forked from PalmStoneGames/kube-cert-manager
/
processor.go
385 lines (337 loc) · 12.1 KB
/
processor.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
// Copyright 2016 Google Inc. All Rights Reserved.
// Copyright 2016 Palm Stone Games, Inc. All Rights Reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// http://www.apache.org/licenses/LICENSE-2.0
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package main
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"encoding/pem"
"log"
"sync"
"time"
"encoding/json"
"github.com/boltdb/bolt"
"github.com/pkg/errors"
"github.com/xenolf/lego/acme"
"github.com/xenolf/lego/providers/dns/cloudflare"
"github.com/xenolf/lego/providers/dns/digitalocean"
"github.com/xenolf/lego/providers/dns/dnsimple"
"github.com/xenolf/lego/providers/dns/dnsmadeeasy"
"github.com/xenolf/lego/providers/dns/dyn"
"github.com/xenolf/lego/providers/dns/gandi"
"github.com/xenolf/lego/providers/dns/googlecloud"
"github.com/xenolf/lego/providers/dns/namecheap"
"github.com/xenolf/lego/providers/dns/ovh"
"github.com/xenolf/lego/providers/dns/pdns"
"github.com/xenolf/lego/providers/dns/rfc2136"
"github.com/xenolf/lego/providers/dns/route53"
"github.com/xenolf/lego/providers/dns/vultr"
)
type CertProcessor struct {
certSecretPrefix string
acmeURL string
db *bolt.DB
Lock sync.Mutex
HTTPLock sync.Mutex
TLSLock sync.Mutex
}
func NewCertProcessor(acmeURL string, certSecretPrefix string, db *bolt.DB) *CertProcessor {
return &CertProcessor{acmeURL: acmeURL,
certSecretPrefix: certSecretPrefix,
db: db,
}
}
func (p *CertProcessor) newACMEClient(acmeUser acme.User, provider string) (*acme.Client, *sync.Mutex, error) {
acmeClient, err := acme.NewClient(p.acmeURL, acmeUser, acme.RSA2048)
if err != nil {
return nil, nil, errors.Wrap(err, "Error while generating acme client")
}
initDNSProvider := func(p acme.ChallengeProvider, err error) (*acme.Client, *sync.Mutex, error) {
if err != nil {
return nil, nil, errors.Wrapf(err, "Error while initializing provider %v", provider)
}
if err := acmeClient.SetChallengeProvider(acme.DNS01, p); err != nil {
return nil, nil, errors.Wrap(err, "Error while setting cloudflare challenge provider")
}
acmeClient.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSSNI01})
return acmeClient, nil, nil
}
switch provider {
case "http":
acmeClient.SetHTTPAddress("8080")
acmeClient.ExcludeChallenges([]acme.Challenge{acme.DNS01, acme.TLSSNI01})
return acmeClient, &p.HTTPLock, nil
case "tls":
acmeClient.SetTLSAddress("8081")
acmeClient.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
return acmeClient, &p.TLSLock, nil
case "cloudflare":
return initDNSProvider(cloudflare.NewDNSProvider())
case "digitalocean":
return initDNSProvider(digitalocean.NewDNSProvider())
case "dnsimple":
return initDNSProvider(dnsimple.NewDNSProvider())
case "dnsmadeeasy":
return initDNSProvider(dnsmadeeasy.NewDNSProvider())
case "dyn":
return initDNSProvider(dyn.NewDNSProvider())
case "gandi":
return initDNSProvider(gandi.NewDNSProvider())
case "googlecloud":
return initDNSProvider(googlecloud.NewDNSProvider())
case "namecheap":
return initDNSProvider(namecheap.NewDNSProvider())
case "ovh":
return initDNSProvider(ovh.NewDNSProvider())
case "pdns":
return initDNSProvider(pdns.NewDNSProvider())
case "rfc2136":
return initDNSProvider(rfc2136.NewDNSProvider())
case "route53":
return initDNSProvider(route53.NewDNSProvider())
case "vultr":
return initDNSProvider(vultr.NewDNSProvider())
default:
return nil, nil, errors.Errorf("Unknown provider %v", provider)
}
}
func (p *CertProcessor) syncCertificates(verbose bool) error {
p.Lock.Lock()
defer p.Lock.Unlock()
certificates, err := getCertificates()
if err != nil {
return errors.Wrap(err, "Error while fetching certificate list")
}
var wg sync.WaitGroup
for _, cert := range certificates {
wg.Add(1)
go func(cert Certificate) {
defer wg.Done()
err := p.processCertificate(&cert.Spec)
if err != nil {
log.Printf("Error while processing certificate during sync: %v", err)
}
}(cert)
}
wg.Wait()
return nil
}
func (p *CertProcessor) watchKubernetesEvents(wg *sync.WaitGroup, doneChan <-chan struct{}) {
events, watchErrs := monitorCertificateEvents()
go func() {
for {
select {
case event := <-events:
err := p.processCertificateEvent(event)
if err != nil {
log.Printf("Error while processing certificate event: %v", err)
}
case err := <-watchErrs:
log.Printf("Error while watching kubernetes events: %v", err)
case <-doneChan:
wg.Done()
log.Println("Stopped certificate event watcher.")
