You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "hailin0 (via GitHub)" <gi...@apache.org> on 2023/09/16 15:13:25 UTC
[GitHub] [skywalking-banyandb] hailin0 opened a new pull request, #331: Support etcd client authentication
hailin0 opened a new pull request, #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331
Set authentication parameters from startup command
<!--
β οΈ Please make sure to read this template first, pull requests that don't accord with this template
maybe closed without notice.
Texts surrounded by `<` and `>` are meant to be replaced by you, e.g. <framework name>, <issue number>.
Put an `x` in the `[ ]` to mark the item as CHECKED. `[x]`
-->
### Fix https://github.com/apache/skywalking/issues/9187
- [ ] Add a unit test to verify that the fix works.
- [x] Explain briefly why the bug exists and how to fix it.
Support set etcd authentication parameters from startup command
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ====
### <Feature description>
- [ ] If this is non-trivial feature, paste the links/URLs to the design doc.
- [ ] Update the documentation to include this new feature.
- [ ] Tests(including UT, IT, E2E) are added to verify the new feature.
- [ ] If it's UI related, attach the screenshots below.
==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ==== -->
- [x] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Fixes apache/skywalking#9187.
- [x] Update the [`CHANGES` log](https://github.com/apache/skywalking-banyandb/blob/main/CHANGES.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hanahmily (via GitHub)" <gi...@apache.org>.
hanahmily merged PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on code in PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#discussion_r1365725043
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
Review Comment:
fixed
##########
test/integration/etcd/client_test.go:
##########
@@ -0,0 +1,304 @@
+// Licensed to Apache Software Foundation (ASF) under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Apache Software Foundation (ASF) licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package integration_etcd_test
+
+import (
+ "context"
+ "crypto/tls"
+ "fmt"
+ "log"
+ "net/url"
+ "path/filepath"
+ "time"
+
+ . "github.com/onsi/ginkgo/v2"
+ . "github.com/onsi/gomega"
+ "github.com/onsi/gomega/gleak"
+ "go.etcd.io/etcd/client/pkg/v3/transport"
+ clientv3 "go.etcd.io/etcd/client/v3"
+ "go.etcd.io/etcd/server/v3/embed"
+
+ databasev1 "github.com/apache/skywalking-banyandb/api/proto/banyandb/database/v1"
+ "github.com/apache/skywalking-banyandb/banyand/metadata/schema"
+ "github.com/apache/skywalking-banyandb/pkg/test"
+ "github.com/apache/skywalking-banyandb/pkg/test/flags"
+ "github.com/apache/skywalking-banyandb/pkg/test/helpers"
+ "github.com/apache/skywalking-banyandb/pkg/test/setup"
+)
+
+const host = "127.0.0.1"
+
+const namespace = "liaison-test"
+
+const nodeHost = "liaison-1"
+
+var _ = Describe("Client Test", func() {
+ var (
+ dir string
+ dirSpaceDef func()
+ caFilePath string
+ serverKeyFilePath string
+ serverCertFilePath string
+ clientKeyFilePath string
+ clientCertFilePath string
+ goods []gleak.Goroutine
+ )
+ BeforeEach(func() {
+ var err error
+ dir, dirSpaceDef, err = test.NewSpace()
+ Expect(err).ShouldNot(HaveOccurred())
+ caFilePath, err = filepath.Abs("./cafile/ca.crt")
+ Expect(err).ShouldNot(HaveOccurred())
+ serverKeyFilePath, err = filepath.Abs("./cafile/server-serverusage.key.insecure")
+ Expect(err).ShouldNot(HaveOccurred())
+ serverCertFilePath, err = filepath.Abs("./cafile/server-serverusage.crt")
+ Expect(err).ShouldNot(HaveOccurred())
+ clientKeyFilePath, err = filepath.Abs("./cafile/client-clientusage.key.insecure")
+ Expect(err).ShouldNot(HaveOccurred())
+ clientCertFilePath, err = filepath.Abs("./cafile/client-clientusage.crt")
+ Expect(err).ShouldNot(HaveOccurred())
+
+ goods = gleak.Goroutines()
+ })
+ AfterEach(func() {
+ dirSpaceDef()
+ Eventually(gleak.Goroutines, flags.EventuallyTimeout).ShouldNot(gleak.HaveLeaked(goods))
+ })
+
+ It("should be using user/password connect etcd server successfully", func() {
+ serverTLSInfo := transport.TLSInfo{}
+ clientTLSInfo := transport.TLSInfo{}
