[Feature] Integration TLS (#1710)

Author: ajanikow

.golangci.yaml

@@ -23,100 +23,102 @@ linters-settings:
   importas:
     no-unaliased: true
     alias:
-      - pkg: k8s.io/api/core/v1
-        alias: core
-      - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
-        alias: meta
-      - pkg: k8s.io/client-go/kubernetes/typed/core/v1
-        alias: typedCore
-      - pkg: k8s.io/api/apps/v1
-        alias: apps
-      - pkg: k8s.io/api/batch/v1
-        alias: batch
-      - pkg: k8s.io/api/storage/v1
-        alias: storage
-      - pkg: github.com/arangodb/kube-arangodb/pkg/deployment/reconcile/shared
-        alias: sharedReconcile
-      - pkg: k8s.io/api/policy/v1
-        alias: policy
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/shared/v1
-        alias: sharedApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1
-        alias: schedulerApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/profiles
-        alias: schedulerProfiles
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/container
-        alias: schedulerContainerApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/container/resources
-        alias: schedulerContainerResourcesApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/pod
-        alias: schedulerPodApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/pod/resources
-        alias: schedulerPodResourcesApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1
-        alias: schedulerApiv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/profiles
-        alias: schedulerProfilesv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/container
-        alias: schedulerContainerApiv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/container/resources
-        alias: schedulerContainerResourcesApiv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/pod
-        alias: schedulerPodApiv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/pod/resources
-        alias: schedulerPodResourcesApiv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/shared
-        alias: shared
-      - pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/analytics/shared
-        alias: analyticsShared
-      - pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/shared
-        alias: enterpriseShared
-      - pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/ml/shared
-        alias: mlShared
-      - pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/ml/shared/test
-        alias: mlSharedTests
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/analytics/v1alpha1
-        alias: analyticsApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/networking/v1alpha1
-        alias: networkingApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/ml/v1beta1
-        alias: mlApi
-      - pkg: github.com/arangodb/kube-arangodb/pkg/apis/ml/v1alpha1
-        alias: mlApiv1alpha1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/scheduler/v1/definition
-        alias: pbSchedulerV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/scheduler/v1
-        alias: pbImplSchedulerV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/shutdown/v1/definition
-        alias: pbShutdownV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/shutdown/v1
-        alias: pbImplShutdownV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/authentication/v1/definition
-        alias: pbAuthenticationV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/authentication/v1
-        alias: pbImplAuthenticationV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/authorization/v0/definition
-        alias: pbAuthorizationV0
-      - pkg: github.com/arangodb/kube-arangodb/integrations/authorization/v0
-        alias: pbImplAuthorizationV0
-      - pkg: github.com/arangodb/kube-arangodb/integrations/config/v1/definition
-        alias: pbConfigV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/config/v1
-        alias: pbImplConfigV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/pong/v1/definition
-        alias: pbPongV1
+      - alias: pbImplAuthenticationV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/authentication/v1
+      - alias: pbAuthenticationV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/authentication/v1/definition
+      - alias: pbImplAuthorizationV0
+        pkg: github.com/arangodb/kube-arangodb/integrations/authorization/v0
+      - alias: pbAuthorizationV0
+        pkg: github.com/arangodb/kube-arangodb/integrations/authorization/v0/definition
+      - alias: pbImplConfigV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/config/v1
+      - alias: pbConfigV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/config/v1/definition
+      - alias: pbImplEnvoyAuthV3
+        pkg: github.com/arangodb/kube-arangodb/integrations/envoy/auth/v3
       - pkg: github.com/arangodb/kube-arangodb/integrations/pong/v1
         alias: pbImplPongV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/shared/v1/definition
-        alias: pbSharedV1
-      - pkg: github.com/arangodb/kube-arangodb/integrations/shared/v1
-        alias: pbImplSharedV1
-      - pkg: github.com/envoyproxy/go-control-plane/envoy/service/auth/v3
-        alias: pbEnvoyAuthV3
-      - pkg: github.com/arangodb/kube-arangodb/integrations/envoy/auth/v3
-        alias: pbImplEnvoyAuthV3
-      - pkg: github.com/arangodb/kube-arangodb/pkg/util/k8sutil/resources
-        alias: kresources
+      - pkg: github.com/arangodb/kube-arangodb/integrations/pong/v1/definition
+        alias: pbPongV1
+      - alias: pbImplSchedulerV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/scheduler/v1
+      - alias: pbSchedulerV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/scheduler/v1/definition
+      - alias: pbImplSharedV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/shared/v1
+      - alias: pbSharedV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/shared/v1/definition
+      - alias: pbImplShutdownV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/shutdown/v1
+      - alias: pbShutdownV1
+        pkg: github.com/arangodb/kube-arangodb/integrations/shutdown/v1/definition
+      - alias: analyticsApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/analytics/v1alpha1
+      - alias: mlApiv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/ml/v1alpha1
+      - alias: mlApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/ml/v1beta1
+      - alias: networkingApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/networking/v1alpha1
+      - alias: schedulerApiv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1
+      - alias: schedulerContainerApiv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/container
+      - alias: schedulerContainerResourcesApiv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/container/resources
+      - alias: schedulerPodApiv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/pod
+      - alias: schedulerPodResourcesApiv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/pod/resources
+      - alias: schedulerProfilesv1alpha1
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1alpha1/profiles
+      - alias: schedulerApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1
+      - alias: schedulerContainerApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/container
+      - alias: schedulerContainerResourcesApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/container/resources
+      - alias: schedulerPodApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/pod
+      - alias: schedulerPodResourcesApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/pod/resources
+      - alias: schedulerProfiles
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/profiles
+      - alias: shared
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/shared
+      - alias: sharedApi
+        pkg: github.com/arangodb/kube-arangodb/pkg/apis/shared/v1
+      - alias: sharedReconcile
+        pkg: github.com/arangodb/kube-arangodb/pkg/deployment/reconcile/shared
+      - alias: analyticsShared
+        pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/analytics/shared
+      - alias: mlShared
+        pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/ml/shared
+      - alias: mlSharedTests
+        pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/ml/shared/test
+      - alias: enterpriseShared
+        pkg: github.com/arangodb/kube-arangodb/pkg/handlers/enterprise/shared
+      - alias: kresources
+        pkg: github.com/arangodb/kube-arangodb/pkg/util/k8sutil/resources
+      - alias: ktls
+        pkg: github.com/arangodb/kube-arangodb/pkg/util/k8sutil/tls
+      - alias: pbEnvoyAuthV3
+        pkg: github.com/envoyproxy/go-control-plane/envoy/service/auth/v3
+      - alias: apps
+        pkg: k8s.io/api/apps/v1
+      - alias: batch
+        pkg: k8s.io/api/batch/v1
+      - alias: core
+        pkg: k8s.io/api/core/v1
+      - alias: policy
+        pkg: k8s.io/api/policy/v1
+      - alias: storage
+        pkg: k8s.io/api/storage/v1
+      - alias: meta
+        pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+      - alias: typedCore
+        pkg: k8s.io/client-go/kubernetes/typed/core/v1
   gci:
     sections:
       - standard