return
}
}
}()
}
func (p *CertProcessor) refreshCertificates(syncInterval time.Duration, wg *sync.WaitGroup, doneChan <-chan struct{}) {
go func() {
for {
select {
case <-time.After(syncInterval):
err := p.syncCertificates(false)
if err != nil {
log.Printf("Error while synchronizing certificates during refresh: %v", err)
}
case <-doneChan:
wg.Done()
log.Println("Stopped refresh loop.")
return
}
}
}()
}
func (p *CertProcessor) processCertificateEvent(c CertificateEvent) error {
p.Lock.Lock()
defer p.Lock.Unlock()
switch c.Type {
case "ADDED":
return p.processCertificate(&c.Object.Spec)
case "DELETED":
return p.deleteCertificate(&c.Object.Spec)
}
return nil
}
func (p *CertProcessor) processCertificate(certSpec *CertificateSpec) error {
var (
acmeUserInfo ACMEUserData
acmeCertDetails ACMECertDetails
acmeCert ACMECertData
acmeClient *acme.Client
acmeClientMutex *sync.Mutex
)
// Fetch current certificate data from k8s
s, err := getSecret(p.certSecretPrefix + certSpec.Domain)
if err != nil {
return errors.Wrapf(err, "Error while fetching certificate acme data for domain %v", certSpec.Domain)
}
// If a cert exists, check its expiry
if s != nil {
acmeCert, err = NewACMECertDataFromSecret(s)
if err != nil {
return errors.Wrapf(err, "Error while decoding acme certificate from secret for existing domain %v", certSpec.Domain)
}
// Decode cert
pemBlock, _ := pem.Decode(acmeCert.Cert)
parsedCert, err := x509.ParseCertificate(pemBlock.Bytes)
if err != nil {
return errors.Wrapf(err, "Error while decoding x509 encoded certificate for existing domain %v", certSpec.Domain)
}
// If certificate expires in more than a week, don't renew
if parsedCert.NotAfter.After(time.Now().Add(time.Hour * 24 * 7)) {
return nil
}
log.Printf("[%v] Expiry for cert is in less than a week (%v), attempting renewal", certSpec.Domain, parsedCert.NotAfter.String())
}
// Fetch acme user data and cert details from bolt
var userInfoRaw, certDetailsRaw []byte
err = p.db.View(func(tx *bolt.Tx) error {
userInfoRaw = tx.Bucket([]byte("user-info")).Get([]byte(certSpec.Domain))
certDetailsRaw = tx.Bucket([]byte("cert-details")).Get([]byte(certSpec.Domain))
return nil
})
if err != nil {
return errors.Wrapf(err, "Error while running bolt view transaction for domain %v", certSpec.Domain)
}
// Handle user information
if userInfoRaw != nil { // Use existing user
if err := json.Unmarshal(userInfoRaw, &acmeUserInfo); err != nil {
return errors.Wrapf(err, "Error while unmarshalling user info for %v", certSpec.Domain)
}
acmeClient, acmeClientMutex, err = p.newACMEClient(&acmeUserInfo, certSpec.Provider)
if err != nil {
return errors.Wrapf(err, "Error while creating ACME client for %v", certSpec.Domain)
}
// Some acme providers require locking, if the mutex is specified, lock it
if acmeClientMutex != nil {
acmeClientMutex.Lock()
defer acmeClientMutex.Lock()
}
} else { // Generate a new ACME user
userKey, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
return errors.Wrapf(err, "Error while generating rsa key for new user for domain %v", certSpec.Domain)
}
acmeUserInfo.Email = certSpec.Email
acmeUserInfo.Key = pem.EncodeToMemory(&pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(userKey),
})
acmeClient, acmeClientMutex, err = p.newACMEClient(&acmeUserInfo, certSpec.Provider)
if err != nil {
return errors.Wrapf(err, "Error while creating ACME client for %v", certSpec.Domain)
}
// Some acme providers require locking, if the mutex is specified, lock it
if acmeClientMutex != nil {