+ clientConfig, err := clientTLSInfo.ClientConfig()
+ Expect(err).ShouldNot(HaveOccurred())
+ username := "banyandb"
+ password := "banyandb"
+
+ etcdServer, err := createEtcdServer(dir, serverTLSInfo)
+ Expect(err).ShouldNot(HaveOccurred())
+ // wait for e.Server to join the cluster
+ <-etcdServer.Server.ReadyNotify()
+ etcdEndpoint := etcdServer.Config().ListenClientUrls[0].String()
+ defer etcdServer.Close()
+
+ adminClient, err := clientv3.New(clientv3.Config{
+ Endpoints: []string{etcdEndpoint},
+ })
+ Expect(err).ShouldNot(HaveOccurred())
+ defer adminClient.Close()
+ adminClient.RoleAdd(context.Background(), "root")
+ adminClient.UserAdd(context.Background(), "root", "root")
+ adminClient.UserGrantRole(context.Background(), "root", "root")
+ adminClient.UserAdd(context.Background(), username, password)
+ adminClient.UserGrantRole(context.Background(), username, "root")
+ adminClient.AuthEnable(context.Background())
+
+ ports, err := test.AllocateFreePorts(2)
+ Expect(err).NotTo(HaveOccurred())
+ addr := fmt.Sprintf("%s:%d", host, ports[0])
+ httpAddr := fmt.Sprintf("%s:%d", host, ports[1])
+ closeFn := setup.CMD("liaison",
+ "--namespace", namespace,
+ "--grpc-host="+host,
+ fmt.Sprintf("--grpc-port=%d", ports[0]),
+ "--http-host="+host,
+ fmt.Sprintf("--http-port=%d", ports[1]),
+ "--http-grpc-addr="+addr,
+ "--node-host-provider", "flag",
+ "--node-host", nodeHost,
+ "--etcd-endpoints", etcdEndpoint,
+ "--etcd-username", username,
+ "--etcd-password", password)
+ defer closeFn()
+
+ Eventually(helpers.HTTPHealthCheck(httpAddr), flags.EventuallyTimeout).Should(Succeed())
+ Eventually(func() (map[string]*databasev1.Node, error) {
+ return listKeys(etcdEndpoint, username, password, clientConfig, fmt.Sprintf("/%s/nodes/%s:%d", namespace, nodeHost, ports[0]))
+ }, flags.EventuallyTimeout).Should(HaveLen(1))
+ })
+
+ It("should be using cacert connect etcd server successfully", func() {
+ serverTLSInfo := transport.TLSInfo{
+ KeyFile: serverKeyFilePath,
+ CertFile: serverCertFilePath,
+ }
+ clientTLSInfo := transport.TLSInfo{
+ TrustedCAFile: caFilePath,
+ }
+ clientConfig, err := clientTLSInfo.ClientConfig()
+ Expect(err).ShouldNot(HaveOccurred())
+
+ etcdServer, err := createEtcdServer(dir, serverTLSInfo)
+ Expect(err).ShouldNot(HaveOccurred())
+ // wait for e.Server to join the cluster
+ <-etcdServer.Server.ReadyNotify()
+ etcdEndpoint := etcdServer.Config().ListenClientUrls[0].String()
+ defer etcdServer.Close()
+
+ ports, err := test.AllocateFreePorts(2)
+ Expect(err).NotTo(HaveOccurred())
+ addr := fmt.Sprintf("%s:%d", host, ports[0])
+ httpAddr := fmt.Sprintf("%s:%d", host, ports[1])
+ closeFn := setup.CMD("liaison",
+ "--namespace", namespace,
+ "--grpc-host="+host,
+ fmt.Sprintf("--grpc-port=%d", ports[0]),
+ "--http-host="+host,
+ fmt.Sprintf("--http-port=%d", ports[1]),
+ "--http-grpc-addr="+addr,
+ "--node-host-provider", "flag",
+ "--node-host", nodeHost,
+ "--etcd-endpoints", etcdEndpoint,
+ "--etcd-tls-ca-file", caFilePath)
+ defer closeFn()
+
+ Eventually(helpers.HTTPHealthCheck(httpAddr), flags.EventuallyTimeout).Should(Succeed())
+ Eventually(func() (map[string]*databasev1.Node, error) {
+ return listKeys(etcdEndpoint, "", "", clientConfig, fmt.Sprintf("/%s/nodes/%s:%d", namespace, nodeHost, ports[0]))
+ }, flags.EventuallyTimeout).Should(HaveLen(1))
+ })
+
+ It("should be using key pair connect etcd server successfully", func() {
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#issuecomment-1771972416
@hanahmily PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on code in PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#discussion_r1365724065
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
+
+The etcd user can be setup by the [etcd authentication guide](https://etcd.io/docs/v3.5/op-guide/authentication/)
+
+The username/password is configured in the following command:
Review Comment:
added `note`
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
+
+The etcd user can be setup by the [etcd authentication guide](https://etcd.io/docs/v3.5/op-guide/authentication/)
+
+The username/password is configured in the following command:
+
+- `etcd-username`: The username for etcd client authentication.
