This is an automated email from the ASF dual-hosted git repository.
albumenj pushed a commit to branch 3.2
in repository https://gitbox.apache.org/repos/asf/dubbo.git
The following commit(s) were added to refs/heads/3.2 by this push:
new 86c1678892 Support Istio third-party-jwt (#10714)
86c1678892 is described below
commit 86c16788929081e067cf0afa5d246aa9260a3f55
Author: Albumen Kevin <[email protected]>
AuthorDate: Mon Oct 10 11:48:38 2022 +0800
Support Istio third-party-jwt (#10714)
---
.../xds/istio/IstioCitadelCertificateSigner.java | 9 +-
.../dubbo/registry/xds/istio/IstioConstant.java | 13 +++
.../apache/dubbo/registry/xds/istio/IstioEnv.java | 101 ++++++++++++---------
3 files changed, 77 insertions(+), 46 deletions(-)
diff --git
a/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioCitadelCertificateSigner.java
b/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioCitadelCertificateSigner.java
index cf91f1ea98..7aa033c486 100644
---
a/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioCitadelCertificateSigner.java
+++
b/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioCitadelCertificateSigner.java
@@ -26,7 +26,6 @@ import io.grpc.ManagedChannel;
import io.grpc.Metadata;
import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts;
import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder;
-import
io.grpc.netty.shaded.io.netty.handler.ssl.util.InsecureTrustManagerFactory;
import io.grpc.stub.MetadataUtils;
import io.grpc.stub.StreamObserver;
import istio.v1.auth.IstioCertificateRequest;
@@ -46,8 +45,10 @@ import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder;
import org.bouncycastle.util.io.pem.PemObject;
+import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.StringWriter;
+import java.nio.charset.StandardCharsets;
import java.security.InvalidAlgorithmParameterException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
@@ -143,7 +144,11 @@ public class IstioCitadelCertificateSigner implements
XdsCertificateSigner {
String csr = generateCsr(publicKey, signer);
ManagedChannel channel =
NettyChannelBuilder.forTarget(istioEnv.getCaAddr())
-
.sslContext(GrpcSslContexts.forClient().trustManager(InsecureTrustManagerFactory.INSTANCE).build()).build();
+ .sslContext(
+ GrpcSslContexts.forClient()
+ .trustManager(new
ByteArrayInputStream(istioEnv.getCaCert().getBytes(StandardCharsets.UTF_8)))
+ .build())
+ .build();
Metadata header = new Metadata();
Metadata.Key<String> key = Metadata.Key.of("authorization",
Metadata.ASCII_STRING_MARSHALLER);
diff --git
a/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioConstant.java
b/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioConstant.java
index d14aca0142..391d4e8bef 100644
---
a/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioConstant.java
+++
b/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioConstant.java
@@ -48,6 +48,10 @@ public class IstioConstant {
public final static String KUBERNETES_CA_PATH =
"/var/run/secrets/kubernetes.io/serviceaccount/ca.crt";
+ public final static String ISTIO_SA_PATH =
"/var/run/secrets/tokens/istio-token";
+
+ public final static String ISTIO_CA_PATH =
"/var/run/secrets/istio/root-cert.pem";
+
public final static String KUBERNETES_NAMESPACE_PATH =
