Added env based support for HTTPS connection (#4706)

* Added env based support for HTTPS connection Signed-off-by: Saranya-jena <[email protected]> * resolved review comments Signed-off-by: Saranya-jena <[email protected]> * updated logic Signed-off-by: Saranya-jena <[email protected]> * fixed importd Signed-off-by: Saranya-jena <[email protected]> * added helper files Signed-off-by: Saranya-jena <[email protected]> * resolved comments Signed-off-by: Saranya-jena <[email protected]> * resolved comments Signed-off-by: Saranya-jena <[email protected]> * Update push.yml * minor changes Signed-off-by: Saranya-jena <[email protected]> * minor changes Signed-off-by: Saranya-jena <[email protected]> * minor changes Signed-off-by: Saranya-jena <[email protected]> * minor changes Signed-off-by: Saranya-jena <[email protected]> * minor changes Signed-off-by: Saranya-jena <[email protected]> * Update push.yml * updated oush.yam Signed-off-by: Saranya-jena <[email protected]> * updated manifest Signed-off-by: Saranya-jena <[email protected]> --------- Signed-off-by: Saranya-jena <[email protected]> Co-authored-by: Namkyu Park <[email protected]>
litmuschaos · Jul 8, 2024 · 9f4fe25 · 9f4fe25
1 parent a00691f
commit 9f4fe25
Show file tree

Hide file tree

Showing 12 changed files with 359 additions and 5 deletions.
diff --git a/chaoscenter/authentication/api/main.go b/chaoscenter/authentication/api/main.go
@@ -4,11 +4,13 @@ import (
 	"flag"
 	"fmt"
 	"net"
+	"net/http"
 	"runtime"
 	"time"
 
 	response "github.com/litmuschaos/litmus/chaoscenter/authentication/api/handlers"
 	"github.com/litmuschaos/litmus/chaoscenter/authentication/pkg/authConfig"
+	"google.golang.org/grpc/credentials"
 
 	grpcHandler "github.com/litmuschaos/litmus/chaoscenter/authentication/api/handlers/grpc"
 	"github.com/litmuschaos/litmus/chaoscenter/authentication/api/middleware"
@@ -132,6 +134,14 @@ func main() {
 	validatedAdminSetup(applicationService)
 
 	go runGrpcServer(applicationService)
+	if utils.EnableInternalTls {
+		if utils.CustomTlsCertPath != "" && utils.TlSKeyPath != "" {
+			go runGrpcServerWithTLS(applicationService)
+		} else {
+			log.Fatalf("Failure to start chaoscenter authentication GRPC server due to empty TLS cert file path and TLS key path")
+		}
+	}
+
 	runRestServer(applicationService)
 }
 
@@ -186,6 +196,29 @@ func runRestServer(applicationService services.ApplicationService) {
 	routes.ProjectRouter(app, applicationService)
 
 	log.Infof("Listening and serving HTTP on %s", utils.Port)
+
+	if utils.EnableInternalTls {
+		log.Infof("Listening and serving HTTPS on %s", utils.PortHttps)
+		if utils.CustomTlsCertPath != "" && utils.TlSKeyPath != "" {
+			conf := utils.GetTlsConfig()
+
+			server := http.Server{
+				Addr:      utils.PortHttps,
+				Handler:   app,
+				TLSConfig: conf,
+			}
+			log.Infof("Listening and serving HTTPS on %s", utils.Port)
+			go func() {
+				err := server.ListenAndServeTLS("", "")
+				if err != nil {
+					log.Fatalf("Failure to start litmus-portal authentication REST server due to %v", err)
+				}
+			}()
+		} else {
+			log.Fatalf("Failure to start chaoscenter authentication REST server due to empty TLS cert file path and TLS key path")
+		}
+	}
+
 	err := app.Run(utils.Port)
 	if err != nil {
 		log.Fatalf("Failure to start litmus-portal authentication REST server due to %v", err)
@@ -205,6 +238,34 @@ func runGrpcServer(applicationService services.ApplicationService) {
 	log.Infof("Listening and serving gRPC on %s", utils.GrpcPort)
 	err = grpcServer.Serve(lis)
 	if err != nil {
-		log.Fatalf("Failure to start litmus-portal authentication GRPC server due to %v", err)
+		log.Fatalf("Failure to start chaoscenter authentication GRPC server due to %v", err)
+	}
+}
+
+func runGrpcServerWithTLS(applicationService services.ApplicationService) {
+
+	// Starting gRPC server
+	lis, err := net.Listen("tcp", utils.GrpcPortHttps)
+	if err != nil {
+		log.Fatalf("Failure to start litmus-portal authentication server due to %s", err)
+	}
+
+	// configuring TLS config based on provided certificates & keys
+	conf := utils.GetTlsConfig()
+
+	// create tls credentials
+	tlsCredentials := credentials.NewTLS(conf)
+
+	// create grpc server with tls credential
+	grpcServer := grpc.NewServer(grpc.Creds(tlsCredentials))
+
+	grpcApplicationServer := grpcHandler.ServerGrpc{ApplicationService: applicationService}
+
+	grpcPresenter.RegisterAuthRpcServiceServer(grpcServer, &grpcApplicationServer)
+
+	log.Infof("Listening and serving gRPC on %s with TLS", utils.GrpcPort)
+	err = grpcServer.Serve(lis)
+	if err != nil {
+		log.Fatalf("Failure to start chaoscenter authentication GRPC server due to %v", err)
 	}
 }
diff --git a/chaoscenter/authentication/pkg/utils/configs.go b/chaoscenter/authentication/pkg/utils/configs.go
@@ -1,8 +1,12 @@
 package utils
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"os"
 	"strconv"
+
+	log "github.com/sirupsen/logrus"
 )
 