+- `etcd-password`: The password for etcd client authentication.
+
+```shell
+$ ./banyand-server storage --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+$ ./banyand-server liaison --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+```
+
+### Client-to-server transport security with HTTPS
+
+The etcd trusted certificate file can be setup by the [etcd transport security model](https://etcd.io/docs/v3.5/op-guide/security/#example-1-client-to-server-transport-security-with-https)
+
+- `etcd-tls-ca-file`: The path of the trusted certificate file.
+
+```shell
+$ ./banyand-server storage --etcd-endpoints=your-https-endpoints --etcd-tls-ca-file=youf-file-path <flags>
+$ ./banyand-server liaison --etcd-endpoints=your-https-endpoints --etcd-tls-ca-file=youf-file-path <flags>
+```
+
+### Client-to-server authentication with HTTPS client certificates
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hanahmily (via GitHub)" <gi...@apache.org>.
hanahmily commented on code in PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#discussion_r1365102335
##########
.licenserc.yaml:
##########
@@ -85,6 +85,7 @@ header: # `header` section is configurations for source codes license header.
- 'ui'
- '.github/PULL_REQUEST_TEMPLATE'
- "**/*.prof"
+ - "**/test/integration/etcd/cafile/**"
Review Comment:
Would you please put them into `testdata`, which is ignored by the checker automatically? You can put this folder in any place.
##########
test/integration/etcd/client_test.go:
##########
@@ -0,0 +1,304 @@
+// Licensed to Apache Software Foundation (ASF) under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Apache Software Foundation (ASF) licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package integration_etcd_test
+
+import (
+ "context"
+ "crypto/tls"
+ "fmt"
+ "log"
+ "net/url"
+ "path/filepath"
+ "time"
+
+ . "github.com/onsi/ginkgo/v2"
+ . "github.com/onsi/gomega"
+ "github.com/onsi/gomega/gleak"
+ "go.etcd.io/etcd/client/pkg/v3/transport"
+ clientv3 "go.etcd.io/etcd/client/v3"
+ "go.etcd.io/etcd/server/v3/embed"
+
+ databasev1 "github.com/apache/skywalking-banyandb/api/proto/banyandb/database/v1"
+ "github.com/apache/skywalking-banyandb/banyand/metadata/schema"
+ "github.com/apache/skywalking-banyandb/pkg/test"
+ "github.com/apache/skywalking-banyandb/pkg/test/flags"
+ "github.com/apache/skywalking-banyandb/pkg/test/helpers"
+ "github.com/apache/skywalking-banyandb/pkg/test/setup"
+)
+
+const host = "127.0.0.1"
+
+const namespace = "liaison-test"
+
+const nodeHost = "liaison-1"
+
+var _ = Describe("Client Test", func() {
+ var (
+ dir string
+ dirSpaceDef func()
+ caFilePath string
+ serverKeyFilePath string
+ serverCertFilePath string
+ clientKeyFilePath string
+ clientCertFilePath string
+ goods []gleak.Goroutine
+ )
+ BeforeEach(func() {
+ var err error
+ dir, dirSpaceDef, err = test.NewSpace()
+ Expect(err).ShouldNot(HaveOccurred())
+ caFilePath, err = filepath.Abs("./cafile/ca.crt")
Review Comment:
Please use https://github.com/apache/skywalking-banyandb/blob/main/test/integration/standalone/other/tls_test.go#L47 to load files
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
