[NPM] Generate TLS certificates during docker build and bake into image for gRPC secure channels #1262
Conversation
Signed-off-by: Nitish Malhotra <nitishm@microsoft.com>
…into nitishm/feat/generate-certs-grpc
- Fixed an issue with the root command not parsing the config - Removed ca key after signing server cert - Fixed lint errors Signed-off-by: Nitish Malhotra <nitishm@microsoft.com>
…into nitishm/feat/generate-certs-grpc
Signed-off-by: Nitish Malhotra <nitishm@microsoft.com>
Signed-off-by: Nitish Malhotra <nitishm@microsoft.com>
| serverCertPEMFilename = "tls.crt" | ||
| serverKeyPEMFilename = "tls.key" | ||
| caCertPEMFilename = "ca.crt" | ||
| path = "/usr/local/npm" |
There was a problem hiding this comment.
Can we have this path be defined in azure-npm-config ?
There was a problem hiding this comment.
The certs are baked in through the Dockerfile. Not sure how to make that dynamic. Hence I made this static :/
There was a problem hiding this comment.
you could make it dynamic using a volume mount at runtime for a BYO cert situation; it would be better for these to be configurable imo
| if connectClient == nil { | ||
| klog.Info("Reconnecting to gRPC server controller") | ||
| opts := []grpc.CallOption{grpc.WaitForReady(true)} | ||
| opts := []grpc.CallOption{grpc.WaitForReady(false)} |
There was a problem hiding this comment.
curious what this represents and why we had it true before, false now
There was a problem hiding this comment.
True blocks the connection until the server is ready to accept the connection. We don't want to block our connection since the server pod could crash which we are connecting or in the load-balancing case reject the connection in which case the agent would need to block until timeout. Instead we try sending, error out and try reconnecting.
| COPY --from=builder /usr/local/bin/azure-npm \ | ||
| /usr/bin/azure-npm | ||
|
|
||
| COPY --from=builder /usr/local/src/npm/npm/scripts \ |
There was a problem hiding this comment.
is npm/npm/ intentional?
There was a problem hiding this comment.
Yep. Since I didnt want to change the WORKDIR in the builder image (here) which copies the host's source to /usr/local/src/npm it has to be this way.
Signed-off-by: Nitish Malhotra <nitishm@microsoft.com>
4 participants
This change adds the generation of the Server cert and CA cert to the docker image. These certs are available to both the client and the server side to establish a secure gRPC connection between client & server.
Changes include,
TODOs,
Reason for Change:
Issue Fixed:
Requirements:
Notes: