From 48f6db779e68dd2c2fdfaa374422b72832f70a38 Mon Sep 17 00:00:00 2001 From: mrjoelkamp Date: Wed, 24 Jul 2024 14:16:20 -0500 Subject: [PATCH 1/4] feat: add readiness probe --- README.md | 14 +++----------- .../templates/attest-provider-deployment.yaml | 5 +++++ main.go | 9 ++++++++- pkg/handler/ready.go | 16 ++++++++++++++++ 4 files changed, 32 insertions(+), 12 deletions(-) create mode 100644 pkg/handler/ready.go diff --git a/README.md b/README.md index f8374dc..fa3769c 100644 --- a/README.md +++ b/README.md @@ -55,19 +55,11 @@ make docker-buildx # load the image into kind make kind-load-image -# Choose one of the following ways to deploy the external data provider: - -# 1. client and server auth enabled (recommended) -helm install attest-provider charts/external-data-provider \ +# deploy attest provider +helm install attest-provider charts/attest-provider \ --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \ + --set image="docker/attest-provider:dev" \ --namespace "${NAMESPACE:-gatekeeper-system}" - -# 2. client auth disabled and server auth enabled -helm install attest-provider charts/external-data-provider \ - --set clientCAFile="" \ - --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \ - --namespace "${NAMESPACE:-gatekeeper-system}" \ - --create-namespace ``` 4. Install constraint template and constraint. diff --git a/charts/attest-provider/templates/attest-provider-deployment.yaml b/charts/attest-provider/templates/attest-provider-deployment.yaml index cc6372e..326752e 100644 --- a/charts/attest-provider/templates/attest-provider-deployment.yaml +++ b/charts/attest-provider/templates/attest-provider-deployment.yaml @@ -68,6 +68,11 @@ spec: mountPath: {{ .Values.certDir }} readOnly: true {{- end }} + readinessProbe: + httpGet: + path: /ready + port: {{ .Values.port }} + scheme: HTTPS restartPolicy: Always nodeSelector: kubernetes.io/os: linux diff --git a/main.go b/main.go index 2d13c5f..798ad22 100644 --- a/main.go +++ b/main.go @@ -101,8 +101,15 @@ func main() { os.Exit(1) } + readyHandler, err := handler.NewReadyHandler() + if err != nil { + klog.ErrorS(err, "unable to create ready handler") + os.Exit(1) + } + mux.Handle("POST /validate", http.TimeoutHandler(validateHandler, handlerTimeout, timeoutError)) mux.Handle("POST /mutate", http.TimeoutHandler(mutateHandler, handlerTimeout, timeoutError)) + mux.Handle("GET /ready", readyHandler) server := &http.Server{ Addr: fmt.Sprintf(":%d", port), @@ -125,7 +132,7 @@ func main() { clientCAs.AppendCertsFromPEM(caCert) config.ClientCAs = clientCAs - config.ClientAuth = tls.RequireAndVerifyClientCert + config.ClientAuth = tls.VerifyClientCertIfGiven server.TLSConfig = config } diff --git a/pkg/handler/ready.go b/pkg/handler/ready.go new file mode 100644 index 0000000..b711b57 --- /dev/null +++ b/pkg/handler/ready.go @@ -0,0 +1,16 @@ +package handler + +import ( + "net/http" +) + +type readyHandler struct{} + +// NewReadyHandler returns a readiness probe handler. +func NewReadyHandler() (http.Handler, error) { + return &readyHandler{}, nil +} + +func (h *readyHandler) ServeHTTP(w http.ResponseWriter, _ *http.Request) { + w.WriteHeader(http.StatusOK) +} From 44a8819a5be5196a0004af7b0501de33d8f7a99b Mon Sep 17 00:00:00 2001 From: mrjoelkamp Date: Thu, 25 Jul 2024 09:27:18 -0500 Subject: [PATCH 2/4] refactor: inline ready handler --- main.go | 10 +++------- pkg/handler/ready.go | 16 ---------------- 2 files changed, 3 insertions(+), 23 deletions(-) delete mode 100644 pkg/handler/ready.go diff --git a/main.go b/main.go index 798ad22..d399f55 100644 --- a/main.go +++ b/main.go @@ -101,15 +101,11 @@ func main() { os.Exit(1) } - readyHandler, err := handler.NewReadyHandler() - if err != nil { - klog.ErrorS(err, "unable