github-personal/matchbox
1
0
Fork 0
mirror of https://github.com/outbackdingo/matchbox.git synced 2026-01-27 10:19:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

*: Read-only TLS credentials and limit CipherSuites

Browse Source 
* Group changelog bullet points for readability
This commit is contained in:
Dalton Hubble
2016-06-09 16:52:14 -07:00
parent c0d679ac44
commit d738880a46
3 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
CHANGES.md
View File

@@ -2,16 +2,19 @@
## Latest
* Add gRPC API TLS and TLS client-to-server authentication (#140)
* TLS Authentication:
* Add gRPC API TLS and TLS client-to-server authentication (#140)
* Enable gRPC API by providing a TLS server `-cert-file` and `-key-file`, and a `-ca-file` to authenticate client certificates
* Provide `bootcmd` tool a TLS client `-cert-file` and `-key-file`, and a `-ca-file` to verify the server identity.
* Allow Ignition 2.0.0 JSON and YAML template files (#141)
* Improvements to Ignition Support:
* Allow Ignition 2.0.0 JSON and YAML template files (#141)
* Stop requiring Ignition templates to use file extensions (#176)
* Logging Improvements:
* Show `bootcfg` message at the home path `/`
* Fix http package log messages and increase request logging (#173)
* Log requests for bootcfg hosted assets (#214)
* Error when an Ignition/Cloud-config template is rendered with a machine Group which is missing a metadata value. Previously, missing values defaulted to "no value" (#210)
* Add/improve rkt, Docker, Kubernetes, and binary/systemd deployment docs
* Show `bootcfg` message at the home path `/`
* Fix http package log messages and increase request logging (#173)
* Log requests for bootcfg hosted assets (#214)
* Error when an Ignition/Cloud-config template is rendered with a machine Group which is missing a metadata value. Previously, missing values defaulted to "no value" (#210)
* Stop requiring Ignition templates to use file extensions (#176)
#### Examples

4
Documentation/config.md
View File

@@ -70,7 +70,7 @@ The gRPC API can be enabled with the `-rpc-address` flag and by providing a TLS
Run the ACI with rkt and TLS credentials from `examples/etc/bootcfg`.
sudo rkt --insecure-options=image run --net=metal0:IP=172.15.0.2 --mount volume=data,target=/var/lib/bootcfg --volume data,kind=host,source=$PWD/examples --mount volume=config,target=/etc/bootcfg --volume config,kind=host,source=$PWD/examples/etc/bootcfg --mount volume=groups,target=/var/lib/bootcfg/groups --volume groups,kind=host,source=$PWD/examples/groups/etcd bootcfg.aci -- -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
sudo rkt run --net=metal0:IP=172.15.0.2 --mount volume=data,target=/var/lib/bootcfg --volume data,kind=host,source=$PWD/examples,readOnly=true --mount volume=config,target=/etc/bootcfg --volume config,kind=host,source=$PWD/examples/etc/bootcfg --mount volume=groups,target=/var/lib/bootcfg/groups --volume groups,kind=host,source=$PWD/examples/groups/etcd quay.io/coreos/bootcfg:latest -- -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
A `bootcmd` client can call the gRPC API running at the IP used in the rkt example.
@@ -78,7 +78,7 @@ A `bootcmd` client can call the gRPC API running at the IP used in the rkt examp
Run the Docker image with TLS credentials from `examples/etc/bootcfg`.
sudo docker run -p 8080:8080 -p 8081 --rm -v $PWD/examples:/var/lib/bootcfg:Z -v $PWD/examples/etc/bootcfg:/etc/bootcfg:Z -v $PWD/examples/groups/etcd:/var/lib/bootcfg/groups:Z coreos/bootcfg:latest -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
sudo docker run -p 8080:8080 -p 8081:8081 --rm -v $PWD/examples:/var/lib/bootcfg:Z -v $PWD/examples/etc/bootcfg:/etc/bootcfg:Z,ro -v $PWD/examples/groups/etcd:/var/lib/bootcfg/groups:Z quay.io/coreos/bootcfg:latest -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
A `bootcmd` client can call the gRPC API running at the IP used in the Docker example.

6
bootcfg/tlsutil/info.go
View File

@@ -57,5 +57,11 @@ func (info *TLSInfo) ServerConfig() (*tls.Config, error) {
ClientAuth: tls.RequireAndVerifyClientCert,
// CA for verifying and authorizing client certificates
ClientCAs: pool,
CipherSuites: []uint16{
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
},
}, nil
}