 var (
@@ -20,9 +24,15 @@ var (
 	DexClientID                  = os.Getenv("DEX_OAUTH_CLIENT_ID")
 	DexClientSecret              = os.Getenv("DEX_OAUTH_CLIENT_SECRET")
 	DexOIDCIssuer                = os.Getenv("OIDC_ISSUER")
+	EnableInternalTls            = getEnvAsBool("ENABLE_INTERNAL_TLS", false)
+	CustomTlsCertPath            = os.Getenv("CUSTOM_TLS_CERT_PATH")
+	TlSKeyPath                   = os.Getenv("TLS_KEY_PATH")
+	CaCertPath                   = os.Getenv("CA_CERT_PATH")
 	DBName                       = "auth"
 	Port                         = ":3000"
+	PortHttps                    = ":3001"
 	GrpcPort                     = ":3030"
+	GrpcPortHttps                = ":3031"
 	UserCollection               = "users"
 	ProjectCollection            = "project"
 	AuthConfigCollection         = "auth-config"
@@ -33,6 +43,7 @@ var (
 	PasswordEncryptionCost       = 15
 	DefaultLitmusGqlGrpcEndpoint = "localhost"
 	DefaultLitmusGqlGrpcPort     = ":8000"
+	//DefaultLitmusGqlGrpcPortHttps = ":8001" // enable when in use
 )
 
 func getEnvAsInt(name string, defaultVal int) int {
@@ -50,3 +61,32 @@ func getEnvAsBool(name string, defaultVal bool) bool {
 	}
 	return defaultVal
 }
+
+func GetTlsConfig() *tls.Config {
+
+	// read ca's cert, verify to client's certificate
+	caPem, err := os.ReadFile(CaCertPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// create cert pool and append ca's cert
+	certPool := x509.NewCertPool()
+	if !certPool.AppendCertsFromPEM(caPem) {
+		log.Fatal(err)
+	}
+
+	// read server cert & key
+	serverCert, err := tls.LoadX509KeyPair(CustomTlsCertPath, TlSKeyPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// configuring TLS config based on provided certificates & keys to
+	conf := &tls.Config{
+		Certificates: []tls.Certificate{serverCert},
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+		ClientCAs:    certPool,
+	}
+	return conf
+}
diff --git a/chaoscenter/client-ext.conf b/chaoscenter/client-ext.conf
@@ -0,0 +1 @@
+subjectAltName=DNS:*.someclient.com,IP:0.0.0.0,DNS:localhost
diff --git a/chaoscenter/graphql/server/pkg/authorization/validate.go b/chaoscenter/graphql/server/pkg/authorization/validate.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/grpc"
+	"github.com/sirupsen/logrus"
 
 	grpc2 "google.golang.org/grpc"
 )
@@ -20,7 +21,8 @@ func ValidateRole(ctx context.Context, projectID string,
 		requiredRoles,
 		invitation)
 	if err != nil {
-		return errors.New("permission_denied")
+		logrus.Error(err)
+		return errors.New("permission_denied: " + err.Error())
 	}
 	return nil
 }
diff --git a/chaoscenter/graphql/server/pkg/grpc/auth_grpc_client.go b/chaoscenter/graphql/server/pkg/grpc/auth_grpc_client.go
@@ -3,6 +3,9 @@ package grpc
 import (
 	"context"
 	"errors"
+	"strconv"
+
+	"google.golang.org/grpc/credentials"
 
