Skip to content

Commit 7f418e7

Browse files
romayalonromayalon
authored
Merge pull request #8545 from romayalon/romy-nc-sts-disable
Refactor endpoint services and certificates start
2 parents e480192 + f186df4 commit 7f418e7

File tree

4 files changed

+113
-99
lines changed

4 files changed

+113
-99
lines changed

‎config.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,9 @@ config.BUFFERS_MEM_LIMIT = Math.min(
7171
// CERTIFICATE CONFIG //
7272
////////////////////////
7373

74-
config.STS_SERVICE_CERT_PATH = '/etc/sts-secret';
7574
config.S3_SERVICE_CERT_PATH = '/etc/s3-secret';
75+
config.STS_SERVICE_CERT_PATH = '/etc/sts-secret';
76+
config.IAM_SERVICE_CERT_PATH = '/etc/iam-secret';
7677
config.MGMT_SERVICE_CERT_PATH = '/etc/mgmt-secret';
7778
config.EXTERNAL_DB_SERVICE_CERT_PATH = '/etc/external-db-secret';
7879

‎src/endpoint/endpoint.js

Lines changed: 106 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ if (process.env.NOOBAA_LOG_LEVEL) {
5454
dbg_conf.endpoint.map(module => dbg.set_module_level(dbg_conf.level, module));
5555
}
5656

57+
const SERVICES_TYPES_ENUM = Object.freeze({
58+
S3: 'S3',
59+
STS: 'STS',
60+
IAM: 'IAM'
61+
});
62+
5763
const new_umask = process.env.NOOBAA_ENDPOINT_UMASK || 0o000;
5864
const old_umask = process.umask(new_umask);
5965
let fork_count;
@@ -114,10 +120,6 @@ async function main(options = {}) {
114120
const metrics_port = options.metrics_port || config.EP_METRICS_SERVER_PORT;
115121
if (fork_utils.start_workers(metrics_port, fork_count)) return;
116122

117-
const http_port = options.http_port || config.ENDPOINT_PORT;
118-
const https_port = options.https_port || config.ENDPOINT_SSL_PORT;
119-
const https_port_sts = options.https_port_sts || Number(process.env.ENDPOINT_SSL_PORT_STS) || 7443;
120-
const https_port_iam = options.https_port_iam || config.ENDPOINT_SSL_IAM_PORT;
121123
const endpoint_group_id = process.env.ENDPOINT_GROUP_ID || 'default-endpoint-group';
122124

123125
const virtual_hosts = Object.freeze(
@@ -182,59 +184,25 @@ async function main(options = {}) {
182184
init_request_sdk = create_init_request_sdk(rpc, internal_rpc_client, object_io);
183185
}
184186

185-
const endpoint_request_handler = create_endpoint_handler(init_request_sdk, virtual_hosts, /*is_sts?*/ false,
186-
bucket_logger, notification_logger);
187-
const endpoint_request_handler_sts = create_endpoint_handler(init_request_sdk, virtual_hosts, /*is_sts?*/ true);
187+
// START S3, STS & IAM SERVERS & CERTS
188+
const http_port_s3 = options.http_port || config.ENDPOINT_PORT;
189+
const https_port_s3 = options.https_port || config.ENDPOINT_SSL_PORT;
190+
const https_port_sts = options.https_port_sts || Number(process.env.ENDPOINT_SSL_PORT_STS) || 7443; // || (process.env.NC_NSFS_NO_DB_ENV === 'true' ? -1 : 7443);
191+
const https_port_iam = options.https_port_iam || config.ENDPOINT_SSL_IAM_PORT;
188192

189-
const ssl_cert_info = await ssl_utils.get_ssl_cert_info('S3', options.nsfs_config_root);
190-
const https_server = await create_https_server(ssl_cert_info, true, endpoint_request_handler);
191-
const sts_ssl_cert_info = await ssl_utils.get_ssl_cert_info('STS');
192-
const https_server_sts = await create_https_server(sts_ssl_cert_info, true, endpoint_request_handler_sts);
193+
await start_server_and_cert(SERVICES_TYPES_ENUM.S3, init_request_sdk,
194+
{ ...options, https_port: https_port_s3, http_port: http_port_s3, virtual_hosts, bucket_logger, notification_logger });
195+
await start_server_and_cert(SERVICES_TYPES_ENUM.STS, init_request_sdk, { https_port: https_port_sts, virtual_hosts });
196+
await start_server_and_cert(SERVICES_TYPES_ENUM.IAM, init_request_sdk, { https_port: https_port_iam });
193197