Review Comment:
```suggestion
## Etcd Authentication
```
##########
test/integration/etcd/client_test.go:
##########
@@ -0,0 +1,304 @@
+// Licensed to Apache Software Foundation (ASF) under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Apache Software Foundation (ASF) licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package integration_etcd_test
+
+import (
+ "context"
+ "crypto/tls"
+ "fmt"
+ "log"
+ "net/url"
+ "path/filepath"
+ "time"
+
+ . "github.com/onsi/ginkgo/v2"
+ . "github.com/onsi/gomega"
+ "github.com/onsi/gomega/gleak"
+ "go.etcd.io/etcd/client/pkg/v3/transport"
+ clientv3 "go.etcd.io/etcd/client/v3"
+ "go.etcd.io/etcd/server/v3/embed"
+
+ databasev1 "github.com/apache/skywalking-banyandb/api/proto/banyandb/database/v1"
+ "github.com/apache/skywalking-banyandb/banyand/metadata/schema"
+ "github.com/apache/skywalking-banyandb/pkg/test"
+ "github.com/apache/skywalking-banyandb/pkg/test/flags"
+ "github.com/apache/skywalking-banyandb/pkg/test/helpers"
+ "github.com/apache/skywalking-banyandb/pkg/test/setup"
+)
+
+const host = "127.0.0.1"
+
+const namespace = "liaison-test"
+
+const nodeHost = "liaison-1"
+
+var _ = Describe("Client Test", func() {
+ var (
+ dir string
+ dirSpaceDef func()
+ caFilePath string
+ serverKeyFilePath string
+ serverCertFilePath string
+ clientKeyFilePath string
+ clientCertFilePath string
+ goods []gleak.Goroutine
+ )
+ BeforeEach(func() {
+ var err error
+ dir, dirSpaceDef, err = test.NewSpace()
+ Expect(err).ShouldNot(HaveOccurred())
+ caFilePath, err = filepath.Abs("./cafile/ca.crt")
+ Expect(err).ShouldNot(HaveOccurred())
+ serverKeyFilePath, err = filepath.Abs("./cafile/server-serverusage.key.insecure")
+ Expect(err).ShouldNot(HaveOccurred())
+ serverCertFilePath, err = filepath.Abs("./cafile/server-serverusage.crt")
+ Expect(err).ShouldNot(HaveOccurred())
+ clientKeyFilePath, err = filepath.Abs("./cafile/client-clientusage.key.insecure")
+ Expect(err).ShouldNot(HaveOccurred())
+ clientCertFilePath, err = filepath.Abs("./cafile/client-clientusage.crt")
+ Expect(err).ShouldNot(HaveOccurred())
+
+ goods = gleak.Goroutines()
+ })
+ AfterEach(func() {
+ dirSpaceDef()
+ Eventually(gleak.Goroutines, flags.EventuallyTimeout).ShouldNot(gleak.HaveLeaked(goods))
+ })
+
+ It("should be using user/password connect etcd server successfully", func() {
+ serverTLSInfo := transport.TLSInfo{}
+ clientTLSInfo := transport.TLSInfo{}
+ clientConfig, err := clientTLSInfo.ClientConfig()
+ Expect(err).ShouldNot(HaveOccurred())
+ username := "banyandb"
+ password := "banyandb"
+
+ etcdServer, err := createEtcdServer(dir, serverTLSInfo)
+ Expect(err).ShouldNot(HaveOccurred())
+ // wait for e.Server to join the cluster
+ <-etcdServer.Server.ReadyNotify()
+ etcdEndpoint := etcdServer.Config().ListenClientUrls[0].String()
+ defer etcdServer.Close()
+
+ adminClient, err := clientv3.New(clientv3.Config{
+ Endpoints: []string{etcdEndpoint},
+ })
+ Expect(err).ShouldNot(HaveOccurred())
+ defer adminClient.Close()
+ adminClient.RoleAdd(context.Background(), "root")
+ adminClient.UserAdd(context.Background(), "root", "root")