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/protos"
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/utils"
@@ -13,10 +16,34 @@ import (
 
 // GetAuthGRPCSvcClient returns an RPC client for Authentication service
 func GetAuthGRPCSvcClient(conn *grpc.ClientConn) (protos.AuthRpcServiceClient, *grpc.ClientConn) {
-	conn, err := grpc.Dial(utils.Config.LitmusAuthGrpcEndpoint+utils.Config.LitmusAuthGrpcPort, grpc.WithBlock(), grpc.WithInsecure())
+
+	enableHTTPSConnection, err := strconv.ParseBool(utils.Config.EnableInternalTls)
 	if err != nil {
-		logrus.Fatalf("did not connect: %s", err)
+		logrus.Errorf("unable to parse boolean value %v", err)
 	}
+
+	if enableHTTPSConnection {
+		if utils.Config.ServerTlsCertPath != "" {
+			// configuring TLS config based on provided certificates & keys
+			conf := utils.GetTlsConfig(utils.Config.ClientTlsCertPath, utils.Config.ClientTlsKeyPath, false)
+
+			tlsCredential := credentials.NewTLS(conf)
+
+			// Set up a connection to the server.
+			conn, err = grpc.NewClient(utils.Config.LitmusAuthGrpcEndpoint+utils.Config.LitmusAuthGrpcPortHttps, grpc.WithTransportCredentials(tlsCredential))
+			if err != nil {
+				logrus.Fatalf("did not connect: %v", err)
+			}
+		} else {
+			logrus.Fatalf("Failure to start chaoscenter authentication REST server due to empty TLS cert file path and TLS key path")
+		}
+	} else {
+		conn, err = grpc.Dial(utils.Config.LitmusAuthGrpcEndpoint+utils.Config.LitmusAuthGrpcPort, grpc.WithBlock(), grpc.WithInsecure())
+		if err != nil {
+			logrus.Fatalf("did not connect: %s", err)
+		}
+	}
+
 	return protos.NewAuthRpcServiceClient(conn), conn
 }
 

diff --git a/chaoscenter/graphql/server/server.go b/chaoscenter/graphql/server/server.go
@@ -4,6 +4,8 @@ import (
 	"regexp"
 	"strconv"
 
+	"google.golang.org/grpc/credentials"
+
 	"github.com/gin-gonic/gin"
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/api/middleware"
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/chaoshub"
@@ -35,6 +37,7 @@ import (
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/database/mongodb/config"
 	"github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/handlers"
 	pb "github.com/litmuschaos/litmus/chaoscenter/graphql/server/protos"
+	"github.com/sirupsen/logrus"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 )
@@ -100,7 +103,20 @@ func main() {
 	if err := validateVersion(); err != nil {
 		log.Fatal(err)
 	}
+
+	enableHTTPSConnection, err := strconv.ParseBool(utils.Config.EnableInternalTls)
+	if err != nil {
+		logrus.Errorf("unable to parse boolean value %v", err)
+	}
+
 	go startGRPCServer(utils.Config.RpcPort, mongodbOperator) // start GRPC serve
+	if enableHTTPSConnection {
+		if utils.Config.ServerTlsCertPath != "" && utils.Config.ServerTlsKeyPath != "" {
+			go startGRPCServerWithTLS(mongodbOperator) // start GRPC serve
+		} else {
+			log.Fatalf("Failure to start chaoscenter authentication REST server due to empty TLS cert file path and TLS key path")
+		}
+	}
 
 	srv := handler.New(generated.NewExecutableSchema(graph.NewConfig(mongodbOperator)))
 	srv.AddTransport(transport.POST{})
@@ -152,8 +168,24 @@ func main() {
 	projectEventChannel := make(chan string)
 	go projects.ProjectEvents(projectEventChannel, mongodb.MgoClient, mongodbOperator)
 
-	log.Infof("chaos manager running at http://localhost:%s", utils.Config.HttpPort)
+	if enableHTTPSConnection {
+		log.Infof("graphql server running at https://localhost:%s", utils.Config.HttpsPort)
+		// configuring TLS config based on provided certificates & keys
+		conf := utils.GetTlsConfig(utils.Config.ServerTlsCertPath, utils.Config.ServerTlsKeyPath, true)
+
+		server := http.Server{
+			Addr:      ":" + utils.Config.HttpsPort,
+			Handler:   router,
+			TLSConfig: conf,
+		}
+		if utils.Config.ServerTlsCertPath != "" && utils.Config.ServerTlsKeyPath != "" {
+			go log.Fatal(server.ListenAndServeTLS("", ""))
+		}
+	}
+
+	log.Infof("graphql server running at http://localhost:%s", utils.Config.HttpPort)
 	log.Fatal(http.ListenAndServe(":"+utils.Config.HttpPort, router))
+
 }
 