194-
ssl_cert_info.on('update', updated_ssl_cert_info => {
195-
dbg.log0("Setting updated S3 ssl certs for endpoint.");
196-
const updated_ssl_options = { ...updated_ssl_cert_info.cert, honorCipherOrder: true };
197-
https_server.setSecureContext(updated_ssl_options);
198-
});
199-
sts_ssl_cert_info.on('update', updated_sts_ssl_cert_info => {
200-
dbg.log0("Setting updated STS ssl certs for endpoint.");
201-
const updated_ssl_options = { ...updated_sts_ssl_cert_info.cert, honorCipherOrder: true };
202-
https_server_sts.setSecureContext(updated_ssl_options);
203-
});
204-
if (options.nsfs_config_root && !config.ALLOW_HTTP) {
205-
dbg.warn('HTTP is not allowed for NC NSFS.');
206-
} else {
207-
const http_server = http.createServer(endpoint_request_handler);
208-
if (http_port > 0) {
209-
dbg.log0('Starting S3 HTTP', http_port);
210-
await listen_http(http_port, http_server);
211-
dbg.log0('Started S3 HTTP successfully');
212-
}
213-
}
214-
if (https_port > 0) {
215-
dbg.log0('Starting S3 HTTPS', https_port);
216-
await listen_http(https_port, https_server);
217-
dbg.log0('Started S3 HTTPS successfully');
218-
}
219-
if (https_port_sts > 0) {
220-
dbg.log0('Starting STS HTTPS', https_port_sts);
221-
await listen_http(https_port_sts, https_server_sts);
222-
dbg.log0('Started STS HTTPS successfully');
223-
}
224-
if (https_port_iam > 0) {
225-
dbg.log0('Starting IAM HTTPS', https_port_iam);
226-
const endpoint_request_handler_iam = create_endpoint_handler_iam(init_request_sdk);
227-
// NOTE: The IAM server currently uses the S3 server's certificate. This *will* cause route failures in Openshift.
228-
// TODO: Generate, mount and utilize an appropriate IAM certificate once the service and route are implemented
229-
const https_server_iam = await create_https_server(ssl_cert_info, true, endpoint_request_handler_iam);
230-
await listen_http(https_port_iam, https_server_iam);
231-
dbg.log0('Started IAM HTTPS successfully');
232-
}
198+
199+
// START METRICS SERVER
233200
if (metrics_port > 0 && cluster.isPrimary) {
234201
dbg.log0('Starting metrics server', metrics_port);
235202
await prom_reporting.start_server(metrics_port, false);
236203
dbg.log0('Started metrics server successfully');
237204
}
205+
238206
// TODO: currently NC NSFS deployments don't have internal_rpc_client nor db,
239207
// there for namespace monitor won't be registered
240208
if (internal_rpc_client && config.NAMESPACE_MONITOR_ENABLED) {
@@ -271,54 +239,99 @@ async function main(options = {}) {
271239
}
272240