to create ready handler") - os.Exit(1) - } - mux.Handle("POST /validate", http.TimeoutHandler(validateHandler, handlerTimeout, timeoutError)) mux.Handle("POST /mutate", http.TimeoutHandler(mutateHandler, handlerTimeout, timeoutError)) - mux.Handle("GET /ready", readyHandler) + mux.Handle("GET /ready", http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.WriteHeader(http.StatusOK) + })) server := &http.Server{ Addr: fmt.Sprintf(":%d", port), diff --git a/pkg/handler/ready.go b/pkg/handler/ready.go deleted file mode 100644 index b711b57..0000000 --- a/pkg/handler/ready.go +++ /dev/null @@ -1,16 +0,0 @@ -package handler - -import ( - "net/http" -) - -type readyHandler struct{} - -// NewReadyHandler returns a readiness probe handler. -func NewReadyHandler() (http.Handler, error) { - return &readyHandler{}, nil -} - -func (h *readyHandler) ServeHTTP(w http.ResponseWriter, _ *http.Request) { - w.WriteHeader(http.StatusOK) -} From 76355c0d94fe847fba20fc5637330daa3306a604 Mon Sep 17 00:00:00 2001 From: "attest-release[bot]" <176524748+attest-release[bot]@users.noreply.github.com> Date: Thu, 25 Jul 2024 15:26:53 +0000 Subject: [PATCH 3/4] [BOT] Update attest lib (#54) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index d529605..eb6caa7 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/docker/attest-provider go 1.22.5 require ( - github.com/docker/attest v0.1.10 + github.com/docker/attest v0.1.11 github.com/google/go-containerregistry v0.20.1 github.com/in-toto/in-toto-golang v0.9.0 github.com/open-policy-agent/frameworks/constraint v0.0.0-20221214024800-b745745c4118 diff --git a/go.sum b/go.sum index 3997ff5..9a017b0 100644 --- a/go.sum +++ b/go.sum @@ -212,8 +212,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/attest v0.1.10 h1:KPp8V7VpTLFpXLC1LBVyaIvhkoXJCFRAzYsXLeJWK6A= -github.com/docker/attest v0.1.10/go.mod h1:ymA2Qv8YP9qRUXXC8VlaKP5AfhldFkHskM3HyNOMxgw= +github.com/docker/attest v0.1.11 h1:Nh7RmQXPdPOoM6eP9qvPXtUGPVuOJPCBcbvMIihoQrQ= +github.com/docker/attest v0.1.11/go.mod h1:B3aMIZ1ONEbUYWROpoOpXPTaUP5Ee6i7MscsXbaNCfw= github.com/docker/cli v26.1.3+incompatible h1:bUpXT/N0kDE3VUHI2r5VMsYQgi38kYuoC0oL9yt3lqc= github.com/docker/cli v26.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= From 0b4e8fc12508f9ac0d5a9f674d609eb505507c03 Mon Sep 17 00:00:00 2001 From: mrjoelkamp Date: Fri, 26 Jul 2024 09:44:12 -0500 Subject: [PATCH 4/4] fix: increase handler timeout --- main.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/main.go b/main.go index d399f55..61f9b25 100644 --- a/main.go +++ b/main.go @@ -17,7 +17,6 @@ import ( ) const ( - handlerTimeout = 15 * time.Second readHeaderTimeout = 1 * time.Second ) @@ -29,9 +28,10 @@ const ( ) var ( - certDir string - clientCAFile string - port int + certDir string + clientCAFile string + port int + handlerTimeoutSeconds int tufRoot string tufoutputPath string @@ -62,6 +62,7 @@ func init() { flag.StringVar(&certDir, "cert-dir", "", "path to directory containing TLS certificates") flag.StringVar(&clientCAFile, "client-ca-file", "", "path to client CA certificate") flag.IntVar(&port, "port", defaultPort, "Port for the server to listen on") + flag.IntVar(&handlerTimeoutSeconds, "handler-timeout", 25, "timeout for handler in seconds") flag.StringVar(&tufRoot, "tuf-root", "prod", "specify embedded tuf root [dev, staging, prod], default [prod]") flag.StringVar(&metadataURL, "tuf-metadata-source", defaultMetadataURL, "source (URL or repo) for TUF metadata") @@ -79,6 +80,7 @@ func init() { func main() { mux := http.NewServeMux() + handlerTimeout := time.Duration(handlerTimeoutSeconds) * time.Second validateHandler, err := handler.NewValidateHandler(&handler.ValidateHandlerOptions{ TUFRoot: tufRoot,