CHANGELOG.md

@@ -20,6 +20,7 @@
 - (Feature) Custom Gateway image
 - (Bugfix) Fix race condition in ArangoBackup
 - (Feature) Improve Gateway Config gen
+- (Feature) Integration Service TLS
 
 ## [1.2.42](https://github.com/arangodb/kube-arangodb/tree/1.2.42) (2024-07-23)
 - (Maintenance) Go 1.22.4 & Kubernetes 1.29.6 libraries

docs/cli/arangodb_operator_integration.md

@@ -22,6 +22,7 @@ Flags:
       --health.auth.token string                                   Token for health service (when auth service is token)
       --health.auth.type string                                    Auth type for health service (default "None")
       --health.shutdown.enabled                                    Determines if shutdown service should be enabled and exposed (default true)
+      --health.tls.keyfile string                                  Path to the keyfile
   -h, --help                                                       help for arangodb_operator_integration
       --integration.authentication.v1                              Enable AuthenticationV1 Integration Service
       --integration.authentication.v1.enabled                      Defines if Authentication is enabled (default true)
@@ -74,6 +75,8 @@ Flags:
       --services.external.auth.token string                        Token for external service (when auth service is token)
       --services.external.auth.type string                         Auth type for external service (default "None")
       --services.external.enabled                                  Defines if external access is enabled
+      --services.external.tls.keyfile string                       Path to the keyfile
+      --services.tls.keyfile string                                Path to the keyfile
 