273241
/**
274-
* @param {EndpointHandler} init_request_sdk
275-
* @param {readonly string[]} virtual_hosts
276-
* @returns {EndpointHandler}
242+
* start_server_and_cert starts the server by type and options and creates a certificate if required
243+
* @param {('S3'|'IAM'|'STS')} server_type
244+
* @param {EndpointHandler} init_request_sdk
245+
* @param {{ http_port?: number, https_port?: number, virtual_hosts?: readonly string[],
246+
* bucket_logger?: PersistentLogger, notification_logger?: PersistentLogger,
247+
* nsfs_config_root?: string}} options
277248
*/
278-
function create_endpoint_handler(init_request_sdk, virtual_hosts, sts, logger, notification_logger) {
279-
const blob_rest_handler = process.env.ENDPOINT_BLOB_ENABLED === 'true' ? blob_rest : unavailable_handler;
280-
const lambda_rest_handler = config.DB_TYPE === 'mongodb' ? lambda_rest : unavailable_handler;
281-
282-
/** @type {EndpointHandler} */
283-
const endpoint_request_handler = (req, res) => {
284-
endpoint_utils.set_noobaa_server_header(res);
285-
endpoint_utils.prepare_rest_request(req);
286-
req.virtual_hosts = virtual_hosts;
287-
if (logger) req.bucket_logger = logger;
288-
if (notification_logger) req.notification_logger = notification_logger;
289-
init_request_sdk(req, res);
290-
if (req.url.startsWith('/2015-03-31/functions')) {
291-
return lambda_rest_handler(req, res);
292-
} else if (req.headers['x-ms-version']) {
293-
return blob_rest_handler(req, res);
294-
} else if (req.url.startsWith('/total_fork_count')) {
295-
return fork_count_handler(req, res);
296-
} else if (req.url.startsWith('/endpoint_fork_id')) {
297-
return endpoint_fork_id_handler(req, res);
249+
async function start_server_and_cert(server_type, init_request_sdk, options = {}) {
250+
const { http_port, https_port, nsfs_config_root } = options;
251+
const endpoint_request_handler = create_endpoint_handler(server_type, init_request_sdk, options);
252+
253+
if (server_type === SERVICES_TYPES_ENUM.S3) {
254+
if (nsfs_config_root && !config.ALLOW_HTTP) {
255+
dbg.warn('HTTP is not allowed for NC NSFS.');
298256
} else {
299-
return s3_rest.handler(req, res);
257+
const http_server = http.createServer(endpoint_request_handler);
258+
if (http_port > 0) {
259+
dbg.log0(`Starting ${server_type} HTTP - ${http_port}`);
260+
await listen_http(http_port, http_server);
261+
dbg.log0(`Started ${server_type} HTTP successfully`);
262+
}
300263
}
301-
};
302-
/** @type {EndpointHandler} */
303-
const endpoint_sts_request_handler = (req, res) => {
304-
endpoint_utils.set_noobaa_server_header(res);
305-
endpoint_utils.prepare_rest_request(req);
306-
init_request_sdk(req, res);
307-
return sts_rest(req, res);
308-
};
309-
310-
return sts ? endpoint_sts_request_handler : endpoint_request_handler;
264+
}
265+
if (https_port > 0) {
266+
const ssl_cert_info = await ssl_utils.get_ssl_cert_info(server_type, nsfs_config_root);
267+
const https_server = await create_https_server(ssl_cert_info, true, endpoint_request_handler);
268+
ssl_cert_info.on('update', updated_ssl_cert_info => {
269+
dbg.log0(`Setting updated ${server_type} ssl certs for endpoint.`);
270+
const updated_ssl_options = { ...updated_ssl_cert_info.cert, honorCipherOrder: true };
271+
https_server.setSecureContext(updated_ssl_options);
272+
});
273+
dbg.log0(`Starting ${server_type} HTTPS - ${https_port}`);
274+
await listen_http(https_port, https_server);
275+
dbg.log0(`Started ${server_type} HTTPS successfully`);
276+
}
311277
}
312278