 // startGRPCServer initializes, registers services to and starts the gRPC server for RPC calls
@@ -172,3 +204,28 @@ func startGRPCServer(port string, mongodbOperator mongodb.MongoOperator) {
 	log.Infof("GRPC server listening on %v", lis.Addr())
 	log.Fatal(grpcServer.Serve(lis))
 }
+
+// startGRPCServerWithTLS initializes, registers services to and starts the gRPC server for RPC calls
+func startGRPCServerWithTLS(mongodbOperator mongodb.MongoOperator) {
+
+	lis, err := net.Listen("tcp", ":"+utils.Config.RpcPortHttps)
+	if err != nil {
+		log.Fatal("failed to listen: %w", err)
+	}
+
+	// configuring TLS config based on provided certificates & keys
+	conf := utils.GetTlsConfig(utils.Config.ServerTlsCertPath, utils.Config.ServerTlsKeyPath, true)
+
+	// create tls credentials
+	tlsCredentials := credentials.NewTLS(conf)
+
+	// create grpc server with tls credential
+	grpcServer := grpc.NewServer(grpc.Creds(tlsCredentials))
+
+	// Register services
+
+	pb.RegisterProjectServer(grpcServer, &projects.ProjectServer{Operator: mongodbOperator})
+
+	log.Infof("GRPC server listening on %v", lis.Addr())
+	log.Fatal(grpcServer.Serve(lis))
+}
diff --git a/chaoscenter/graphql/server/utils/config.go b/chaoscenter/graphql/server/utils/config.go
@@ -0,0 +1,47 @@
+package utils
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+)
+
+func GetTlsConfig(certPath string, keyPath string, isServerConfig bool) *tls.Config {
+
+	// read ca's cert, verify to client's certificate
+	caPem, err := os.ReadFile(Config.CaCertPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// create cert pool and append ca's cert
+	certPool := x509.NewCertPool()
+	if !certPool.AppendCertsFromPEM(caPem) {
+		log.Fatal(err)
+	}
+
+	// read server cert & key
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	config := &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		RootCAs:      certPool,
+	}
+
+	if isServerConfig {
+		// configuring TLS config based on provided certificates & keys to
+		conf := &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			ClientAuth:   tls.RequireAndVerifyClientCert,
+			ClientCAs:    certPool,
+		}
+		return conf
+	}
+
+	return config
+}
diff --git a/chaoscenter/graphql/server/utils/variables.go b/chaoscenter/graphql/server/utils/variables.go
@@ -23,17 +23,26 @@ type Configuration struct {
 	TlsCertB64                  string   `split_words:"true"`
 	LitmusAuthGrpcEndpoint      string   `split_words:"true" default:"localhost"`
 	LitmusAuthGrpcPort          string   `split_words:"true" default:":3030"`
+	LitmusAuthGrpcPortHttps     string   `split_words:"true" default:":3031"`
 	KubeConfigFilePath          string   `split_words:"true"`
 	RemoteHubMaxSize            string   `split_words:"true"`
 	SkipSslVerify               string   `split_words:"true"`
 	HttpPort                    string   `split_words:"true" default:"8080"`
+	HttpsPort                   string   `split_words:"true" default:"8081"`
 	RpcPort                     string   `split_words:"true" default:"8000"`
+	RpcPortHttps                string   `split_words:"true" default:"8001"`
 	InfraCompatibleVersions     string   `required:"true" split_words:"true"`
 	DefaultHubGitURL            string   `required:"true" default:"https://github.com/litmuschaos/chaos-charts"`
 	DefaultHubBranchName        string   `required:"true" split_words:"true"`
 	CustomChaosHubPath          string   `split_words:"true" default:"/tmp/"`
 	DefaultChaosHubPath         string   `split_words:"true" default:"/tmp/default/"`
 	EnableGQLIntrospection      string   `split_words:"true" default:"false"`
+	EnableInternalTls           string   `split_words:"true" default:"false"`
+	ServerTlsCertPath           string   `split_words:"true"`
+	ServerTlsKeyPath            string   `split_words:"true"`
+	ClientTlsCertPath           string   `split_words:"true"`
+	ClientTlsKeyPath            string   `split_words:"true"`
+	CaCertPath                  string   `split_words:"true"`
 	AllowedOrigins              []string `split_words:"true" default:"^(http://|https://|)litmuschaos.io(:[0-9]+|)?,^(http://|https://|)localhost(:[0-9]+|)"`
 }