"/var/run/secrets/kubernetes.io/serviceaccount/namespace";
public final static String RSA_KEY_SIZE_KEY = "RSA_KEY_SIZE";
@@ -90,4 +94,13 @@ public class IstioConstant {
public final static String NS = "/ns/";
public final static String SA = "/sa/";
+
+ public final static String JWT_POLICY = "JWT_POLICY";
+
+ public final static String DEFAULT_JWT_POLICY = "first-party-jwt";
+
+ public final static String FIRST_PARTY_JWT = "first-party-jwt";
+
+ public final static String THIRD_PARTY_JWT = "third-party-jwt";
+
}
diff --git
a/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioEnv.java
b/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioEnv.java
index 0bb0e06c96..87d468573f 100644
--- a/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioEnv.java
+++ b/dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioEnv.java
@@ -40,9 +40,7 @@ public class IstioEnv implements XdsEnv {
private String caAddr;
- private String serviceAccount = null;
-
- private String csrHost;
+ private String jwtPolicy;
private String trustDomain;
@@ -58,49 +56,30 @@ public class IstioEnv implements XdsEnv {
private String istioMetaClusterId;
- private String caCert;
-
private IstioEnv() {
- // read k8s jwt token
- File saFile = new File(IstioConstant.KUBERNETES_SA_PATH);
- if (saFile.canRead()) {
- try {
- podName = System.getenv("HOSTNAME");
- serviceAccount = FileUtils.readFileToString(saFile,
StandardCharsets.UTF_8);
- trustDomain =
Optional.ofNullable(System.getenv(IstioConstant.TRUST_DOMAIN_KEY)).orElse(IstioConstant.DEFAULT_TRUST_DOMAIN);
- workloadNameSpace =
Optional.ofNullable(System.getenv(IstioConstant.WORKLOAD_NAMESPACE_KEY))
- .orElseGet(()->{
- File namespaceFile = new
File(IstioConstant.KUBERNETES_NAMESPACE_PATH);
- if (namespaceFile.canRead()) {
- try {
- return
FileUtils.readFileToString(namespaceFile, StandardCharsets.UTF_8);
- } catch (IOException e) {
- logger.error("read namespace file error", e);
- }
- }
- return IstioConstant.DEFAULT_WORKLOAD_NAMESPACE;
- });
- // spiffe://<trust_domain>/ns/<namespace>/sa/<service_account>
- csrHost = SPIFFE + trustDomain + NS + workloadNameSpace + SA +
serviceAccount;
- caAddr =
Optional.ofNullable(System.getenv(IstioConstant.CA_ADDR_KEY)).orElse(IstioConstant.DEFAULT_CA_ADDR);
- rasKeySize =
Integer.parseInt(Optional.ofNullable(System.getenv(IstioConstant.RSA_KEY_SIZE_KEY)).orElse(IstioConstant.DEFAULT_RSA_KEY_SIZE));
- eccSigAlg =
Optional.ofNullable(System.getenv(IstioConstant.ECC_SIG_ALG_KEY)).orElse(IstioConstant.DEFAULT_ECC_SIG_ALG);
- secretTTL =
Integer.parseInt(Optional.ofNullable(System.getenv(IstioConstant.SECRET_TTL_KEY)).orElse(IstioConstant.DEFAULT_SECRET_TTL));
- secretGracePeriodRatio =
Float.parseFloat(Optional.ofNullable(System.getenv(IstioConstant.SECRET_GRACE_PERIOD_RATIO_KEY)).orElse(IstioConstant.DEFAULT_SECRET_GRACE_PERIOD_RATIO));
- istioMetaClusterId =
Optional.ofNullable(System.getenv(IstioConstant.ISTIO_META_CLUSTER_ID_KEY)).orElse(IstioConstant.DEFAULT_ISTIO_META_CLUSTER_ID);
- File caFile = new File(IstioConstant.KUBERNETES_CA_PATH);
- if (caFile.canRead()) {
+ jwtPolicy =
Optional.ofNullable(System.getenv(IstioConstant.JWT_POLICY)).orElse(IstioConstant.DEFAULT_JWT_POLICY);
+ podName =
Optional.ofNullable(System.getenv("POD_NAME")).orElse(System.getenv("HOSTNAME"));
