path to a unix domain socket instead of a network address")
flag.Usage = func() {
fmt.Fprintf(flag.CommandLine.Output(), "Usage: %s [-unix] address\n", os.Args[0])
fmt.Fprintf(flag.CommandLine.Output(), "Usage: %s [-unix] address basepath\n", os.Args[0])
flag.PrintDefaults()
os.Exit(0)
}
@ -142,6 +146,21 @@ func main() {
var client *worker.Client
if unix {
client = worker.NewClientUnix(address)
} else if config.Authentication != nil && config.Authentication.OfflineTokenPath != "" {
t, err := ioutil.ReadFile(config.Authentication.OfflineTokenPath)
if err != nil {
log.Fatalf("Could not read offline token: %v", err)
}
token := string(t)
if config.Authentication.OAuthURL == "" {
log.Fatal("OAuth URL should be specified together with the offline token")
}
client, err = worker.NewClient("https://"+address, nil, &token, &config.Authentication.OAuthURL)
if err != nil {
log.Fatalf("Error creating worker client: %v", err)
}
} else {
conf, err := createTLSConfig(&connectionConfig{
CACertFile: "/etc/osbuild-composer/ca-crt.pem",
@ -152,7 +171,7 @@ func main() {
log.Fatalf("Error creating TLS config: %v", err)
}
client, err = worker.NewClient("https://"+address, conf)
client, err = worker.NewClient("https://"+address, conf, nil, nil)
if err != nil {
log.Fatalf("Error creating worker client: %v", err)
}