Mutual tls support for falcosidekick authentication #231

jasiam · 2021-04-15T15:02:33Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area outputs

What this PR does / why we need it:

It adds mutual tls support to be used in alertmanager, elasticsearch, influxdb, NATs and webhook outputs

Which issue(s) this PR fixes:

Fixes #216

Special notes for your reviewer:

poiana · 2021-04-15T15:02:41Z

Welcome @jasiam! It looks like this is your first PR to falcosecurity/falcosidekick 🎉

Issif · 2021-04-15T19:14:07Z

Can you complete the description of your PR please.

Issif

I know it's a WIP, I just added few suggestions and comments.

I like the client_test.go with crt/key generation for unit tests. 👍

config_example.yaml

outputs/client.go

config_example.yaml

main.go

Issif · 2021-04-15T21:28:54Z

main.go

@@ -282,7 +282,7 @@ func init() {

 	if config.CloudEvents.Address != "" {
 		var err error
-		cloudeventsClient, err = outputs.NewClient("CloudEvents", config.CloudEvents.Address, config, stats, promStats, statsdClient, dogstatsdClient)
+		cloudeventsClient, err = outputs.NewClient("CloudEvents", config.CloudEvents.Address, false, config, stats, promStats, statsdClient, dogstatsdClient)


Suggested change

cloudeventsClient, err = outputs.NewClient("CloudEvents", config.CloudEvents.Address, false, config, stats, promStats, statsdClient, dogstatsdClient)

cloudeventsClient, err = outputs.NewClient("CloudEvents", config.CloudEvents.Address, config.CloudEvents.MutualTls, config, stats, promStats, statsdClient, dogstatsdClient)

main.go

outputs/client.go

jasiam · 2021-04-16T04:29:34Z

Do we really want to add the mutualtls support for all outputs which use the NewClient method? For instance, Loki doesn't support this kind of authentication (or any) and you'd need a reverse proxy in order to use it.

Issif · 2021-04-16T07:52:51Z

Do we really want to add the mutualtls support for all outputs which use the NewClient method? For instance, Loki doesn't support this kind of authentication (or any) and you'd need a reverse proxy in order to use it.

Only for outputs which allow it. This is why it's a "by output" setting.

jasiam · 2021-04-16T08:23:21Z

Do we really want to add the mutualtls support for all outputs which use the NewClient method? For instance, Loki doesn't support this kind of authentication (or any) and you'd need a reverse proxy in order to use it.

Only for outputs which allow it. This is why it's a "by output" setting.

So... I'm confused. Do you want to add the config.[OUTPUT].MutualTLS parameter in the NewClient method even if the output doesn't support mutual tls authN? I know the default value is false, but I'm afraid some users think they can use mutual tls when the actually can't.
If you want to, I can contact you over slack and discuss it.

jasiam · 2021-04-16T09:07:02Z

Can you complete the description of your PR please.

It's super weird. If I try to edit the description I can see everything I wrote yesterday when I opened the PR, but nothing is shown when I update it.

config_example.yaml

outputs/client.go

Issif · 2021-04-16T18:58:32Z

Do we really want to add the mutualtls support for all outputs which use the NewClient method? For instance, Loki doesn't support this kind of authentication (or any) and you'd need a reverse proxy in order to use it.

Only for outputs which allow it. This is why it's a "by output" setting.

So... I'm confused. Do you want to add the config.[OUTPUT].MutualTLS parameter in the NewClient method even if the output doesn't support mutual tls authN? I know the default value is false, but I'm afraid some users think they can use mutual tls when the actually can't.
If you want to, I can contact you over slack and discuss it.

We can discuss about this on Slack, feel free to contact me 😉

Signed-off-by: Jose Angel Santiago <>

Issif

The README is not up to date with config_example.yaml and it misses variables for MutualTLS and CheckCert in list of env vars.

In config.go, default values are missing for MutualTLS and CheckCert, they should all be there, to only have explicit values.

Thanks. 🙏

config.go

config_example.yaml

outputs/openfaas.go

outputs/kubeless.go

config.go

Signed-off-by: Jose Angel Santiago <>

jasiam · 2021-04-30T08:32:57Z

The README is not up to date with config_example.yaml and it misses variables for MutualTLS and CheckCert in list of env vars.

In config.go, default values are missing for MutualTLS and CheckCert, they should all be there, to only have explicit values.

Thanks.

I think all required changes are now in the PR

Issif

can you check both README and config_example have same variables please

README.md

config_example.yaml

Signed-off-by: Jose Angel Santiago <>

jasiam · 2021-04-30T10:57:17Z

can you check both README and config_example have same variables please

My fault, I forgot to update the env vars part in README file. Now README and config_example.yaml files are synchronized.

poiana · 2021-04-30T11:05:04Z

LGTM label has been added.