+ trustDomain =
Optional.ofNullable(System.getenv(IstioConstant.TRUST_DOMAIN_KEY)).orElse(IstioConstant.DEFAULT_TRUST_DOMAIN);
+ workloadNameSpace =
Optional.ofNullable(System.getenv(IstioConstant.WORKLOAD_NAMESPACE_KEY))
+ .orElseGet(()->{
+ File namespaceFile = new
File(IstioConstant.KUBERNETES_NAMESPACE_PATH);
+ if (namespaceFile.canRead()) {
try {
- caCert = FileUtils.readFileToString(caFile,
StandardCharsets.UTF_8);
+ return FileUtils.readFileToString(namespaceFile,
StandardCharsets.UTF_8);
} catch (IOException e) {
- logger.error("read ca file error", e);
+ logger.error("read namespace file error", e);
}
}
- } catch (IOException e) {
- logger.error("Unable to read token file.", e);
- }
- }
- if (serviceAccount == null) {
+ return IstioConstant.DEFAULT_WORKLOAD_NAMESPACE;
+ });
+ caAddr =
Optional.ofNullable(System.getenv(IstioConstant.CA_ADDR_KEY)).orElse(IstioConstant.DEFAULT_CA_ADDR);
+ rasKeySize =
Integer.parseInt(Optional.ofNullable(System.getenv(IstioConstant.RSA_KEY_SIZE_KEY)).orElse(IstioConstant.DEFAULT_RSA_KEY_SIZE));
+ eccSigAlg =
Optional.ofNullable(System.getenv(IstioConstant.ECC_SIG_ALG_KEY)).orElse(IstioConstant.DEFAULT_ECC_SIG_ALG);
+ secretTTL =
Integer.parseInt(Optional.ofNullable(System.getenv(IstioConstant.SECRET_TTL_KEY)).orElse(IstioConstant.DEFAULT_SECRET_TTL));
+ secretGracePeriodRatio =
Float.parseFloat(Optional.ofNullable(System.getenv(IstioConstant.SECRET_GRACE_PERIOD_RATIO_KEY)).orElse(IstioConstant.DEFAULT_SECRET_GRACE_PERIOD_RATIO));
+ istioMetaClusterId =
Optional.ofNullable(System.getenv(IstioConstant.ISTIO_META_CLUSTER_ID_KEY)).orElse(IstioConstant.DEFAULT_ISTIO_META_CLUSTER_ID);
+
+ if (getServiceAccount() == null) {
throw new UnsupportedOperationException("Unable to found
kubernetes service account token file. " +
"Please check if work in Kubernetes and mount service account
token file correctly.");
}
@@ -119,11 +98,29 @@ public class IstioEnv implements XdsEnv {
}
public String getServiceAccount() {
- return serviceAccount;
+ File saFile;
+ switch (jwtPolicy) {
+ case IstioConstant.FIRST_PARTY_JWT:
+ saFile = new File(IstioConstant.KUBERNETES_SA_PATH);
+ break;
+ case IstioConstant.THIRD_PARTY_JWT:
+ default:
+ saFile = new File(IstioConstant.ISTIO_SA_PATH);
+ }
+ if (saFile.canRead()) {
+ try {
+ return FileUtils.readFileToString(saFile,
StandardCharsets.UTF_8);
+ } catch (IOException e) {
+ logger.error("Unable to read token file.", e);
+ }
+ }
+
+ return null;
}
public String getCsrHost() {
- return csrHost;
+ // spiffe://<trust_domain>/ns/<namespace>/sa/<service_account>
+ return SPIFFE + trustDomain + NS + workloadNameSpace + SA +
getServiceAccount();
}
public String getTrustDomain() {
@@ -160,6 +157,22 @@ public class IstioEnv implements XdsEnv {
}
public String getCaCert() {
- return caCert;
+ File caFile;
+ switch (jwtPolicy) {
+ case IstioConstant.FIRST_PARTY_JWT:
+ caFile = new File(IstioConstant.KUBERNETES_CA_PATH);
+ break;
+ case IstioConstant.THIRD_PARTY_JWT:
+ default:
+ caFile = new File(IstioConstant.ISTIO_CA_PATH);
+ }
+ if (caFile.canRead()) {
+ try {
+ return FileUtils.readFileToString(caFile,
StandardCharsets.UTF_8);
+ } catch (IOException e) {
+ logger.error("read ca file error", e);
+ }
+ }
+ return null;
}
}
