Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-06-25 14:40:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

move key derivation to joinservice instead of joinclient

Browse source
This commit is contained in:
miampf 2025-01-16 13:26:32 +01:00
parent 19181af13d
commit f386dbc95f
No known key found for this signature in database
GPG key ID: EF039364B5B6886C
4 changed files with 11 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
bootstrapper/internal/joinclient/BUILD.bazel
View file

@ -11,7 +11,6 @@ go_library(
"//internal/attestation", "//internal/attestation",
"//internal/cloud/metadata", "//internal/cloud/metadata",
"//internal/constants", "//internal/constants",
"//internal/crypto",
"//internal/file", "//internal/file",
"//internal/nodestate", "//internal/nodestate",
"//internal/role", "//internal/role",
@ -22,7 +21,6 @@ go_library(
"@io_k8s_kubernetes//cmd/kubeadm/app/constants", "@io_k8s_kubernetes//cmd/kubeadm/app/constants",
"@io_k8s_utils//clock", "@io_k8s_utils//clock",
"@org_golang_google_grpc//:grpc", "@org_golang_google_grpc//:grpc",
"@org_golang_x_crypto//ssh",
], ],
) )

9
bootstrapper/internal/joinclient/joinclient.go
View file

@ -31,14 +31,12 @@ import (
"github.com/edgelesssys/constellation/v2/internal/attestation" "github.com/edgelesssys/constellation/v2/internal/attestation"
"github.com/edgelesssys/constellation/v2/internal/cloud/metadata" "github.com/edgelesssys/constellation/v2/internal/cloud/metadata"
"github.com/edgelesssys/constellation/v2/internal/constants" "github.com/edgelesssys/constellation/v2/internal/constants"
"github.com/edgelesssys/constellation/v2/internal/crypto"
"github.com/edgelesssys/constellation/v2/internal/file" "github.com/edgelesssys/constellation/v2/internal/file"
"github.com/edgelesssys/constellation/v2/internal/nodestate" "github.com/edgelesssys/constellation/v2/internal/nodestate"
"github.com/edgelesssys/constellation/v2/internal/role" "github.com/edgelesssys/constellation/v2/internal/role"
"github.com/edgelesssys/constellation/v2/internal/versions/components" "github.com/edgelesssys/constellation/v2/internal/versions/components"
"github.com/edgelesssys/constellation/v2/joinservice/joinproto" "github.com/edgelesssys/constellation/v2/joinservice/joinproto"
"github.com/spf13/afero" "github.com/spf13/afero"
"golang.org/x/crypto/ssh"
"google.golang.org/grpc" "google.golang.org/grpc"
kubeadm "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3" kubeadm "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
kubeconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants" kubeconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
@ -273,12 +271,7 @@ func (c *JoinClient) startNodeAndJoin(ticket *joinproto.IssueJoinTicketResponse,
return fmt.Errorf("writing kubelet key: %w", err) return fmt.Errorf("writing kubelet key: %w", err)
} }
ca, err := crypto.GenerateEmergencySSHCAKey(ticket.EmergencyCaKey) if err := c.fileHandler.Write(constants.SSHCAKeyPath, ticket.EmergencyCaKey, file.OptMkdirAll); err != nil {
if err != nil {
return fmt.Errorf("generating emergency SSH CA key: %s", err)
}
if err := c.fileHandler.Write(constants.SSHCAKeyPath, ssh.MarshalAuthorizedKey(ca.PublicKey()), file.OptMkdirAll); err != nil {
return fmt.Errorf("writing ca key: %w", err) return fmt.Errorf("writing ca key: %w", err)
} }

1
joinservice/internal/server/BUILD.bazel
View file

@ -19,6 +19,7 @@ go_library(
"@org_golang_google_grpc//codes", "@org_golang_google_grpc//codes",
"@org_golang_google_grpc//credentials", "@org_golang_google_grpc//credentials",
"@org_golang_google_grpc//status", "@org_golang_google_grpc//status",
"@org_golang_x_crypto//ssh",
], ],
) )

11
joinservice/internal/server/server.go
View file

@ -9,6 +9,7 @@ package server
import ( import (
"context" "context"
"crypto/ed25519"
"fmt" "fmt"
"log/slog" "log/slog"
"net" "net"
@ -21,6 +22,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/logger" "github.com/edgelesssys/constellation/v2/internal/logger"
"github.com/edgelesssys/constellation/v2/internal/versions/components" "github.com/edgelesssys/constellation/v2/internal/versions/components"
"github.com/edgelesssys/constellation/v2/joinservice/joinproto" "github.com/edgelesssys/constellation/v2/joinservice/joinproto"
"golang.org/x/crypto/ssh"
"google.golang.org/grpc" "google.golang.org/grpc"
"google.golang.org/grpc/codes" "google.golang.org/grpc/codes"
"google.golang.org/grpc/credentials" "google.golang.org/grpc/credentials"
@ -101,11 +103,16 @@ func (s *Server) IssueJoinTicket(ctx context.Context, req *joinproto.IssueJoinTi
} }
log.Info("Requesting emergency SSH CA derivation key") log.Info("Requesting emergency SSH CA derivation key")
sshCAKey, err := s.dataKeyGetter.GetDataKey(ctx, constants.SSHCAKeySuffix, 256) ssheCADerivationKey, err := s.dataKeyGetter.GetDataKey(ctx, constants.SSHCAKeySuffix, ed25519.SeedSize)
if err != nil { if err != nil {
log.With(slog.Any("error", err)).Error("Failed to get emergency SSH CA derivation key") log.With(slog.Any("error", err)).Error("Failed to get emergency SSH CA derivation key")
return nil, status.Errorf(codes.Internal, "getting emergency SSH CA derivation key: %s", err) return nil, status.Errorf(codes.Internal, "getting emergency SSH CA derivation key: %s", err)
} }
ca, err := crypto.GenerateEmergencySSHCAKey(ssheCADerivationKey)
if err != nil {
log.With(slog.Any("error", err)).Error("Failed to derive ssh CA key from derivation key")
return nil, status.Errorf(codes.Internal, "generating ssh emergency CA key: %s", err)
}
log.Info("Creating Kubernetes join token") log.Info("Creating Kubernetes join token")
kubeArgs, err := s.joinTokenGetter.GetJoinToken(constants.KubernetesJoinTokenTTL) kubeArgs, err := s.joinTokenGetter.GetJoinToken(constants.KubernetesJoinTokenTTL)
@ -174,7 +181,7 @@ func (s *Server) IssueJoinTicket(ctx context.Context, req *joinproto.IssueJoinTi
KubeletCert: kubeletCert, KubeletCert: kubeletCert,
ControlPlaneFiles: controlPlaneFiles, ControlPlaneFiles: controlPlaneFiles,
KubernetesComponents: components, KubernetesComponents: components,
EmergencyCaKey: sshCAKey, EmergencyCaKey: ssh.MarshalAuthorizedKey(ca.PublicKey()),
}, nil }, nil
} }