Git tree hash: 3d064bd02d27d3037c12c366a66340c2333994b1

poiana · 2021-04-30T11:05:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Issif

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Issif]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Issif · 2021-04-30T12:29:09Z

/ready

developer-guy · 2021-06-23T11:30:40Z

config.go

 	v.SetDefault("Kafka.HostPort", "")
 	v.SetDefault("Kafka.Topic", "")
 	v.SetDefault("Kafka.MinimumPriority", "")
 	v.SetDefault("Pagerduty.RoutingKey", "")
 	v.SetDefault("Pagerduty.MinimumPriority", "")
+	v.SetDefault("Googlechat.MutualTls", false)


I think there should be PagerDuty.MutualTls.
@Issif @jasiam

poiana added kind/feature New feature or request dco-signoff: yes labels Apr 15, 2021

poiana requested review from cpanato and leodido April 15, 2021 15:02

poiana added the size/XL label Apr 15, 2021

jasiam force-pushed the mutualTLS-support branch from 1e714aa to c369704 Compare April 15, 2021 16:41

Issif added this to In progress in 2.x via automation Apr 15, 2021

Issif added this to the 2.23.0 milestone Apr 15, 2021

Issif changed the title ~~Mutual tls support for falcosidekick authentication~~ WIP: Mutual tls support for falcosidekick authentication Apr 15, 2021

poiana added the do-not-merge/work-in-progress label Apr 15, 2021

Issif requested changes Apr 15, 2021

View reviewed changes

poiana assigned Issif Apr 15, 2021

poiana added the needs-rebase label Apr 16, 2021

Issif requested changes Apr 16, 2021

View reviewed changes

config_example.yaml Outdated Show resolved Hide resolved

config_example.yaml Show resolved Hide resolved

outputs/client.go Show resolved Hide resolved

poiana added size/XXL and removed size/XL labels Apr 23, 2021

Move checkcert parameter from global to per-output configuration

9e6b0f4

Signed-off-by: Jose Angel Santiago <>

jasiam force-pushed the mutualTLS-support branch from cc75cf3 to 9e6b0f4 Compare April 23, 2021 11:41

poiana removed the needs-rebase label Apr 23, 2021

Issif requested changes Apr 28, 2021

View reviewed changes

Update README and remove checkcert feature from SaaS exclusive outputs

ee0392e

Signed-off-by: Jose Angel Santiago <>

Issif requested changes Apr 30, 2021

View reviewed changes

Update README env vars

42fb1d2

Signed-off-by: Jose Angel Santiago <>

jasiam force-pushed the mutualTLS-support branch from e8b0348 to 42fb1d2 Compare April 30, 2021 10:44

Issif approved these changes Apr 30, 2021

View reviewed changes

poiana added the lgtm label Apr 30, 2021

poiana added the approved label Apr 30, 2021

Issif changed the title ~~WIP: Mutual tls support for falcosidekick authentication~~ Mutual tls support for falcosidekick authentication Apr 30, 2021

poiana removed the do-not-merge/work-in-progress label Apr 30, 2021

poiana merged commit 4461d9b into falcosecurity:master Apr 30, 2021

2.x automation moved this from In progress to Done Apr 30, 2021

developer-guy reviewed Jun 23, 2021

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Mutual tls support for falcosidekick authentication #231

Mutual tls support for falcosidekick authentication #231

jasiam commented Apr 15, 2021 •

edited

poiana commented Apr 15, 2021

Issif commented Apr 15, 2021

Issif left a comment

Issif Apr 15, 2021

jasiam commented Apr 16, 2021 •

edited

Issif commented Apr 16, 2021

jasiam commented Apr 16, 2021

jasiam commented Apr 16, 2021 •

edited

Issif commented Apr 16, 2021

Issif left a comment

jasiam commented Apr 30, 2021

Issif left a comment

jasiam commented Apr 30, 2021

poiana commented Apr 30, 2021

poiana commented Apr 30, 2021

Issif commented Apr 30, 2021

developer-guy Jun 23, 2021

	cloudeventsClient, err = outputs.NewClient("CloudEvents", config.CloudEvents.Address, false, config, stats, promStats, statsdClient, dogstatsdClient)
	cloudeventsClient, err = outputs.NewClient("CloudEvents", config.CloudEvents.Address, config.CloudEvents.MutualTls, config, stats, promStats, statsdClient, dogstatsdClient)

Mutual tls support for falcosidekick authentication #231

Mutual tls support for falcosidekick authentication #231

Conversation

jasiam commented Apr 15, 2021 • edited

poiana commented Apr 15, 2021

Issif commented Apr 15, 2021

Issif left a comment

Choose a reason for hiding this comment

Issif Apr 15, 2021

Choose a reason for hiding this comment

jasiam commented Apr 16, 2021 • edited

Issif commented Apr 16, 2021

jasiam commented Apr 16, 2021

jasiam commented Apr 16, 2021 • edited

Issif commented Apr 16, 2021

Issif left a comment

Choose a reason for hiding this comment

jasiam commented Apr 30, 2021

Issif left a comment

Choose a reason for hiding this comment

jasiam commented Apr 30, 2021

poiana commented Apr 30, 2021

poiana commented Apr 30, 2021

Issif commented Apr 30, 2021

developer-guy Jun 23, 2021

Choose a reason for hiding this comment

jasiam commented Apr 15, 2021 •

edited

jasiam commented Apr 16, 2021 •

edited

jasiam commented Apr 16, 2021 •

edited