+ adminClient.UserGrantRole(context.Background(), "root", "root")
+ adminClient.UserAdd(context.Background(), username, password)
+ adminClient.UserGrantRole(context.Background(), username, "root")
+ adminClient.AuthEnable(context.Background())
+
+ ports, err := test.AllocateFreePorts(2)
+ Expect(err).NotTo(HaveOccurred())
+ addr := fmt.Sprintf("%s:%d", host, ports[0])
+ httpAddr := fmt.Sprintf("%s:%d", host, ports[1])
+ closeFn := setup.CMD("liaison",
+ "--namespace", namespace,
+ "--grpc-host="+host,
+ fmt.Sprintf("--grpc-port=%d", ports[0]),
+ "--http-host="+host,
+ fmt.Sprintf("--http-port=%d", ports[1]),
+ "--http-grpc-addr="+addr,
+ "--node-host-provider", "flag",
+ "--node-host", nodeHost,
+ "--etcd-endpoints", etcdEndpoint,
+ "--etcd-username", username,
+ "--etcd-password", password)
+ defer closeFn()
+
+ Eventually(helpers.HTTPHealthCheck(httpAddr), flags.EventuallyTimeout).Should(Succeed())
+ Eventually(func() (map[string]*databasev1.Node, error) {
+ return listKeys(etcdEndpoint, username, password, clientConfig, fmt.Sprintf("/%s/nodes/%s:%d", namespace, nodeHost, ports[0]))
+ }, flags.EventuallyTimeout).Should(HaveLen(1))
+ })
+
+ It("should be using cacert connect etcd server successfully", func() {
+ serverTLSInfo := transport.TLSInfo{
+ KeyFile: serverKeyFilePath,
+ CertFile: serverCertFilePath,
+ }
+ clientTLSInfo := transport.TLSInfo{
+ TrustedCAFile: caFilePath,
+ }
+ clientConfig, err := clientTLSInfo.ClientConfig()
+ Expect(err).ShouldNot(HaveOccurred())
+
+ etcdServer, err := createEtcdServer(dir, serverTLSInfo)
+ Expect(err).ShouldNot(HaveOccurred())
+ // wait for e.Server to join the cluster
+ <-etcdServer.Server.ReadyNotify()
+ etcdEndpoint := etcdServer.Config().ListenClientUrls[0].String()
+ defer etcdServer.Close()
+
+ ports, err := test.AllocateFreePorts(2)
+ Expect(err).NotTo(HaveOccurred())
+ addr := fmt.Sprintf("%s:%d", host, ports[0])
+ httpAddr := fmt.Sprintf("%s:%d", host, ports[1])
+ closeFn := setup.CMD("liaison",
+ "--namespace", namespace,
+ "--grpc-host="+host,
+ fmt.Sprintf("--grpc-port=%d", ports[0]),
+ "--http-host="+host,
+ fmt.Sprintf("--http-port=%d", ports[1]),
+ "--http-grpc-addr="+addr,
+ "--node-host-provider", "flag",
+ "--node-host", nodeHost,
+ "--etcd-endpoints", etcdEndpoint,
+ "--etcd-tls-ca-file", caFilePath)
+ defer closeFn()
+
+ Eventually(helpers.HTTPHealthCheck(httpAddr), flags.EventuallyTimeout).Should(Succeed())
+ Eventually(func() (map[string]*databasev1.Node, error) {
+ return listKeys(etcdEndpoint, "", "", clientConfig, fmt.Sprintf("/%s/nodes/%s:%d", namespace, nodeHost, ports[0]))
+ }, flags.EventuallyTimeout).Should(HaveLen(1))
+ })
+
+ It("should be using key pair connect etcd server successfully", func() {
Review Comment:
As we discussed earlier, the procedure is not working correctly, as it cannot connect with the server.
How do you fix it?
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
+
+The etcd user can be setup by the [etcd authentication guide](https://etcd.io/docs/v3.5/op-guide/authentication/)
+
+The username/password is configured in the following command:
+
+- `etcd-username`: The username for etcd client authentication.