 Use "arangodb_operator_integration [command] --help" for more information about a command.
 ```
@@ -94,6 +97,10 @@ Available Commands:
 Flags:
       --address string   GRPC Service Address (default "127.0.0.1:8080")
   -h, --help             help for client
+      --tls.ca string    Path to the custom CA
+      --tls.enabled      Defines if GRPC is protected with TLS
+      --tls.fallback     Enables TLS Fallback
+      --tls.insecure     Enables Insecure TLS Connection
       --token string     GRPC Token
 
 Use "arangodb_operator_integration client [command] --help" for more information about a command.

integrations/pong/v1/impl.go

@@ -29,7 +29,6 @@ import (
 
 	pbPongV1 "github.com/arangodb/kube-arangodb/integrations/pong/v1/definition"
 	pbSharedV1 "github.com/arangodb/kube-arangodb/integrations/shared/v1/definition"
-	pbShutdownV1 "github.com/arangodb/kube-arangodb/integrations/shutdown/v1/definition"
 	"github.com/arangodb/kube-arangodb/pkg/util/svc"
 )
 
@@ -45,7 +44,7 @@ type impl struct {
 }
 
 func (i *impl) Name() string {
-	return pbShutdownV1.Name
+	return pbPongV1.Name
 }
 
 func (i *impl) Health() svc.HealthState {

pkg/apis/deployment/v1/tls_spec.go

@@ -49,7 +49,7 @@ const (
 )
 
 const (
-	defaultTLSTTL = Duration("2610h") // About 3 month
+	DefaultTLSTTL = Duration("2610h") // About 3 month
 )
 
 // TLSSpec holds TLS specific configuration settings
@@ -157,7 +157,7 @@ func (s *TLSSpec) SetDefaults(defaultCASecretName string) {
 	if s.GetTTL() == "" {
 		// Note that we don't check for nil here, since even a specified, but zero
 		// should result in the default value.
-		s.TTL = NewDuration(defaultTLSTTL)
+		s.TTL = NewDuration(DefaultTLSTTL)
 	}
 }
 

pkg/apis/deployment/v1/tls_spec_test.go

@@ -1,7 +1,7 @@
 //
 // DISCLAIMER
 //
-// Copyright 2016-2023 ArangoDB GmbH, Cologne, Germany
+// Copyright 2016-2024 ArangoDB GmbH, Cologne, Germany
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -60,6 +60,6 @@ func TestTLSSpecSetDefaults(t *testing.T) {
 	assert.Equal(t, "foo", def(TLSSpec{CASecretName: util.NewType[string]("foo")}).GetCASecretName())
 	assert.Len(t, def(TLSSpec{}).GetAltNames(), 0)
 	assert.Len(t, def(TLSSpec{AltNames: []string{"foo.local"}}).GetAltNames(), 1)
-	assert.Equal(t, defaultTLSTTL, def(TLSSpec{}).GetTTL())
+	assert.Equal(t, DefaultTLSTTL, def(TLSSpec{}).GetTTL())
 	assert.Equal(t, time.Hour, def(TLSSpec{TTL: NewDuration("1h")}).GetTTL().AsDuration())
 }

pkg/apis/deployment/v2alpha1/tls_spec.go

@@ -49,7 +49,7 @@ const (
 )
 
 const (
-	defaultTLSTTL = Duration("2610h") // About 3 month
+	DefaultTLSTTL = Duration("2610h") // About 3 month
 )
 
 // TLSSpec holds TLS specific configuration settings
@@ -157,7 +157,7 @@ func (s *TLSSpec) SetDefaults(defaultCASecretName string) {
 	if s.GetTTL() == "" {
 		// Note that we don't check for nil here, since even a specified, but zero
 		// should result in the default value.
-		s.TTL = NewDuration(defaultTLSTTL)
+		s.TTL = NewDuration(DefaultTLSTTL)
 	}
 }
 

pkg/apis/deployment/v2alpha1/tls_spec_test.go

@@ -1,7 +1,7 @@
 //
 // DISCLAIMER
 //
-// Copyright 2016-2023 ArangoDB GmbH, Cologne, Germany
+// Copyright 2016-2024 ArangoDB GmbH, Cologne, Germany
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -60,6 +60,6 @@ func TestTLSSpecSetDefaults(t *testing.T) {
 	assert.Equal(t, "foo", def(TLSSpec{CASecretName: util.NewType[string]("foo")}).GetCASecretName())
 	assert.Len(t, def(TLSSpec{}).GetAltNames(), 0)
 	assert.Len(t, def(TLSSpec{AltNames: []string{"foo.local"}}).GetAltNames(), 1)