313-
function create_endpoint_handler_iam(init_request_sdk) {
314-
/** @type {EndpointHandler} */
315-
const endpoint_iam_request_handler = (req, res) => {
316-
endpoint_utils.set_noobaa_server_header(res);
317-
endpoint_utils.prepare_rest_request(req);
318-
init_request_sdk(req, res);
319-
return iam_rest(req, res);
320-
};
321-
return endpoint_iam_request_handler;
279+
/**
280+
* @param {('S3'|'IAM'|'STS')} server_type
281+
* @param {EndpointHandler} init_request_sdk
282+
* @param {{virtual_hosts?: readonly string[], bucket_logger?: PersistentLogger, notification_logger?: PersistentLogger}} options
283+
* @returns {EndpointHandler}
284+
*/
285+
function create_endpoint_handler(server_type, init_request_sdk, { virtual_hosts, bucket_logger, notification_logger }) {
286+
if (server_type === SERVICES_TYPES_ENUM.S3) {
287+
const blob_rest_handler = process.env.ENDPOINT_BLOB_ENABLED === 'true' ? blob_rest : unavailable_handler;
288+
const lambda_rest_handler = config.DB_TYPE === 'mongodb' ? lambda_rest : unavailable_handler;
289+
290+
/** @type {EndpointHandler} */
291+
const s3_endpoint_request_handler = (req, res) => {
292+
endpoint_utils.set_noobaa_server_header(res);
293+
endpoint_utils.prepare_rest_request(req);
294+
req.virtual_hosts = virtual_hosts;
295+
if (bucket_logger) req.bucket_logger = bucket_logger;
296+
if (notification_logger) req.notification_logger = notification_logger;
297+
init_request_sdk(req, res);
298+
if (req.url.startsWith('/2015-03-31/functions')) {
299+
return lambda_rest_handler(req, res);
300+
} else if (req.headers['x-ms-version']) {
301+
return blob_rest_handler(req, res);
302+
} else if (req.url.startsWith('/total_fork_count')) {
303+
return fork_count_handler(req, res);
304+
} else if (req.url.startsWith('/endpoint_fork_id')) {
305+
return endpoint_fork_id_handler(req, res);
306+
} else {
307+
return s3_rest.handler(req, res);
308+
}
309+
};
310+
return s3_endpoint_request_handler;
311+
}
312+
313+
if (server_type === SERVICES_TYPES_ENUM.STS) {
314+
/** @type {EndpointHandler} */
315+
const sts_endpoint_request_handler = (req, res) => {
316+
endpoint_utils.set_noobaa_server_header(res);
317+
endpoint_utils.prepare_rest_request(req);
318+
// req.virtual_hosts = virtual_hosts;
319+
init_request_sdk(req, res);
320+
return sts_rest(req, res);
321+
};
322+
return sts_endpoint_request_handler;
323+
}
324+
325+
if (server_type === SERVICES_TYPES_ENUM.IAM) {
326+
/** @type {EndpointHandler} */
327+
const iam_endpoint_request_handler = (req, res) => {
328+
endpoint_utils.set_noobaa_server_header(res);
329+
endpoint_utils.prepare_rest_request(req);
330+
init_request_sdk(req, res);
331+
return iam_rest(req, res);
332+
};
333+
return iam_endpoint_request_handler;
334+
}
322335
}
323336

324337
function endpoint_fork_id_handler(req, res) {
@@ -547,7 +560,6 @@ function setup_http_server(server) {
547560

548561
exports.main = main;
549562
exports.create_endpoint_handler = create_endpoint_handler;
550-
exports.create_endpoint_handler_iam = create_endpoint_handler_iam;
551563
exports.create_init_request_sdk = create_init_request_sdk;
552564

553565
if (require.main === module) main();

‎src/test/unit_tests/coretest.js

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -133,10 +133,10 @@ function setup(options = {}) {
133133
(service, srv) => api_coverage.add(srv));
134134

135135
const object_io = new ObjectIO();
136-
const endpoint_request_handler = endpoint.create_endpoint_handler(
137-
endpoint.create_init_request_sdk(server_rpc.rpc, rpc_client, object_io), [], false);
138-
const endpoint_request_handler_sts = endpoint.create_endpoint_handler(
139-
endpoint.create_init_request_sdk(server_rpc.rpc, rpc_client, object_io), [], true);
136+
const endpoint_request_handler = endpoint.create_endpoint_handler('S3',
137+
endpoint.create_init_request_sdk(server_rpc.rpc, rpc_client, object_io), { virtual_hosts: [] });
138+
const endpoint_request_handler_sts = endpoint.create_endpoint_handler('STS',
139+
endpoint.create_init_request_sdk(server_rpc.rpc, rpc_client, object_io), { virtual_hosts: [] });
140140

141141
async function announce(msg) {
142142
if (process.env.SUPPRESS_LOGS) return;

‎src/util/ssl_utils.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ const certs = {
4646
S3: new CertInfo(config.S3_SERVICE_CERT_PATH),
4747
EXTERNAL_DB: new CertInfo(config.EXTERNAL_DB_SERVICE_CERT_PATH),
4848
STS: new CertInfo(config.STS_SERVICE_CERT_PATH),
49+
IAM: new CertInfo(config.IAM_SERVICE_CERT_PATH)
4950
};
5051

5152
function generate_ssl_certificate() {

0 commit comments

Comments
 (0)