+- `etcd-password`: The password for etcd client authentication.
+
+```shell
+$ ./banyand-server storage --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+$ ./banyand-server liaison --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+```
+
+### Client-to-server transport security with HTTPS
+
+The etcd trusted certificate file can be setup by the [etcd transport security model](https://etcd.io/docs/v3.5/op-guide/security/#example-1-client-to-server-transport-security-with-https)
+
+- `etcd-tls-ca-file`: The path of the trusted certificate file.
+
+```shell
+$ ./banyand-server storage --etcd-endpoints=your-https-endpoints --etcd-tls-ca-file=youf-file-path <flags>
+$ ./banyand-server liaison --etcd-endpoints=your-https-endpoints --etcd-tls-ca-file=youf-file-path <flags>
+```
+
+### Client-to-server authentication with HTTPS client certificates
Review Comment:
```suggestion
### Authentication with HTTPS client certificates
```
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
Review Comment:
```suggestion
### Authentication with username/password
```
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
+
+The etcd user can be setup by the [etcd authentication guide](https://etcd.io/docs/v3.5/op-guide/authentication/)
+
+The username/password is configured in the following command:
+
+- `etcd-username`: The username for etcd client authentication.
+- `etcd-password`: The password for etcd client authentication.
+
+```shell
+$ ./banyand-server storage --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+$ ./banyand-server liaison --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+```
+
+### Client-to-server transport security with HTTPS
Review Comment:
```suggestion
### Transport security with HTTPS
```
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
Review Comment:
```suggestion
`etcd` supports through tls certificates and RBAC-based authentication for both clients to server communication. This section tends to help users set up authentication for BanyanDB.
```
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
+
+The etcd user can be setup by the [etcd authentication guide](https://etcd.io/docs/v3.5/op-guide/authentication/)
+
+The username/password is configured in the following command:
Review Comment:
Setting a password through command-line flags when starting a Golang server can be considered a security risk. We should recommend users set through Environment Variables.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-banyandb] hanahmily commented on a diff in pull request #331: Support etcd client authentication
Posted by "hanahmily (via GitHub)" <gi...@apache.org>.
hanahmily commented on code in PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#discussion_r1328091946
##########
banyand/metadata/client.go:
##########
@@ -56,6 +71,11 @@ func (s *clientService) FlagSet() *run.FlagSet {
fs := run.NewFlagSet("metadata")
fs.StringVar(&s.namespace, "namespace", "banyandb", "The namespace of the metadata stored in etcd")
fs.StringArrayVar(&s.endpoints, flagEtcdEndpointsName, []string{"http://localhost:2379"}, "A comma-delimited list of etcd endpoints")
+ fs.StringVar(&s.etcdUsername, flagEtcdUsername, "", "A username of etcd")
+ fs.StringVar(&s.etcdPassword, flagEtcdPassword, "", "A password of etcd user")
+ fs.StringVar(&s.etcdTLSCAFile, flagEtcdTLSCAFile, "", "A trusted ca file of etcd tls config")
+ fs.StringVar(&s.etcdTLSCertFile, flagEtcdTLSCertFile, "", "A cert file of etcd tls config")
Review Comment:
```suggestion
fs.StringVar(&s.etcdTLSCertFile, flagEtcdTLSCertFile, "", "Etcd client certificate")
```
##########
banyand/metadata/client.go:
##########
@@ -56,6 +71,11 @@ func (s *clientService) FlagSet() *run.FlagSet {
fs := run.NewFlagSet("metadata")
fs.StringVar(&s.namespace, "namespace", "banyandb", "The namespace of the metadata stored in etcd")