-	assert.Equal(t, defaultTLSTTL, def(TLSSpec{}).GetTTL())
+	assert.Equal(t, DefaultTLSTTL, def(TLSSpec{}).GetTTL())
 	assert.Equal(t, time.Hour, def(TLSSpec{TTL: NewDuration("1h")}).GetTTL().AsDuration())
 }

pkg/deployment/reconcile/plan_builder_tls.go

@@ -47,7 +47,7 @@ import (
 	operatorHTTP "github.com/arangodb/kube-arangodb/pkg/util/http"
 	"github.com/arangodb/kube-arangodb/pkg/util/k8sutil"
 	inspectorInterface "github.com/arangodb/kube-arangodb/pkg/util/k8sutil/inspector"
-	memberTls "github.com/arangodb/kube-arangodb/pkg/util/k8sutil/tls"
+	ktls "github.com/arangodb/kube-arangodb/pkg/util/k8sutil/tls"
 	"github.com/arangodb/kube-arangodb/pkg/util/k8sutil/tools"
 	"github.com/arangodb/kube-arangodb/pkg/util/strings"
 )
@@ -542,13 +542,13 @@ func (r *Reconciler) keyfileRenewalRequired(ctx context.Context, apiObject k8sut
 		}
 
 		// Verify AltNames
-		var altNames memberTls.KeyfileInput
+		var altNames ktls.KeyfileInput
 
 		switch group.Type() {
 		case api.ServerGroupTypeArangoD:
-			altNames, err = memberTls.GetServerAltNames(apiObject, spec, tlsSpec, service, group, member)
+			altNames, err = ktls.GetServerAltNames(apiObject, spec, tlsSpec, service, group, member)
 		case api.ServerGroupTypeArangoSync:
-			altNames, err = memberTls.GetSyncAltNames(apiObject, spec, tlsSpec, group, member)
+			altNames, err = ktls.GetSyncAltNames(apiObject, spec, tlsSpec, group, member)
 		default:
 			assertion.InvalidGroupKey.Assert(true, "Unable to check TLS Key Renewal for an unknown group: %s", group.AsRole())
 			return false, false

pkg/deployment/resources/certificates_client_auth.go

@@ -1,7 +1,7 @@
 //
 // DISCLAIMER
 //
-// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
+// Copyright 2016-2024 ArangoDB GmbH, Cologne, Germany
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -23,36 +23,23 @@ package resources
 import (
 	"context"
 	"fmt"
-	"time"
 
 	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	certificates "github.com/arangodb-helper/go-certificates"
-
 	api "github.com/arangodb/kube-arangodb/pkg/apis/deployment/v1"
 	"github.com/arangodb/kube-arangodb/pkg/util/errors"
 	"github.com/arangodb/kube-arangodb/pkg/util/k8sutil"
 	secretv1 "github.com/arangodb/kube-arangodb/pkg/util/k8sutil/inspector/secret/v1"
 	"github.com/arangodb/kube-arangodb/pkg/util/k8sutil/kerrors"
-)
-
-const (
-	clientAuthECDSACurve = "P256" // This curve is the default that ArangoDB accepts and plenty strong
+	ktls "github.com/arangodb/kube-arangodb/pkg/util/k8sutil/tls"
 )
 
 // createClientAuthCACertificate creates a client authentication CA certificate and stores it in a secret with name
 // specified in the given spec.
 func (r *Resources) createClientAuthCACertificate(ctx context.Context, secrets secretv1.ModInterface, spec api.SyncAuthenticationSpec, deploymentName string, ownerRef *meta.OwnerReference) error {
 	log := r.log.Str("section", "secrets")
-	options := certificates.CreateCertificateOptions{
-		CommonName:   fmt.Sprintf("%s Client Authentication Root Certificate", deploymentName),
-		ValidFrom:    time.Now(),
-		ValidFor:     caTTL,
-		IsCA:         true,
-		IsClientAuth: true,
-		ECDSACurve:   clientAuthECDSACurve,
-	}
-	cert, priv, err := certificates.CreateCertificate(options, nil)
+
+	cert, priv, err := ktls.CreateTLSCACertificate(fmt.Sprintf("%s Client Authentication Root Certificate", deploymentName))
 	if err != nil {
 		log.Err(err).Str("name", spec.GetClientCASecretName()).Debug("Failed to create CA certificate")
 		return errors.WithStack(err)