acmeClientMutex.Lock()
defer acmeClientMutex.Lock()
}
// Register
acmeUserInfo.Registration, err = acmeClient.Register()
if err != nil {
return errors.Wrapf(err, "Error while registering user for new domain %v", certSpec.Domain)
}
// Agree to TOS
if err := acmeClient.AgreeToTOS(); err != nil {
return errors.Wrapf(err, "Error while agreeing to acme TOS for new domain %v", certSpec.Domain)
}
}
// If we have cert details stored, do a renewal, otherwise, obtain from scratch
if certDetailsRaw == nil || acmeCert.DomainName == "" {
acmeCert.DomainName = certSpec.Domain
// Obtain a cert
certRes, errs := acmeClient.ObtainCertificate([]string{certSpec.Domain}, true, nil)
if errs[certSpec.Domain] != nil {
return errors.Wrapf(errs[certSpec.Domain], "Error while obtaining certificate for new domain %v", certSpec.Domain)
}
// fill in data
acmeCert.Cert = certRes.Certificate
acmeCert.PrivateKey = certRes.PrivateKey
acmeCertDetails = NewACMECertDetailsFromResource(certRes)
} else {
if err := json.Unmarshal(certDetailsRaw, &acmeCertDetails); err != nil {
return errors.Wrapf(err, "Error while unmarshalling cert details for existing domain %v", certSpec.Domain)
}
// Fill in cert resource
certRes := acmeCertDetails.ToCertResource()
certRes.Certificate = acmeCert.Cert
certRes.PrivateKey = acmeCert.PrivateKey
certRes, err = acmeClient.RenewCertificate(certRes, true)
if err != nil {
return errors.Wrapf(err, "Error while renewing certificate for existing domain %v", certSpec.Domain)
}
// Fill in details
acmeCert.Cert = certRes.Certificate
acmeCert.PrivateKey = certRes.PrivateKey
acmeCertDetails = NewACMECertDetailsFromResource(certRes)
}
// Serialize acmeCertDetails and acmeUserInfo
certDetailsRaw, err = json.Marshal(&acmeCertDetails)
if err != nil {
return errors.Wrapf(err, "Error while marshalling cert details for domain %v", certSpec.Domain)
}
userInfoRaw, err = json.Marshal(&acmeUserInfo)
if err != nil {
return errors.Wrapf(err, "Error while marshalling user info for domain %v", certSpec.Domain)
}
// Save cert details and user info to bolt
err = p.db.Update(func(tx *bolt.Tx) error {
key := []byte(certSpec.Domain)
tx.Bucket([]byte("user-info")).Put(key, userInfoRaw)
tx.Bucket([]byte("cert-details")).Put(key, certDetailsRaw)
return nil
})
if err != nil {
return errors.Wrapf(err, "Error while saving data to bolt for domain %v", certSpec.Domain)
}
// Convert cert data to k8s secret
isUpdate := s != nil
s, err = acmeCert.ToSecret(p.certSecretPrefix)
if err != nil {
return errors.Wrapf(err, "Error while creating secret for ACME certificate for domain %v", certSpec.Domain)
}
// Save the k8s secret
if err := saveSecret(s, isUpdate); err != nil {
return errors.Wrapf(err, "Error while saving secret for domain %v", certSpec.Domain)
}
return nil
}
func (p *CertProcessor) deleteCertificate(certSpec *CertificateSpec) error {
secretName := p.certSecretPrefix + certSpec.Domain
log.Printf("[%v] Deleting secret %v", certSpec.Domain, secretName)
if err := deleteSecret(secretName); err != nil {
return errors.Wrapf(err, "Error while deleting secret for domain %v", certSpec.Domain)
}
log.Printf("[%v] Deleting user info and certificate details", certSpec.Domain)
err := p.db.Update(func(tx *bolt.Tx) error {
key := []byte(certSpec.Domain)
tx.Bucket([]byte("user-info")).Delete(key)
tx.Bucket([]byte("cert-details")).Delete(key)
return nil
})
if err != nil {
return errors.Wrapf(err, "Error while saving data to bolt for domain %v", certSpec.Domain)
}
return nil
}