fs.StringArrayVar(&s.endpoints, flagEtcdEndpointsName, []string{"http://localhost:2379"}, "A comma-delimited list of etcd endpoints")
+ fs.StringVar(&s.etcdUsername, flagEtcdUsername, "", "A username of etcd")
+ fs.StringVar(&s.etcdPassword, flagEtcdPassword, "", "A password of etcd user")
+ fs.StringVar(&s.etcdTLSCAFile, flagEtcdTLSCAFile, "", "A trusted ca file of etcd tls config")
Review Comment:
```suggestion
fs.StringVar(&s.etcdTLSCAFile, flagEtcdTLSCAFile, "", "Trusted certificate authority")
```
##########
banyand/metadata/client.go:
##########
@@ -56,6 +71,11 @@ func (s *clientService) FlagSet() *run.FlagSet {
fs := run.NewFlagSet("metadata")
fs.StringVar(&s.namespace, "namespace", "banyandb", "The namespace of the metadata stored in etcd")
fs.StringArrayVar(&s.endpoints, flagEtcdEndpointsName, []string{"http://localhost:2379"}, "A comma-delimited list of etcd endpoints")
+ fs.StringVar(&s.etcdUsername, flagEtcdUsername, "", "A username of etcd")
+ fs.StringVar(&s.etcdPassword, flagEtcdPassword, "", "A password of etcd user")
+ fs.StringVar(&s.etcdTLSCAFile, flagEtcdTLSCAFile, "", "A trusted ca file of etcd tls config")
+ fs.StringVar(&s.etcdTLSCertFile, flagEtcdTLSCertFile, "", "A cert file of etcd tls config")
+ fs.StringVar(&s.etcdTLSKeyFile, flagEtcdTLSKeyFile, "", "A key file of etcd tls config")
Review Comment:
```suggestion
fs.StringVar(&s.etcdTLSKeyFile, flagEtcdTLSKeyFile, "", "Private key for the etcd client certificate.")
```
##########
banyand/metadata/client.go:
##########
@@ -35,17 +35,32 @@ import (
const flagEtcdEndpointsName = "etcd-endpoints"
+const flagEtcdUsername = "etcd-username"
+
+const flagEtcdPassword = "etcd-password"
+
+const flagEtcdTLSCAFile = "etcd-tls-ca-file"
+
+const flagEtcdTLSCertFile = "etcd-tls-cert-file"
+
+const flagEtcdTLSKeyFile = "etcd-tls-key-file"
+
// NewClient returns a new metadata client.
func NewClient(_ context.Context) (Service, error) {
return &clientService{closer: run.NewCloser(1)}, nil
}
type clientService struct {
- namespace string
- schemaRegistry schema.Registry
- alc *allocator
- closer *run.Closer
- endpoints []string
+ namespace string
+ etcdUsername string
+ etcdPassword string
+ etcdTLSCAFile string
+ etcdTLSCertFile string
+ etcdTLSKeyFile string
Review Comment:
Both of these fields must either be present together or not at all. Please add a checker to verify it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#issuecomment-1768623495
> You should create test cases to ensure the added items are verified. You can utilize "test/integration/distributed/setup/node_test.go" as a reference for writing the test cases.
@hanahmily please help to review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-banyandb] hailin0 commented on pull request #331: Support etcd client authentication
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#issuecomment-1722251246
reference
https://github.com/etcd-io/etcd/blob/9ec5f981894063d13fdc5cfc60933c515ab6c6c2/tests/integration/clientv3/examples/example_test.go#L58
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-banyandb] codecov-commenter commented on pull request #331: Support etcd client authentication
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#issuecomment-1722251866
## [Codecov](https://app.codecov.io/gh/apache/skywalking-banyandb/pull/331?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
> Merging [#331](https://app.codecov.io/gh/apache/skywalking-banyandb/pull/331?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (c486996) into [main](https://app.codecov.io/gh/apache/skywalking-banyandb/commit/9552688d60f055f6bb539a91464e8b1db77e7309?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (9552688) will **decrease** coverage by `0.05%`.
> The diff coverage is `32.60%`.
```diff
@@ Coverage Diff @@
## main #331 +/- ##
==========================================
- Coverage 40.59% 40.54% -0.05%
==========================================
Files 110 110
Lines 11775 11821 +46
==========================================
+ Hits 4780 4793 +13
- Misses 6526 6558 +32
- Partials 469 470 +1
```
| [Files Changed](https://app.codecov.io/gh/apache/skywalking-banyandb/pull/331?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Ξ | |
|---|---|---|
| [banyand/metadata/schema/etcd.go](https://app.codecov.io/gh/apache/skywalking-banyandb/pull/331?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-YmFueWFuZC9tZXRhZGF0YS9zY2hlbWEvZXRjZC5nbw==) | `46.40% <13.88%> (-4.34%)` | :arrow_down: |
| [banyand/metadata/client.go](https://app.codecov.io/gh/apache/skywalking-banyandb/pull/331?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-YmFueWFuZC9tZXRhZGF0YS9jbGllbnQuZ28=) | `44.65% <100.00%> (+3.71%)` | :arrow_up: |
... and [1 file with indirect coverage changes](https://app.codecov.io/gh/apache/skywalking-banyandb/pull/331/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
:mega: Weβre building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on code in PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#discussion_r1365725432
##########
test/integration/etcd/client_test.go:
##########
@@ -0,0 +1,304 @@
+// Licensed to Apache Software Foundation (ASF) under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Apache Software Foundation (ASF) licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package integration_etcd_test
+
+import (
+ "context"
+ "crypto/tls"
+ "fmt"
+ "log"
+ "net/url"
+ "path/filepath"
+ "time"
+
+ . "github.com/onsi/ginkgo/v2"
+ . "github.com/onsi/gomega"
+ "github.com/onsi/gomega/gleak"
+ "go.etcd.io/etcd/client/pkg/v3/transport"
+ clientv3 "go.etcd.io/etcd/client/v3"
+ "go.etcd.io/etcd/server/v3/embed"
+
+ databasev1 "github.com/apache/skywalking-banyandb/api/proto/banyandb/database/v1"
+ "github.com/apache/skywalking-banyandb/banyand/metadata/schema"
+ "github.com/apache/skywalking-banyandb/pkg/test"
+ "github.com/apache/skywalking-banyandb/pkg/test/flags"
+ "github.com/apache/skywalking-banyandb/pkg/test/helpers"
+ "github.com/apache/skywalking-banyandb/pkg/test/setup"
+)
+
+const host = "127.0.0.1"
+
+const namespace = "liaison-test"
+
+const nodeHost = "liaison-1"
+
+var _ = Describe("Client Test", func() {
+ var (
+ dir string
+ dirSpaceDef func()
+ caFilePath string
+ serverKeyFilePath string
+ serverCertFilePath string
+ clientKeyFilePath string
+ clientCertFilePath string
+ goods []gleak.Goroutine
+ )
+ BeforeEach(func() {
+ var err error
+ dir, dirSpaceDef, err = test.NewSpace()
+ Expect(err).ShouldNot(HaveOccurred())
+ caFilePath, err = filepath.Abs("./cafile/ca.crt")
Review Comment:
fixed
##########
.licenserc.yaml:
##########
@@ -85,6 +85,7 @@ header: # `header` section is configurations for source codes license header.
- 'ui'
- '.github/PULL_REQUEST_TEMPLATE'
- "**/*.prof"
+ - "**/test/integration/etcd/cafile/**"
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support etcd client authentication [skywalking-banyandb]
Posted by "hailin0 (via GitHub)" <gi...@apache.org>.
hailin0 commented on code in PR #331:
URL: https://github.com/apache/skywalking-banyandb/pull/331#discussion_r1365724556
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
+
+The etcd user can be setup by the [etcd authentication guide](https://etcd.io/docs/v3.5/op-guide/authentication/)
+
+The username/password is configured in the following command:
+
+- `etcd-username`: The username for etcd client authentication.
+- `etcd-password`: The password for etcd client authentication.
+
+```shell
+$ ./banyand-server storage --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+$ ./banyand-server liaison --etcd-endpoints=your-endpoints --etcd-username=your-username --etcd-password=your-password <flags>
+```
+
+### Client-to-server transport security with HTTPS
Review Comment:
fixed
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
+
+etcd supports through tls certificates and RBAC based authentication for both clients to server communication. This section is intended to help users set up authentication in etcd client.
+
+### Client-to-server authentication with username/password
Review Comment:
fixed
##########
docs/installation/cluster.md:
##########
@@ -28,3 +28,45 @@ The host is registered to the etcd cluster by the `banyand-server` automatically
- `node-host-provider=hostname` : Default. The OS's hostname is registered as the host part in the address.
- `node-host-provider=ip` : The OS's the first non-loopback active IP address(IPv4) is registered as the host part in the address.
- `node-host-provider=flag` : `node-host` is registered as the host part in the address.
+
+## Etcd Client Authentication
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org